Merge pull request #323 from flatcar-linux/krnowak/pkg-updates-2021-part-1-profiles

Package updates, 2021 edition, part 1 - fallout fixes from the update of profiles in portage-stable

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/Manifest

@@ -1 +1,2 @@
 DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470
+DIST krb5-1.19.3.tar.gz 8741343 BLAKE2B 79e68237ee82affa85299060c509e303453c0fab965adc6b9ed305ab64a1f73bd51e65df1b3faadc60815cd506ffefaeed535765ca060d393a9141812f85b48a SHA512 18235440d6f7d8a72c5d7ca5cd8c6465e8adf091d85c483225c7b00d64b4688c1c7924cb800c2fc17e590b2709f1a9de48e6ec79f6debd11dcb7d6fa16c6f351

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.2-r4.ebuild

@@ -14,7 +14,7 @@ SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
 
 LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
 
 # some tests requires network access
@@ -22,18 +22,15 @@ RESTRICT="test"
 
 DEPEND="
 	!!app-crypt/heimdal
-	|| (
 	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
-		sys-libs/e2fsprogs-libs[${MULTILIB_USEDEP}]
-	)
 	|| (
 		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
 		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
 	)
 	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
-	lmdb? ( dev-db/lmdb )
+	lmdb? ( dev-db/lmdb:= )
 	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
 	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
 	xinetd? ( sys-apps/xinetd )
 	"

sdk_container/src/third_party/portage-stable/app-crypt/mit-krb5/mit-krb5-1.19.3-r2.ebuild

@@ -0,0 +1,161 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{8..10} )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+# some tests requires network access
+RESTRICT="test"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb:= )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1:=[${MULTILIB_USEDEP}] )
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? (
+		${PYTHON_DEPS}
+		dev-lang/tcl:0
+		dev-util/dejagnu
+		dev-util/cmocka
+	)"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# QA
+	append-flags -fno-strict-aliasing
+	append-flags -fno-strict-overflow
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_enable threads thread-support) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--disable-rpath
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest

@@ -1,3 +1,3 @@
-DIST qemu-6.0.0.tar.xz 107333232 BLAKE2B 7746329d3e13782b7c346ce4052cc517cfc65cd9b2d514d199e4d5b8570ca79566ec04b0c114db2e97c84e68eb551e0d4cdce1b14b91a88fe08d2a5f682c1418 SHA512 ee3ff00aebec4d8891d2ff6dabe4e667e510b2a4fe3f6190aa34673a91ea32dcd2db2e9bf94c2f1bf05aa79788f17cfbbedc6027c0988ea08a92587b79ee05e4
-DIST qemu-6.0.1.tar.xz 107084292 BLAKE2B 53f4adc1a4ba99aaf03659db499d557c57d0c2559955980591594bf0ed06aaf485f0192d7f8f68338b97e0d4d0a114e4431bae5e5b3f3fc82aef08616429d8ed SHA512 2e37ae97a56c4de71412ebabe0e0a59908a7ca7d353440e046831319456d4020614f0909af07cb2a8bb23423e84880a89b5aa4e463e95d1ad37a64fbf8021337
-DIST qemu-6.1.0.tar.xz 111258808 BLAKE2B 412eecf6d39debd6089b26d3b22e5d25c6c8c30d2eaf31b17c25cc2b3a1b10794a30218dfb151c78801aa295255aa974b297f1fe05b93f14334f203c2af5ccee SHA512 3378ae21c75b77ee6a759827f1fcf7b2a50a0fef07e3b0e89117108022a8d8655fa977e4d65596f4f24f7c735c6594d44b0c6f69732ea4465e88a7406b1d5d3c
+DIST qemu-6.2.0.tar.xz 115667324 BLAKE2B 3f2f02e5c36113df6231a9474c6d5db774e541312173813c28f578d669a51f391695d364dc806f5906d9e3c2796bb20b2606fcd46a247eb751ea517de9d7ce15 SHA512 e9f8231c9e1cfcc41cb47f10a55d63f6b8aee307af00cf6acf64acb7aa4f49fa7e9d6330703a2abea15d8b7bbaba7d3cb08c83edd98d82642367b527df730817
+DIST qemu-7.0.0-rc4.tar.xz 125126604 BLAKE2B e1614daf71ff2625cdd8307812d6dfc4103c7c8a981b49fdda7409b8b4749e2d8354d3f8e903791100e966744485148c9b70ff046c0f8c2b1259a4997a245248 SHA512 ca0e8f5f1608b36f8ad8d9e6aeeb00e07af23e59ffecbda84c4c34bbe686a53c481e26bcedd13165363057cab063dcda7e5191dd5aff2798fde5be711c6dd2ff
+DIST qemu-7.0.0.tar.xz 125117636 BLAKE2B ceda6d9f1a585298bd49fed61e8bb35f0064ad8388a9f979c8bd68a38bfe1a47c5bb055e5f74f970c2c440957042b9de4a861524120040c56e4cd8b56c5cfb68 SHA512 44ecd10c018a3763e1bc87d1d35b98890d0d5636acd69fe9b5cadf5024d5af6a31684d60cbe1c3370e02986434c1fb0ad99224e0e6f6fe7eda169992508157b1

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-5.2.0-cleaner-werror.patch

@@ -1,40 +0,0 @@
--Wall -Wextra compains about unused arguments,
-causes safe-stack to be mis-detected.
---- a/configure
-+++ b/configure
-@@ -2293,7 +2293,7 @@ fi
- cat > $TMPC << EOF
- #include <stdint.h>
- #include <stdio.h>
--int main(int argc, char *argv[]) {
-+int main(void) {
-     return printf("%zu", SIZE_MAX);
- }
- EOF
-@@ -4911,7 +4911,7 @@ fi
- 
- if test "$safe_stack" = "yes"; then
- cat > $TMPC << EOF
--int main(int argc, char *argv[])
-+int main(void)
- {
- #if ! __has_feature(safe_stack)
- #error SafeStack Disabled
-@@ -4933,7 +4933,7 @@ EOF
-   fi
- else
- cat > $TMPC << EOF
--int main(int argc, char *argv[])
-+int main(void)
- {
- #if defined(__has_feature)
- #if __has_feature(safe_stack)
-@@ -5283,7 +5283,7 @@ static const int Z = 1;
- #define TAUT(X) ((X) == Z)
- #define PAREN(X, Y) (X == Y)
- #define ID(X) (X)
--int main(int argc, char *argv[])
-+int main(void)
- {
-     int x = 0, y = 0;
-     x = ID(x);

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-5.2.0-dce-locks.patch

@@ -1,18 +0,0 @@
-Fix CFLAGS=-Og build break. -Og fails because gcc does not enable dead
-code elimination (but does set __OPTIMIZE__ define).
-
-The fix avoids DCE reliance downstream entirely.
-
-Reported-by: Luke-Jr
-Bug: https://bugs.gentoo.org/782364
---- a/include/qemu/lockable.h
-+++ b/include/qemu/lockable.h
-@@ -28,7 +28,7 @@ struct QemuLockable {
-  * to QEMU_MAKE_LOCKABLE.  For optimized builds, we can rely on dead-code elimination
-  * from the compiler, and give the errors already at link time.
-  */
--#if defined(__OPTIMIZE__) && !defined(__SANITIZE_ADDRESS__)
-+#if defined(__OPTIMIZE__) && !defined(__SANITIZE_ADDRESS__) && defined(VALIDATE_LOCKS_VIA_DCE)
- void unknown_lock_type(void *);
- #else
- static inline void unknown_lock_type(void *unused)

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-5.2.0-strings.patch

@@ -1,23 +0,0 @@
-https://bugs.gentoo.org/759310
---- a/configure
-+++ b/configure
-@@ -521,6 +521,7 @@ ld="${LD-${cross_prefix}ld}"
- ranlib="${RANLIB-${cross_prefix}ranlib}"
- nm="${NM-${cross_prefix}nm}"
- strip="${STRIP-${cross_prefix}strip}"
-+strings="${STRINGS-${cross_prefix}strings}"
- windres="${WINDRES-${cross_prefix}windres}"
- pkg_config_exe="${PKG_CONFIG-${cross_prefix}pkg-config}"
- query_pkg_config() {
-@@ -2265,9 +2266,9 @@ int main(int argc, char *argv[]) {
- EOF
- 
- if compile_object ; then
--    if strings -a $TMPO | grep -q BiGeNdIaN ; then
-+    if $strings -a $TMPO | grep -q BiGeNdIaN ; then
-         bigendian="yes"
--    elif strings -a $TMPO | grep -q LiTtLeEnDiAn ; then
-+    elif $strings -a $TMPO | grep -q LiTtLeEnDiAn ; then
-         bigendian="no"
-     else
-         echo big/little test failed

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-6.1.0-automagic-libbpf.patch

@@ -1,21 +0,0 @@
-commit 080832e4f4801a28bd1170c49e61f6a0f5f05d03
-Author: Paolo Bonzini <pbonzini@redhat.com>
-Date:   Tue Sep 7 12:45:12 2021 +0200
-
-    ebpf: only include in system emulators
-    
-    eBPF files are being included in user emulators, which is useless and
-    also breaks compilation because ebpf/trace-events is only processed
-    if a system emulator is included in the build.
-    
-    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/566
-    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-    Signed-off-by: Jason Wang <jasowang@redhat.com>
-
-diff --git a/ebpf/meson.build b/ebpf/meson.build
-index 9cd0635370..2dd0fd8948 100644
---- a/ebpf/meson.build
-+++ b/ebpf/meson.build
-@@ -1 +1 @@
--common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
-+softmmu_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-6.2.0-also-build-virtfs-proxy-helper.patch

@@ -0,0 +1,34 @@
+From 42e53a0aadb76dfa7c11cd3b14eb4a41efba9bbe Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Tue, 11 Jan 2022 07:20:31 -0600
+Subject: [PATCH] also build virtfs-proxy-helper
+
+The Gentoo ebuild splits the qemu build into a softmmu, user and tool
+phase in order to be able to build and link some of the qemu emulators
+statically. This unfortunately has the consequence that we never
+configure with "have_virtfs" and "have_tools" at the same time.
+
+As a workaround, simply build the virtfs userland unconditionally. After
+all, it is a tiny executable
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index fbe856700..d6918b04c 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1390,7 +1390,7 @@ have_virtfs = (targetos == 'linux' and
+     libattr.found() and
+     libcap_ng.found())
+ 
+-have_virtfs_proxy_helper = have_virtfs and have_tools
++have_virtfs_proxy_helper = have_tools and libcap_ng.found()
+
+
+ 
+ if get_option('virtfs').enabled()
+   if not have_virtfs
+-- 
+2.34.1
+

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-6.2.0-glibc-2.35-rseq-seccomp-virtiofsd.patch

@@ -0,0 +1,61 @@
+https://gitlab.com/qemu/qemu/-/commit/7b223e38603de3a75602e14914d26f9d4baf52eb.patch
+https://bugs.gentoo.org/836300
+
+From 7b223e38603de3a75602e14914d26f9d4baf52eb Mon Sep 17 00:00:00 2001
+From: Christian Ehrhardt <christian.ehrhardt@canonical.com>
+Date: Wed, 9 Feb 2022 12:14:56 +0100
+Subject: [PATCH] tools/virtiofsd: Add rseq syscall to the seccomp allowlist
+
+The virtiofsd currently crashes when used with glibc 2.35.
+That is due to the rseq system call being added to every thread
+creation [1][2].
+
+[1]: https://www.efficios.com/blog/2019/02/08/linux-restartable-sequences/
+[2]: https://sourceware.org/pipermail/libc-alpha/2022-February/136040.html
+
+This happens not at daemon start, but when a guest connects
+
+    /usr/lib/qemu/virtiofsd -f --socket-path=/tmp/testvfsd -o sandbox=chroot \
+        -o source=/var/guests/j-virtiofs --socket-group=kvm
+    virtio_session_mount: Waiting for vhost-user socket connection...
+    # start ok, now guest will connect
+    virtio_session_mount: Received vhost-user socket connection
+    virtio_loop: Entry
+    fv_queue_set_started: qidx=0 started=1
+    fv_queue_set_started: qidx=1 started=1
+    Bad system call (core dumped)
+
+We have to put rseq on the seccomp allowlist to avoid that the daemon
+is crashing in this case.
+
+Reported-by: Michael Hudson-Doyle <michael.hudson@canonical.com>
+Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
+Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Message-id: 20220209111456.3328420-1-christian.ehrhardt@canonical.com
+
+[Moved rseq to its alphabetically ordered position in the seccomp
+allowlist.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tools/virtiofsd/passthrough_seccomp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/virtiofsd/passthrough_seccomp.c b/tools/virtiofsd/passthrough_seccomp.c
+index a3ce9f898d..2bc0127b69 100644
+--- a/tools/virtiofsd/passthrough_seccomp.c
++++ b/tools/virtiofsd/passthrough_seccomp.c
+@@ -91,6 +91,9 @@ static const int syscall_allowlist[] = {
+     SCMP_SYS(renameat2),
+     SCMP_SYS(removexattr),
+     SCMP_SYS(restart_syscall),
++#ifdef __NR_rseq
++    SCMP_SYS(rseq), /* required since glibc 2.35 */
++#endif
+     SCMP_SYS(rt_sigaction),
+     SCMP_SYS(rt_sigprocmask),
+     SCMP_SYS(rt_sigreturn),
+-- 
+GitLab
+
+

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-6.2.0-user-SLIC-crash.patch

@@ -0,0 +1,173 @@
+Gentoo bug: https://bugs.gentoo.org/830170
+Upstream bug: https://gitlab.com/qemu-project/qemu/-/issues/786
+Patches taken from
+https://lore.kernel.org/qemu-devel/20211227193120.1084176-1-imammedo@redhat.com/
+
+commit dce6c86f54eab61028e110497c222e73381379df
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:17 2021 -0500
+
+    acpi: fix QEMU crash when started with SLIC table
+    
+    if QEMU is started with used provided SLIC table blob,
+    
+      -acpitable sig=SLIC,oem_id='CRASH ',oem_table_id="ME",oem_rev=00002210,asl_compiler_id="",asl_compiler_rev=00000000,data=/dev/null
+    it will assert with:
+    
+      hw/acpi/aml-build.c:61:build_append_padded_str: assertion failed: (len <= maxlen)
+    
+    and following backtrace:
+    
+      ...
+      build_append_padded_str (array=0x555556afe320, str=0x555556afdb2e "CRASH ME", maxlen=0x6, pad=0x20) at hw/acpi/aml-build.c:61
+      acpi_table_begin (desc=0x7fffffffd1b0, array=0x555556afe320) at hw/acpi/aml-build.c:1727
+      build_fadt (tbl=0x555556afe320, linker=0x555557ca3830, f=0x7fffffffd318, oem_id=0x555556afdb2e "CRASH ME", oem_table_id=0x555556afdb34 "ME") at hw/acpi/aml-build.c:2064
+      ...
+    
+    which happens due to acpi_table_begin() expecting NULL terminated
+    oem_id and oem_table_id strings, which is normally the case, but
+    in case of user provided SLIC table, oem_id points to table's blob
+    directly and as result oem_id became longer than expected.
+    
+    Fix issue by handling oem_id consistently and make acpi_get_slic_oem()
+    return NULL terminated strings.
+    
+    PS:
+    After [1] refactoring, oem_id semantics became inconsistent, where
+    NULL terminated string was coming from machine and old way pointer
+    into byte array coming from -acpitable option. That used to work
+    since build_header() wasn't expecting NULL terminated string and
+    blindly copied the 1st 6 bytes only.
+    
+    However commit [2] broke that by replacing build_header() with
+    acpi_table_begin(), which was expecting NULL terminated string
+    and was checking oem_id size.
+    
+    1) 602b45820 ("acpi: Permit OEM ID and OEM table ID fields to be changed")
+    2)
+    Fixes: 4b56e1e4eb08 ("acpi: build_fadt: use acpi_table_begin()/acpi_table_end() instead of build_header()")
+    Resolves: https://gitlab.com/qemu-project/qemu/-/issues/786
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+
+diff --git a/hw/acpi/core.c b/hw/acpi/core.c
+index 1e004d0078..3e811bf03c 100644
+--- a/hw/acpi/core.c
++++ b/hw/acpi/core.c
+@@ -345,8 +345,8 @@ int acpi_get_slic_oem(AcpiSlicOem *oem)
+         struct acpi_table_header *hdr = (void *)(u - sizeof(hdr->_length));
+ 
+         if (memcmp(hdr->sig, "SLIC", 4) == 0) {
+-            oem->id = hdr->oem_id;
+-            oem->table_id = hdr->oem_table_id;
++            oem->id = g_strndup(hdr->oem_id, 6);
++            oem->table_id = g_strndup(hdr->oem_table_id, 8);
+             return 0;
+         }
+     }
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index a99c6e4fe3..570f82997b 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -2721,6 +2721,8 @@ void acpi_build(AcpiBuildTables *tables, MachineState *machine)
+ 
+     /* Cleanup memory that's no longer used. */
+     g_array_free(table_offsets, true);
++    g_free(slic_oem.id);
++    g_free(slic_oem.table_id);
+ }
+ 
+ static void acpi_ram_update(MemoryRegion *mr, GArray *data)
+
+commit a22de122ad03ea40953ad0328b2c3e31002d8052
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:18 2021 -0500
+
+    tests: acpi: whitelist expected blobs before changing them
+    
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+
+diff --git a/tests/data/acpi/q35/FACP.slic b/tests/data/acpi/q35/FACP.slic
+new file mode 100644
+index 0000000000..f6a864cc86
+Binary files /dev/null and b/tests/data/acpi/q35/FACP.slic differ
+diff --git a/tests/data/acpi/q35/SLIC.slic b/tests/data/acpi/q35/SLIC.slic
+new file mode 100644
+index 0000000000..e69de29bb2
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
+index dfb8523c8b..49dbf8fa3e 100644
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
+@@ -1 +1,3 @@
+ /* List of comma-separated changed AML files to ignore */
++"tests/data/acpi/q35/FACP.slic",
++"tests/data/acpi/q35/SLIC.slic",
+
+commit cb913395d76f8fdfd7f1d0c8ea77d4710821bbd3
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:19 2021 -0500
+
+    tests: acpi: add SLIC table test
+    
+    When user uses '-acpitable' to add SLIC table, some ACPI
+    tables (FADT) will change its 'Oem ID'/'Oem Table ID' fields to
+    match that of SLIC. Test makes sure thati QEMU handles
+    those fields correctly when SLIC table is added with
+    '-acpitable' option.
+    
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+
+diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
+index 258874167e..ae7ef13ec7 100644
+--- a/tests/qtest/bios-tables-test.c
++++ b/tests/qtest/bios-tables-test.c
+@@ -1567,6 +1567,19 @@ static void test_acpi_oem_fields_virt(void)
+     g_free(args);
+ }
+
++static void test_acpi_q35_slic(void)
++{
++    test_data data = {
++        .machine = MACHINE_Q35,
++        .variant = ".slic",
++    };
++
++    test_acpi_one("-acpitable sig=SLIC,oem_id='CRASH ',oem_table_id='ME',"
++                  "oem_rev=00002210,asl_compiler_id='qemu',"
++                  "asl_compiler_rev=00000000,data=/dev/null",
++                  &data);
++    free_test_data(&data);
++}
+
+ int main(int argc, char *argv[])
+ {
+@@ -1639,6 +1652,7 @@ int main(int argc, char *argv[])
+             qtest_add_func("acpi/q35/kvm/xapic", test_acpi_q35_kvm_xapic);
+             qtest_add_func("acpi/q35/kvm/dmar", test_acpi_q35_kvm_dmar);
+         }
++        qtest_add_func("acpi/q35/slic", test_acpi_q35_slic);
+     } else if (strcmp(arch, "aarch64") == 0) {
+         if (has_tcg) {
+             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
+
+commit ffba261306370e0ad8506401b104be5fa4749ade
+Author: Igor Mammedov <imammedo@redhat.com>
+Date:   Mon Dec 27 14:31:20 2021 -0500
+
+    tests: acpi: SLIC: update expected blobs
+    
+    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+
+diff --git a/tests/data/acpi/q35/FACP.slic b/tests/data/acpi/q35/FACP.slic
+index f6a864cc86..891fd4b784 100644
+Binary files a/tests/data/acpi/q35/FACP.slic and b/tests/data/acpi/q35/FACP.slic differ
+diff --git a/tests/data/acpi/q35/SLIC.slic b/tests/data/acpi/q35/SLIC.slic
+index e69de29bb2..fd26592e24 100644
+Binary files a/tests/data/acpi/q35/SLIC.slic and b/tests/data/acpi/q35/SLIC.slic differ
+diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
+index 49dbf8fa3e..dfb8523c8b 100644
+--- a/tests/qtest/bios-tables-test-allowed-diff.h
++++ b/tests/qtest/bios-tables-test-allowed-diff.h
+@@ -1,3 +1 @@
+ /* List of comma-separated changed AML files to ignore */
+-"tests/data/acpi/q35/FACP.slic",
+-"tests/data/acpi/q35/SLIC.slic",

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-7.0.0-also-build-virtfs-proxy-helper.patch

@@ -0,0 +1,32 @@
+From c1093041466772f4b62961bcc5a354801d41355d Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Mon, 4 Apr 2022 12:56:59 +0200
+Subject: [PATCH] also build virtfs-proxy-helper
+
+The Gentoo ebuild splits the qemu build into a softmmu, user and tool
+phase in order to be able to build and link some of the qemu emulators
+statically. This unfortunately has the consequence that we never
+configure with "have_virtfs" and "have_tools" at the same time.
+
+As a workaround, simply build the virtfs userland unconditionally. After
+all, it is a tiny executable
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 861de93c4f..a8d29be3aa 100644
+--- a/meson.build
++++ b/meson.build
+@@ -1474,7 +1474,7 @@ have_virtfs = get_option('virtfs') \
+     .disable_auto_if(not have_tools and not have_system) \
+     .allowed()
+ 
+-have_virtfs_proxy_helper = targetos != 'darwin' and have_virtfs and have_tools
++have_virtfs_proxy_helper = have_tools and libattr.found() and libcap_ng.found()
+ 
+ foreach k : get_option('trace_backends')
+   config_host_data.set('CONFIG_TRACE_' + k.to_upper(), true)
+-- 
+2.35.1
+

sdk_container/src/third_party/portage-stable/app-emulation/qemu/metadata.xml

@@ -1,6 +1,14 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
+	<maintainer type="person">
+		<email>ajak@gentoo.org</email>
+		<name>John Helmert III</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>sam@gentoo.org</email>
+		<name>Sam James</name>
+	</maintainer>
 	<maintainer type="person">
 		<email>tamiko@gentoo.org</email>
 		<name>Matthias Maier</name>

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-6.2.0-r3.ebuild

@@ -1,15 +1,15 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI=8
 
-PYTHON_COMPAT=( python3_{7,8,9,10} )
+PYTHON_COMPAT=( python3_{8,9,10} )
 PYTHON_REQ_USE="ncurses,readline"
 
-FIRMWARE_ABI_VERSION="6.0.0-r50"
+FIRMWARE_ABI_VERSION="6.2.0"
 
-inherit eutils linux-info toolchain-funcs multilib python-r1
-inherit udev fcaps readme.gentoo-r1 pax-utils xdg-utils
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
 
 if [[ ${PV} = *9999* ]]; then
 	EGIT_REPO_URI="https://git.qemu.org/git/qemu.git"
@@ -23,7 +23,7 @@ if [[ ${PV} = *9999* ]]; then
 	SRC_URI=""
 else
 	SRC_URI="https://download.qemu.org/${P}.tar.xz"
-	KEYWORDS="amd64 arm64 ~ppc ppc64 x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -32,11 +32,11 @@ HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
 LICENSE="GPL-2 LGPL-2 BSD-2"
 SLOT="0"
 
-IUSE="accessibility +aio alsa bzip2 capstone +caps +curl debug +doc
-	+fdt fuse glusterfs gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg kernel_linux
-	kernel_FreeBSD lzo multipath
-	ncurses nfs nls numa opengl +oss +pin-upstream-blobs
+IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static static-user systemtap test udev usb
@@ -75,11 +75,8 @@ COMMON_TARGETS="
 IUSE_SOFTMMU_TARGETS="
 	${COMMON_TARGETS}
 	avr
-	lm32
-	moxie
 	rx
 	tricore
-	unicore32
 "
 IUSE_USER_TARGETS="
 	${COMMON_TARGETS}
@@ -108,12 +105,14 @@ REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	qemu_softmmu_targets_ppc? ( fdt )
 	qemu_softmmu_targets_riscv32? ( fdt )
 	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pulseaudio !plugins !rbd !snappy !udev )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	vhost-user-fs? ( caps seccomp )
 	virgl? ( opengl )
 	virtfs? ( caps xattr )
+	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static !static-user )
@@ -145,6 +144,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:= )
 	caps? ( sys-libs/libcap-ng[static-libs(+)] )
@@ -160,11 +160,7 @@ SOFTMMU_TOOLS_DEPEND="
 		x11-libs/gtk+:3
 		vte? ( x11-libs/vte:2.91 )
 	)
-	infiniband? (
-		sys-fabric/libibumad:=[static-libs(+)]
-		sys-fabric/libibverbs:=[static-libs(+)]
-		sys-fabric/librdmacm:=[static-libs(+)]
-	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
 	iscsi? ( net-libs/libiscsi )
 	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
 	jack? ( virtual/jack )
@@ -184,6 +180,7 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[static-libs(+)]
 		media-libs/mesa[egl(+),gbm(+)]
 	)
+	pam? ( sys-libs/pam )
 	png? ( media-libs/libpng:0=[static-libs(+)] )
 	pulseaudio? ( media-sound/pulseaudio )
 	rbd? ( sys-cluster/ceph )
@@ -243,7 +240,10 @@ BDEPEND="
 	dev-lang/perl
 	sys-apps/texinfo
 	virtual/pkgconfig
-	doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx_rtd_theme[${PYTHON_USEDEP}]
+	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
 		dev-libs/glib[utils]
@@ -269,15 +269,18 @@ DEPEND="${CDEPEND}
 	static-user? ( ${ALL_DEPEND} )"
 RDEPEND="${CDEPEND}
 	acct-group/kvm
-	selinux? ( sec-policy/selinux-qemu )"
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
-	"${FILESDIR}"/${PN}-5.2.0-strings.patch
-	"${FILESDIR}"/${PN}-5.2.0-cleaner-werror.patch
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-5.2.0-dce-locks.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${PN}-6.2.0-user-SLIC-crash.patch
+	"${FILESDIR}"/${PN}-6.2.0-also-build-virtfs-proxy-helper.patch
 )
 
 QA_PREBUILT="
@@ -390,7 +393,7 @@ check_targets() {
 	local var=$1 mak=$2
 	local detected sorted
 
-	pushd "${S}"/default-configs/targets/ >/dev/null || die
+	pushd "${S}"/configs/targets/ >/dev/null || die
 
 	# Force C locale until glibc is updated. #564936
 	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
@@ -447,6 +450,7 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
+		--with-git-submodules=ignore
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -467,11 +471,15 @@ qemu_src_configure() {
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
 		--host-cc="$(tc-getBUILD_CC)"
+		$(use_enable alsa)
 		$(use_enable debug debug-info)
 		$(use_enable debug debug-tcg)
-		$(use_enable doc docs)
+		$(use_enable jack)
 		$(use_enable nls gettext)
+		$(use_enable oss)
 		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
 		$(use_enable xattr attr)
 	)
 
@@ -500,13 +508,22 @@ qemu_src_configure() {
 			echo "--disable-${2:-$1}"
 		fi
 	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
 	conf_opts+=(
 		$(conf_notuser accessibility brlapi)
 		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
 		$(conf_notuser bzip2)
 		$(conf_notuser capstone)
 		$(conf_notuser caps cap-ng)
 		$(conf_notuser curl)
+		$(conf_tools doc docs)
 		$(conf_notuser fdt)
 		$(conf_notuser fuse)
 		$(conf_notuser glusterfs)
@@ -516,7 +533,7 @@ qemu_src_configure() {
 		$(conf_notuser infiniband rdma)
 		$(conf_notuser iscsi libiscsi)
 		$(conf_notuser io-uring linux-io-uring)
-		$(conf_notuser jemalloc jemalloc)
+		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
 		$(conf_notuser lzo)
@@ -525,6 +542,7 @@ qemu_src_configure() {
 		$(conf_notuser nfs libnfs)
 		$(conf_notuser numa)
 		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
 		$(conf_notuser png vnc-png)
 		$(conf_notuser rbd)
 		$(conf_notuser sasl vnc-sasl)
@@ -573,7 +591,7 @@ qemu_src_configure() {
 			$(usev oss)
 		)
 		conf_opts+=(
-			--audio-drv-list=$(printf "%s," "${audio_opts[@]}")
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
 		)
 	fi
 
@@ -631,11 +649,6 @@ qemu_src_configure() {
 	echo "../configure ${conf_opts[*]}"
 	cd "${builddir}"
 	../configure "${conf_opts[@]}" || die "configure failed"
-
-	# FreeBSD's kernel does not support QEMU assigning/grabbing
-	# host USB devices yet
-	use kernel_FreeBSD && \
-		sed -i -E -e "s|^(HOST_USB=)bsd|\1stub|" "${S}"/config-host.mak
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-6.2.0-r4.ebuild

@@ -1,15 +1,15 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI=8
 
-PYTHON_COMPAT=( python3_{7,8,9,10} )
+PYTHON_COMPAT=( python3_{8,9,10} )
 PYTHON_REQ_USE="ncurses,readline"
 
-FIRMWARE_ABI_VERSION="6.0.0-r50"
+FIRMWARE_ABI_VERSION="6.2.0"
 
-inherit eutils linux-info toolchain-funcs multilib python-r1
-inherit udev fcaps readme.gentoo-r1 pax-utils xdg-utils
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
 
 if [[ ${PV} = *9999* ]]; then
 	EGIT_REPO_URI="https://git.qemu.org/git/qemu.git"
@@ -23,7 +23,7 @@ if [[ ${PV} = *9999* ]]; then
 	SRC_URI=""
 else
 	SRC_URI="https://download.qemu.org/${P}.tar.xz"
-	KEYWORDS="~amd64 ~arm64 ~ppc ~ppc64 ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -32,11 +32,11 @@ HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
 LICENSE="GPL-2 LGPL-2 BSD-2"
 SLOT="0"
 
-IUSE="accessibility +aio alsa bzip2 capstone +caps +curl debug +doc
-	+fdt fuse glusterfs gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg kernel_linux
-	kernel_FreeBSD lzo multipath
-	ncurses nfs nls numa opengl +oss +pin-upstream-blobs
+IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static static-user systemtap test udev usb
@@ -75,11 +75,8 @@ COMMON_TARGETS="
 IUSE_SOFTMMU_TARGETS="
 	${COMMON_TARGETS}
 	avr
-	lm32
-	moxie
 	rx
 	tricore
-	unicore32
 "
 IUSE_USER_TARGETS="
 	${COMMON_TARGETS}
@@ -108,12 +105,14 @@ REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	qemu_softmmu_targets_ppc? ( fdt )
 	qemu_softmmu_targets_riscv32? ( fdt )
 	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pulseaudio !plugins !rbd !snappy !udev )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	vhost-user-fs? ( caps seccomp )
 	virgl? ( opengl )
 	virtfs? ( caps xattr )
+	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static !static-user )
@@ -145,6 +144,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:= )
 	caps? ( sys-libs/libcap-ng[static-libs(+)] )
@@ -160,11 +160,7 @@ SOFTMMU_TOOLS_DEPEND="
 		x11-libs/gtk+:3
 		vte? ( x11-libs/vte:2.91 )
 	)
-	infiniband? (
-		sys-fabric/libibumad:=[static-libs(+)]
-		sys-fabric/libibverbs:=[static-libs(+)]
-		sys-fabric/librdmacm:=[static-libs(+)]
-	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
 	iscsi? ( net-libs/libiscsi )
 	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
 	jack? ( virtual/jack )
@@ -184,6 +180,7 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[static-libs(+)]
 		media-libs/mesa[egl(+),gbm(+)]
 	)
+	pam? ( sys-libs/pam )
 	png? ( media-libs/libpng:0=[static-libs(+)] )
 	pulseaudio? ( media-sound/pulseaudio )
 	rbd? ( sys-cluster/ceph )
@@ -243,7 +240,10 @@ BDEPEND="
 	dev-lang/perl
 	sys-apps/texinfo
 	virtual/pkgconfig
-	doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx_rtd_theme[${PYTHON_USEDEP}]
+	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
 		dev-libs/glib[utils]
@@ -269,15 +269,19 @@ DEPEND="${CDEPEND}
 	static-user? ( ${ALL_DEPEND} )"
 RDEPEND="${CDEPEND}
 	acct-group/kvm
-	selinux? ( sec-policy/selinux-qemu )"
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
-	"${FILESDIR}"/${PN}-5.2.0-strings.patch
-	"${FILESDIR}"/${PN}-5.2.0-cleaner-werror.patch
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-5.2.0-dce-locks.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${PN}-6.2.0-user-SLIC-crash.patch
+	"${FILESDIR}"/${PN}-6.2.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-6.2.0-glibc-2.35-rseq-seccomp-virtiofsd.patch
 )
 
 QA_PREBUILT="
@@ -390,7 +394,7 @@ check_targets() {
 	local var=$1 mak=$2
 	local detected sorted
 
-	pushd "${S}"/default-configs/targets/ >/dev/null || die
+	pushd "${S}"/configs/targets/ >/dev/null || die
 
 	# Force C locale until glibc is updated. #564936
 	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
@@ -447,6 +451,7 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
+		--with-git-submodules=ignore
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -467,11 +472,15 @@ qemu_src_configure() {
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
 		--host-cc="$(tc-getBUILD_CC)"
+		$(use_enable alsa)
 		$(use_enable debug debug-info)
 		$(use_enable debug debug-tcg)
-		$(use_enable doc docs)
+		$(use_enable jack)
 		$(use_enable nls gettext)
+		$(use_enable oss)
 		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
 		$(use_enable xattr attr)
 	)
 
@@ -500,13 +509,22 @@ qemu_src_configure() {
 			echo "--disable-${2:-$1}"
 		fi
 	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
 	conf_opts+=(
 		$(conf_notuser accessibility brlapi)
 		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
 		$(conf_notuser bzip2)
 		$(conf_notuser capstone)
 		$(conf_notuser caps cap-ng)
 		$(conf_notuser curl)
+		$(conf_tools doc docs)
 		$(conf_notuser fdt)
 		$(conf_notuser fuse)
 		$(conf_notuser glusterfs)
@@ -516,7 +534,7 @@ qemu_src_configure() {
 		$(conf_notuser infiniband rdma)
 		$(conf_notuser iscsi libiscsi)
 		$(conf_notuser io-uring linux-io-uring)
-		$(conf_notuser jemalloc jemalloc)
+		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
 		$(conf_notuser lzo)
@@ -525,6 +543,7 @@ qemu_src_configure() {
 		$(conf_notuser nfs libnfs)
 		$(conf_notuser numa)
 		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
 		$(conf_notuser png vnc-png)
 		$(conf_notuser rbd)
 		$(conf_notuser sasl vnc-sasl)
@@ -573,7 +592,7 @@ qemu_src_configure() {
 			$(usev oss)
 		)
 		conf_opts+=(
-			--audio-drv-list=$(printf "%s," "${audio_opts[@]}")
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
 		)
 	fi
 
@@ -631,11 +650,6 @@ qemu_src_configure() {
 	echo "../configure ${conf_opts[*]}"
 	cd "${builddir}"
 	../configure "${conf_opts[@]}" || die "configure failed"
-
-	# FreeBSD's kernel does not support QEMU assigning/grabbing
-	# host USB devices yet
-	use kernel_FreeBSD && \
-		sed -i -E -e "s|^(HOST_USB=)bsd|\1stub|" "${S}"/config-host.mak
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-6.2.0.ebuild

@@ -1,12 +1,12 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI=7
 
-PYTHON_COMPAT=( python3_{7,8,9,10} )
+PYTHON_COMPAT=( python3_{8,9,10} )
 PYTHON_REQ_USE="ncurses,readline"
 
-FIRMWARE_ABI_VERSION="6.1.0"
+FIRMWARE_ABI_VERSION="6.2.0"
 
 inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
 		pax-utils xdg-utils
@@ -23,7 +23,7 @@ if [[ ${PV} = *9999* ]]; then
 	SRC_URI=""
 else
 	SRC_URI="https://download.qemu.org/${P}.tar.xz"
-	KEYWORDS="~amd64 ~arm64 ~ppc ~ppc64 ~x86"
+	KEYWORDS="amd64 arm64 ~ppc ppc64 x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -33,9 +33,9 @@ LICENSE="GPL-2 LGPL-2 BSD-2"
 SLOT="0"
 
 IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
-	+fdt fuse glusterfs gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg kernel_linux
-	kernel_FreeBSD lzo multipath
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
 	ncurses nfs nls numa opengl +oss +pin-upstream-blobs
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
@@ -105,12 +105,14 @@ REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	qemu_softmmu_targets_ppc? ( fdt )
 	qemu_softmmu_targets_riscv32? ( fdt )
 	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
 	static? ( static-user !alsa !gtk !jack !opengl !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	vhost-user-fs? ( caps seccomp )
 	virgl? ( opengl )
 	virtfs? ( caps xattr )
+	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static !static-user )
@@ -159,9 +161,7 @@ SOFTMMU_TOOLS_DEPEND="
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? (
-		sys-fabric/libibumad:=[static-libs(+)]
-		sys-fabric/libibverbs:=[static-libs(+)]
-		sys-fabric/librdmacm:=[static-libs(+)]
+		sys-cluster/rdma-core[static-libs(+)]
 	)
 	iscsi? ( net-libs/libiscsi )
 	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
@@ -277,7 +277,6 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
 	"${FILESDIR}"/${PN}-6.1.0-strings.patch
-	"${FILESDIR}"/${P}-automagic-libbpf.patch
 )
 
 QA_PREBUILT="
@@ -500,6 +499,13 @@ qemu_src_configure() {
 			echo "--disable-${2:-$1}"
 		fi
 	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
 	conf_opts+=(
 		$(conf_notuser accessibility brlapi)
 		$(conf_notuser aio linux-aio)
@@ -517,7 +523,7 @@ qemu_src_configure() {
 		$(conf_notuser infiniband rdma)
 		$(conf_notuser iscsi libiscsi)
 		$(conf_notuser io-uring linux-io-uring)
-		$(conf_notuser jemalloc jemalloc)
+		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
 		$(conf_notuser lzo)
@@ -574,7 +580,7 @@ qemu_src_configure() {
 			$(usev oss)
 		)
 		conf_opts+=(
-			--audio-drv-list=$(printf "%s," "${audio_opts[@]}")
+			--audio-drv-list="${audio_opts// /,}"
 		)
 	fi
 
@@ -632,11 +638,6 @@ qemu_src_configure() {
 	echo "../configure ${conf_opts[*]}"
 	cd "${builddir}"
 	../configure "${conf_opts[@]}" || die "configure failed"
-
-	# FreeBSD's kernel does not support QEMU assigning/grabbing
-	# host USB devices yet
-	use kernel_FreeBSD && \
-		sed -i -E -e "s|^(HOST_USB=)bsd|\1stub|" "${S}"/config-host.mak
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.0.0-r1.ebuild

@@ -0,0 +1,914 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{8,9,10} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.0.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		meson
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+	KEYWORDS="amd64 ~arm ~arm64 ~ppc ppc64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net vhost-user-fs virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	vhost-user-fs? ( caps seccomp )
+	virgl? ( opengl )
+	virtfs? ( caps xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	>=dev-libs/glib-2.0[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:= )
+	caps? ( sys-libs/libcap-ng[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		dev-libs/nettle:=[static-libs(+)]
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( virtual/jpeg:0=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-sound/pulseaudio )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202105"
+SEABIOS_VERSION="1.14.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}[binary]
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-${SEABIOS_VERSION}[binary,seavgabios]
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+		sys-firmware/ipxe[qemu]
+		>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-${SEABIOS_VERSION}[binary,seavgabios]
+	)
+	!pin-upstream-blobs? (
+		>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx_rtd_theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${PN}-7.0.0-also-build-virtfs-proxy-helper.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled copy of libfdt
+	rm -r dtc || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}"
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--python="${PYTHON}"
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser caps cap-ng)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png vnc-png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp slirp system)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser vhost-user-fs)
+		$(conf_tools vhost-user-fs virtiofsd)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		default
+	fi
+
+	cd "${S}/tools-build"
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build"
+	emake DESTDIR="${ED}" install
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}"
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		rm "${ED}/usr/share/qemu/bios.bin"
+		rm "${ED}/usr/share/qemu/bios-256k.bin"
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios.bin /usr/share/qemu/bios.bin
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		rm "${ED}/usr/share/qemu/sgabios.bin"
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		rm "${ED}"/usr/share/qemu/pxe-*.rom
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin ${EROOT}/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+		ewarn "	$(best_version sys-firmware/edk2-ovmf)"
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/seabios)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+	echo "  $(best_version sys-firmware/edk2-ovmf)"
+	if has_version 'sys-firmware/edk2-ovmf[binary]'; then
+		echo "    USE=binary"
+	else
+		echo "    USE=''"
+	fi
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/seabios)"
+	if has_version 'sys-firmware/seabios[binary]'; then
+		echo "    USE=binary"
+	else
+		echo "    USE=''"
+	fi
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.0.0_rc4.ebuild

@@ -1,18 +1,18 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI=8
 
-PYTHON_COMPAT=( python3_{7,8,9,10} )
+PYTHON_COMPAT=( python3_{8,9,10} )
 PYTHON_REQ_USE="ncurses,readline"
 
-FIRMWARE_ABI_VERSION="5.2.0-r50"
+FIRMWARE_ABI_VERSION="6.2.0"
 
-inherit eutils linux-info toolchain-funcs multilib python-r1
-inherit udev fcaps readme.gentoo-r1 pax-utils xdg-utils
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
 
 if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://git.qemu.org/git/qemu.git"
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=(
 		meson
 		tests/fp/berkeley-softfloat-3
@@ -22,8 +22,10 @@ if [[ ${PV} = *9999* ]]; then
 	inherit git-r3
 	SRC_URI=""
 else
-	SRC_URI="https://download.qemu.org/${P}.tar.xz"
-	KEYWORDS="amd64 arm64 ~ppc ppc64 x86"
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+	#KEYWORDS="~amd64 ~arm64 ~ppc ~ppc64 ~x86"
+	S="${WORKDIR}/${MY_P}"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -32,16 +34,16 @@ HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
 LICENSE="GPL-2 LGPL-2 BSD-2"
 SLOT="0"
 
-IUSE="accessibility +aio alsa bzip2 capstone +caps +curl debug +doc
-	+fdt fuse glusterfs gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg kernel_linux
-	kernel_FreeBSD lzo multipath
-	ncurses nfs nls numa opengl +oss +pin-upstream-blobs
+IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static static-user systemtap test udev usb
 	usbredir vde +vhost-net vhost-user-fs virgl virtfs +vnc vte xattr xen
-	xfs zstd"
+	zstd"
 
 COMMON_TARGETS="
 	aarch64
@@ -75,11 +77,8 @@ COMMON_TARGETS="
 IUSE_SOFTMMU_TARGETS="
 	${COMMON_TARGETS}
 	avr
-	lm32
-	moxie
 	rx
 	tricore
-	unicore32
 "
 IUSE_USER_TARGETS="
 	${COMMON_TARGETS}
@@ -88,7 +87,6 @@ IUSE_USER_TARGETS="
 	hexagon
 	mipsn32
 	mipsn32el
-	ppc64abi32
 	ppc64le
 	sparc32plus
 "
@@ -108,12 +106,14 @@ REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	qemu_softmmu_targets_ppc? ( fdt )
 	qemu_softmmu_targets_riscv32? ( fdt )
 	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pulseaudio !plugins !rbd !snappy !udev )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	vhost-user-fs? ( caps seccomp )
 	virgl? ( opengl )
 	virtfs? ( caps xattr )
+	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static !static-user )
@@ -137,7 +137,6 @@ ALL_DEPEND="
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
 # softmmu targets (qemu-system-*).
 SOFTMMU_TOOLS_DEPEND="
-	dev-libs/libxml2[static-libs(+)]
 	>=x11-libs/pixman-0.28.0[static-libs(+)]
 	accessibility? (
 		app-accessibility/brltty[api]
@@ -145,6 +144,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:= )
 	caps? ( sys-libs/libcap-ng[static-libs(+)] )
@@ -160,11 +160,7 @@ SOFTMMU_TOOLS_DEPEND="
 		x11-libs/gtk+:3
 		vte? ( x11-libs/vte:2.91 )
 	)
-	infiniband? (
-		sys-fabric/libibumad:=[static-libs(+)]
-		sys-fabric/libibverbs:=[static-libs(+)]
-		sys-fabric/librdmacm:=[static-libs(+)]
-	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
 	iscsi? ( net-libs/libiscsi )
 	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
 	jack? ( virtual/jack )
@@ -184,6 +180,7 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[static-libs(+)]
 		media-libs/mesa[egl(+),gbm(+)]
 	)
+	pam? ( sys-libs/pam )
 	png? ( media-libs/libpng:0=[static-libs(+)] )
 	pulseaudio? ( media-sound/pulseaudio )
 	rbd? ( sys-cluster/ceph )
@@ -209,21 +206,21 @@ SOFTMMU_TOOLS_DEPEND="
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
 	xen? ( app-emulation/xen-tools:= )
-	xfs? ( sys-fs/xfsprogs[static-libs(+)] )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
+EDK2_OVMF_VERSION="202105"
 SEABIOS_VERSION="1.14.0"
 
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
-		~sys-firmware/edk2-ovmf-202008[binary]
+		~sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}[binary]
 		~sys-firmware/ipxe-1.21.1[binary,qemu]
 		~sys-firmware/seabios-${SEABIOS_VERSION}[binary,seavgabios]
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
 	!pin-upstream-blobs? (
-		sys-firmware/edk2-ovmf
+		>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
 		sys-firmware/ipxe[qemu]
 		>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
 		sys-firmware/sgabios
@@ -242,7 +239,10 @@ BDEPEND="
 	dev-lang/perl
 	sys-apps/texinfo
 	virtual/pkgconfig
-	doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx_rtd_theme[${PYTHON_USEDEP}]
+	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
 		dev-libs/glib[utils]
@@ -268,15 +268,17 @@ DEPEND="${CDEPEND}
 	static-user? ( ${ALL_DEPEND} )"
 RDEPEND="${CDEPEND}
 	acct-group/kvm
-	selinux? ( sec-policy/selinux-qemu )"
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
-	"${FILESDIR}"/${PN}-5.2.0-strings.patch
-	"${FILESDIR}"/${PN}-5.2.0-cleaner-werror.patch
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-5.2.0-dce-locks.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${PN}-7.0.0-also-build-virtfs-proxy-helper.patch
 )
 
 QA_PREBUILT="
@@ -305,7 +307,6 @@ QA_WX_LOAD="usr/bin/qemu-i386
 	usr/bin/qemu-or1k
 	usr/bin/qemu-ppc
 	usr/bin/qemu-ppc64
-	usr/bin/qemu-ppc64abi32
 	usr/bin/qemu-sh4
 	usr/bin/qemu-sh4eb
 	usr/bin/qemu-sparc
@@ -389,7 +390,7 @@ check_targets() {
 	local var=$1 mak=$2
 	local detected sorted
 
-	pushd "${S}"/default-configs/targets/ >/dev/null || die
+	pushd "${S}"/configs/targets/ >/dev/null || die
 
 	# Force C locale until glibc is updated. #564936
 	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
@@ -446,6 +447,7 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
+		--with-git-submodules=ignore
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -466,11 +468,15 @@ qemu_src_configure() {
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
 		--host-cc="$(tc-getBUILD_CC)"
+		$(use_enable alsa)
 		$(use_enable debug debug-info)
 		$(use_enable debug debug-tcg)
-		$(use_enable doc docs)
+		$(use_enable jack)
 		$(use_enable nls gettext)
+		$(use_enable oss)
 		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
 		$(use_enable xattr attr)
 	)
 
@@ -499,13 +505,22 @@ qemu_src_configure() {
 			echo "--disable-${2:-$1}"
 		fi
 	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
 	conf_opts+=(
 		$(conf_notuser accessibility brlapi)
 		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
 		$(conf_notuser bzip2)
 		$(conf_notuser capstone)
 		$(conf_notuser caps cap-ng)
 		$(conf_notuser curl)
+		$(conf_tools doc docs)
 		$(conf_notuser fdt)
 		$(conf_notuser fuse)
 		$(conf_notuser glusterfs)
@@ -515,7 +530,7 @@ qemu_src_configure() {
 		$(conf_notuser infiniband rdma)
 		$(conf_notuser iscsi libiscsi)
 		$(conf_notuser io-uring linux-io-uring)
-		$(conf_notuser jemalloc jemalloc)
+		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
 		$(conf_notuser lzo)
@@ -524,6 +539,7 @@ qemu_src_configure() {
 		$(conf_notuser nfs libnfs)
 		$(conf_notuser numa)
 		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
 		$(conf_notuser png vnc-png)
 		$(conf_notuser rbd)
 		$(conf_notuser sasl vnc-sasl)
@@ -548,18 +564,11 @@ qemu_src_configure() {
 		$(conf_notuser vte)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
-		$(conf_notuser xfs xfsctl)
 		# use prebuilt keymaps, bug #759604
 		--disable-xkbcommon
 		$(conf_notuser zstd)
 	)
 
-	if [[ ${buildtype} == "user" ]] ; then
-		conf_opts+=( --disable-libxml2 )
-	else
-		conf_opts+=( --enable-libxml2 )
-	fi
-
 	if [[ ! ${buildtype} == "user" ]] ; then
 		# audio options
 		local audio_opts=(
@@ -572,7 +581,7 @@ qemu_src_configure() {
 			$(usev oss)
 		)
 		conf_opts+=(
-			--audio-drv-list=$(printf "%s," "${audio_opts[@]}")
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
 		)
 	fi
 
@@ -630,11 +639,6 @@ qemu_src_configure() {
 	echo "../configure ${conf_opts[*]}"
 	cd "${builddir}"
 	../configure "${conf_opts[@]}" || die "configure failed"
-
-	# FreeBSD's kernel does not support QEMU assigning/grabbing
-	# host USB devices yet
-	use kernel_FreeBSD && \
-		sed -i -E -e "s|^(HOST_USB=)bsd|\1stub|" "${S}"/config-host.mak
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild

@@ -1,18 +1,18 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="7"
+EAPI=8
 
-PYTHON_COMPAT=( python3_{7,8,9,10} )
+PYTHON_COMPAT=( python3_{8,9,10} )
 PYTHON_REQ_USE="ncurses,readline"
 
-FIRMWARE_ABI_VERSION="6.1.0"
+FIRMWARE_ABI_VERSION="6.2.0"
 
 inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
 		pax-utils xdg-utils
 
 if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://git.qemu.org/git/qemu.git"
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
 	EGIT_SUBMODULES=(
 		meson
 		tests/fp/berkeley-softfloat-3
@@ -23,7 +23,7 @@ if [[ ${PV} = *9999* ]]; then
 	SRC_URI=""
 else
 	SRC_URI="https://download.qemu.org/${P}.tar.xz"
-	KEYWORDS="~amd64 ~arm64 ~ppc ~ppc64 ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -32,16 +32,16 @@ HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
 LICENSE="GPL-2 LGPL-2 BSD-2"
 SLOT="0"
 
-IUSE="accessibility +aio alsa bzip2 capstone +caps +curl debug +doc
-	+fdt fuse glusterfs gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg kernel_linux
-	kernel_FreeBSD lzo multipath
-	ncurses nfs nls numa opengl +oss +pin-upstream-blobs
+IUSE="accessibility +aio alsa bpf bzip2 capstone +caps +curl debug +doc
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static static-user systemtap test udev usb
 	usbredir vde +vhost-net vhost-user-fs virgl virtfs +vnc vte xattr xen
-	xfs zstd"
+	zstd"
 
 COMMON_TARGETS="
 	aarch64
@@ -85,7 +85,6 @@ IUSE_USER_TARGETS="
 	hexagon
 	mipsn32
 	mipsn32el
-	ppc64abi32
 	ppc64le
 	sparc32plus
 "
@@ -105,12 +104,14 @@ REQUIRED_USE="${PYTHON_REQUIRED_USE}
 	qemu_softmmu_targets_ppc? ( fdt )
 	qemu_softmmu_targets_riscv32? ( fdt )
 	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
 	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pulseaudio !plugins !rbd !snappy !udev )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
 	static-user? ( !plugins )
 	vhost-user-fs? ( caps seccomp )
 	virgl? ( opengl )
 	virtfs? ( caps xattr )
+	vnc? ( gnutls )
 	vte? ( gtk )
 	multipath? ( udev )
 	plugins? ( !static !static-user )
@@ -134,7 +135,6 @@ ALL_DEPEND="
 # Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
 # softmmu targets (qemu-system-*).
 SOFTMMU_TOOLS_DEPEND="
-	dev-libs/libxml2[static-libs(+)]
 	>=x11-libs/pixman-0.28.0[static-libs(+)]
 	accessibility? (
 		app-accessibility/brltty[api]
@@ -142,6 +142,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	aio? ( dev-libs/libaio[static-libs(+)] )
 	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
 	bzip2? ( app-arch/bzip2[static-libs(+)] )
 	capstone? ( dev-libs/capstone:= )
 	caps? ( sys-libs/libcap-ng[static-libs(+)] )
@@ -157,11 +158,7 @@ SOFTMMU_TOOLS_DEPEND="
 		x11-libs/gtk+:3
 		vte? ( x11-libs/vte:2.91 )
 	)
-	infiniband? (
-		sys-fabric/libibumad:=[static-libs(+)]
-		sys-fabric/libibverbs:=[static-libs(+)]
-		sys-fabric/librdmacm:=[static-libs(+)]
-	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
 	iscsi? ( net-libs/libiscsi )
 	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
 	jack? ( virtual/jack )
@@ -181,6 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 		media-libs/mesa[static-libs(+)]
 		media-libs/mesa[egl(+),gbm(+)]
 	)
+	pam? ( sys-libs/pam )
 	png? ( media-libs/libpng:0=[static-libs(+)] )
 	pulseaudio? ( media-sound/pulseaudio )
 	rbd? ( sys-cluster/ceph )
@@ -206,7 +204,6 @@ SOFTMMU_TOOLS_DEPEND="
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
 	virtfs? ( sys-libs/libcap )
 	xen? ( app-emulation/xen-tools:= )
-	xfs? ( sys-fs/xfsprogs[static-libs(+)] )
 	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
 "
 
@@ -241,8 +238,8 @@ BDEPEND="
 	sys-apps/texinfo
 	virtual/pkgconfig
 	doc? (
-		dev-python/sphinx
-		dev-python/sphinx_rtd_theme
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx_rtd_theme[${PYTHON_USEDEP}]
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
@@ -269,13 +266,17 @@ DEPEND="${CDEPEND}
 	static-user? ( ${ALL_DEPEND} )"
 RDEPEND="${CDEPEND}
 	acct-group/kvm
-	selinux? ( sec-policy/selinux-qemu )"
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.11.1-capstone_include_path.patch
 	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
 	"${FILESDIR}"/${PN}-6.0.0-make.patch
 	"${FILESDIR}"/${PN}-6.1.0-strings.patch
+	"${FILESDIR}"/${PN}-7.0.0-also-build-virtfs-proxy-helper.patch
 )
 
 QA_PREBUILT="
@@ -304,7 +305,6 @@ QA_WX_LOAD="usr/bin/qemu-i386
 	usr/bin/qemu-or1k
 	usr/bin/qemu-ppc
 	usr/bin/qemu-ppc64
-	usr/bin/qemu-ppc64abi32
 	usr/bin/qemu-sh4
 	usr/bin/qemu-sh4eb
 	usr/bin/qemu-sparc
@@ -445,6 +445,7 @@ qemu_src_configure() {
 		--disable-containers # bug #732972
 		--disable-guest-agent
 		--disable-strip
+		--with-git-submodules=ignore
 
 		# bug #746752: TCG interpreter has a few limitations:
 		# - it does not support FPU
@@ -465,11 +466,15 @@ qemu_src_configure() {
 		--cc="$(tc-getCC)"
 		--cxx="$(tc-getCXX)"
 		--host-cc="$(tc-getBUILD_CC)"
+		$(use_enable alsa)
 		$(use_enable debug debug-info)
 		$(use_enable debug debug-tcg)
-		$(use_enable doc docs)
+		$(use_enable jack)
 		$(use_enable nls gettext)
+		$(use_enable oss)
 		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
 		$(use_enable xattr attr)
 	)
 
@@ -498,13 +503,22 @@ qemu_src_configure() {
 			echo "--disable-${2:-$1}"
 		fi
 	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
 	conf_opts+=(
 		$(conf_notuser accessibility brlapi)
 		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
 		$(conf_notuser bzip2)
 		$(conf_notuser capstone)
 		$(conf_notuser caps cap-ng)
 		$(conf_notuser curl)
+		$(conf_tools doc docs)
 		$(conf_notuser fdt)
 		$(conf_notuser fuse)
 		$(conf_notuser glusterfs)
@@ -514,7 +528,7 @@ qemu_src_configure() {
 		$(conf_notuser infiniband rdma)
 		$(conf_notuser iscsi libiscsi)
 		$(conf_notuser io-uring linux-io-uring)
-		$(conf_notuser jemalloc jemalloc)
+		$(conf_malloc jemalloc)
 		$(conf_notuser jpeg vnc-jpeg)
 		$(conf_notuser kernel_linux kvm)
 		$(conf_notuser lzo)
@@ -523,6 +537,7 @@ qemu_src_configure() {
 		$(conf_notuser nfs libnfs)
 		$(conf_notuser numa)
 		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
 		$(conf_notuser png vnc-png)
 		$(conf_notuser rbd)
 		$(conf_notuser sasl vnc-sasl)
@@ -547,18 +562,11 @@ qemu_src_configure() {
 		$(conf_notuser vte)
 		$(conf_notuser xen)
 		$(conf_notuser xen xen-pci-passthrough)
-		$(conf_notuser xfs xfsctl)
 		# use prebuilt keymaps, bug #759604
 		--disable-xkbcommon
 		$(conf_notuser zstd)
 	)
 
-	if [[ ${buildtype} == "user" ]] ; then
-		conf_opts+=( --disable-libxml2 )
-	else
-		conf_opts+=( --enable-libxml2 )
-	fi
-
 	if [[ ! ${buildtype} == "user" ]] ; then
 		# audio options
 		local audio_opts=(
@@ -571,7 +579,7 @@ qemu_src_configure() {
 			$(usev oss)
 		)
 		conf_opts+=(
-			--audio-drv-list=$(printf "%s," "${audio_opts[@]}")
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
 		)
 	fi
 
@@ -629,11 +637,6 @@ qemu_src_configure() {
 	echo "../configure ${conf_opts[*]}"
 	cd "${builddir}"
 	../configure "${conf_opts[@]}" || die "configure failed"
-
-	# FreeBSD's kernel does not support QEMU assigning/grabbing
-	# host USB devices yet
-	use kernel_FreeBSD && \
-		sed -i -E -e "s|^(HOST_USB=)bsd|\1stub|" "${S}"/config-host.mak
 }
 
 src_configure() {

sdk_container/src/third_party/portage-stable/changelog/security/2022-05-12-qemu-update.md

@@ -0,0 +1 @@
+- SDK: qemu ([CVE-2021-20203](https://nvd.nist.gov/vuln/detail/CVE-2021-20203), [CVE-2021-3713](https://nvd.nist.gov/vuln/detail/CVE-2021-3713), [CVE-2021-3930](https://nvd.nist.gov/vuln/detail/CVE-2021-3930), [CVE-2021-3947](https://nvd.nist.gov/vuln/detail/CVE-2021-3947), [CVE-2021-4145](https://nvd.nist.gov/vuln/detail/CVE-2021-4145), [CVE-2022-26353](https://nvd.nist.gov/vuln/detail/CVE-2022-26353), [CVE-2022-26354](https://nvd.nist.gov/vuln/detail/CVE-2022-26354))

sdk_container/src/third_party/portage-stable/changelog/updates/2022-05-12-profiles-update.md

@@ -0,0 +1,5 @@
+- SDK: qemu ([7.0.0](https://wiki.qemu.org/ChangeLog/7.0))
+- e2fsprogs ([1.46.5](http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.46.5))
+- ldb ([2.4.1](https://gitlab.com/samba-team/samba/-/commit/a795e0c84597aa045d011e663dbad3cdabf0f1e6))
+- talloc ([2.3.3](https://gitlab.com/samba-team/samba/-/commit/bc1ee7ca0640f0136e5af7dcc4ca8ed0a5893053))
+- tevent ([0.11.0](https://gitlab.com/samba-team/samba/-/commit/de4e8a1af9564f6056f9af90867c2f013449051c))

sdk_container/src/third_party/portage-stable/dev-util/catalyst/Manifest

@@ -1,2 +1,2 @@
 DIST catalyst-3.0.18.tar.bz2 621208 BLAKE2B 63f76634b96006ef4a751b0ce166ab36dcba3016234251b2e44e89b43b0c6909e57914007d6287e54584094ff7f064c0251a79f095c87e4c7957925e9d4605cd SHA512 94a30304b242b4e63cc14f34916acd68c03700876ba1cc2f516880f4e8365258de8b62db85cddc9492229414484ba6908edc91991b70b13da0578792b8b96aa3
-DIST catalyst-3.0.20.tar.bz2 620395 BLAKE2B 24e1e1def627bccebea4da7b4c0f787d1b7e06cc3a830847896d71e997d859ecc2131a85d328f2d58226bbf2d459ca349d50b1af68b95bb06bfe8e1843f4c4aa SHA512 f2f2b0003a70b7843006155edca0971508d19199dfe803b85477d2f2fd0365304b9e65531cc19bfb06b83fa98dac11960b72001e899bed0f9b55c0f6881a853e
+DIST catalyst-3.0.21.tar.bz2 620472 BLAKE2B 6ecf59edde24cbec6d072a31680b75e2e7f142e267b43783473dc607b189d5091b6ca2b7bd02e88a6528a7bccea8441fce21c74aed6623ec14d701557fb4d267 SHA512 e2c58a562508e25465186a5d9771040ddb9f00104943a6434489e5ef01da220ac0330339f741d023717c8d1df6ec2bf765654fabe4097d93d3086ef9005a294c

sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.18.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=6
@@ -22,7 +22,7 @@ HOMEPAGE="https://wiki.gentoo.org/wiki/Catalyst"
 
 LICENSE="GPL-2+"
 SLOT="0"
-IUSE="ccache doc +iso kernel_linux system-bootloader"
+IUSE="ccache doc +iso system-bootloader"
 
 DEPEND="
 	app-text/asciidoc
@@ -36,8 +36,10 @@ RDEPEND="
 	app-arch/lbzip2
 	app-crypt/shash
 	sys-fs/dosfstools
-	!kernel_FreeBSD? ( || ( app-arch/tar[xattr] app-arch/libarchive[xattr] ) )
-	kernel_FreeBSD? ( app-arch/libarchive[xattr] )
+	|| (
+		app-arch/tar[xattr]
+		app-arch/libarchive[xattr]
+	)
 	amd64? ( >=sys-boot/syslinux-3.72 )
 	x86? ( >=sys-boot/syslinux-3.72 )
 	ccache? ( dev-util/ccache )

sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.21.ebuild

@@ -1,7 +1,7 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 if [[ ${PV} == *9999* ]]; then
 	SRC_ECLASS="git-r3"
@@ -9,10 +9,10 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_BRANCH="master"
 else
 	SRC_URI="https://gitweb.gentoo.org/proj/catalyst.git/snapshot/${P}.tar.bz2"
-	# KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-PYTHON_COMPAT=( python3_{8,9} )
+PYTHON_COMPAT=( python3_{8..10} )
 DISTUTILS_USE_SETUPTOOLS=no
 
 inherit distutils-r1 ${SRC_ECLASS}
@@ -22,7 +22,7 @@ HOMEPAGE="https://wiki.gentoo.org/wiki/Catalyst"
 
 LICENSE="GPL-2+"
 SLOT="0"
-IUSE="ccache doc +iso kernel_linux system-bootloader"
+IUSE="ccache doc +iso system-bootloader"
 
 DEPEND="
 	app-text/asciidoc
@@ -36,8 +36,10 @@ RDEPEND="
 	app-arch/lbzip2
 	app-crypt/shash
 	sys-fs/dosfstools
-	!kernel_FreeBSD? ( || ( app-arch/tar[xattr] app-arch/libarchive[xattr] ) )
-	kernel_FreeBSD? ( app-arch/libarchive[xattr] )
+	|| (
+		app-arch/tar[xattr]
+		app-arch/libarchive[xattr]
+	)
 	amd64? ( >=sys-boot/syslinux-3.72 )
 	x86? ( >=sys-boot/syslinux-3.72 )
 	ccache? ( dev-util/ccache )

sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -12,7 +12,7 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-PYTHON_COMPAT=( python3_{8..9} )
+PYTHON_COMPAT=( python3_{8..10} )
 DISTUTILS_USE_SETUPTOOLS=no
 
 inherit distutils-r1 linux-info optfeature ${SRC_ECLASS}
@@ -31,7 +31,7 @@ DEPEND="
 	sys-apps/portage[${PYTHON_USEDEP}]
 	>=dev-python/snakeoil-0.6.5[${PYTHON_USEDEP}]
 	dev-python/fasteners[${PYTHON_USEDEP}]
-	dev-python/toml[${PYTHON_USEDEP}]
+	dev-python/tomli[${PYTHON_USEDEP}]
 	sys-apps/util-linux[python,${PYTHON_USEDEP}]
 "
 RDEPEND="

sdk_container/src/third_party/portage-stable/net-nds/openldap/Manifest

@@ -1,3 +1,6 @@
 DIST openldap-2.4.57.tgz 5883912 BLAKE2B 439605e1bebcf34968f0a552aaade1b72b7671ae2a94a0b700a84f9f715acd162e7b8dadfdd3ffd5b0a785f9306b5f5033ab956cf0ffd26b66119a7110d0aa57 SHA512 b929bced0f5ba9a90e015a24b8037c8958fbb7282db272bd0cacf43b5f7540ab42159a3c4441148074340228bb5f07f93651c0dbb2affde961be156058f99ce5
 DIST openldap-2.4.58.tgz 5885225 BLAKE2B effb618dba03497796a497cd7f53ec52e389133769321dd242433bed5ec4b1f66cf7353f08a49d5f3465880f6bcfc9afc9c7d2a28e075b66f5fd926b02213541 SHA512 2fa2aa36117692eca44e55559f162c8c796f78469e6c2aee91b06d46f2b755d416979c913a3d89bbf9db14cc84881ecffee69af75b48e1d16b7aa9d2e3873baa
+DIST openldap-2.4.59.tgz 5886272 BLAKE2B a2a8bed1d2af97fd41d651668152fd4740871bc5a8abf4b50390839228af82ac103346b3500ae0f8dd31b708acabb30435b90cd48dfafe510e648df5150d96b8 SHA512 233459ab446da6e107a7fc4ecd5668d6b08c11a11359ee76449550393e8f586a29b59d7ae09a050a1fca4fcf388ea61438ef60831b3ae802d92c048365ae3968
+DIST openldap-2.5.4.tgz 6415235 BLAKE2B 16e466d01dc7642786bb88a101854513f1239f1e817fd05145e89deb54bc1b911a5dc5f42b132747f14bdd2a3355e7c398b8b14937e7093361f4a96bfb7e9197 SHA512 00b57c9179acf3b1bde738e91604f3b09b5f5309106362bb947154d131868f233713eaa75c9af9771bfad731902d67406e8fb429851bad227fc48054cace16a8
+DIST openldap-OPENLDAP_REL_ENG_2_6_1.tar.gz 6211863 BLAKE2B 81f4591db483a214351c2e02631fef2875e17e0890fc621182d2ed61d927c3c029a4f290ee6c0788952495d6f7a76ed15e62557b8d8f2e241d867e19fdf223b7 SHA512 ca61c1dccf3194d8d149ca0c45a4834d6fadf67a3676cf348f5f62ab92c94bc7501216d7da681c3a6f87f646a18d0f3d116c3d3a24d2e5cbebc6c695c986e517
 DIST rfc2307bis.schema-20140524 12262 BLAKE2B 98031f49e9bde1e4821e637af3382364d8344ed7017649686a088070d96a632dffa6c661552352656b1b159c0fd962965580069a64c7f3d5bb6a3ed75f60fd99 SHA512 83b89a1deeefc8566b97e7e865b9b6d04541099cbdf719e24538a7d27d61b6209e87ab9003a9f140bd9afd018ec569e71721e3a24090e1902c8b6659d2ba103e

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.2.14-perlthreadsfix.patch

@@ -1,6 +1,5 @@
-diff -ur openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in openldap-2.2.14/servers/slapd/back-perl/Makefile.in
---- openldap-2.2.14.orig/servers/slapd/back-perl/Makefile.in	2004-04-12 11:20:14.000000000 -0700
-+++ openldap-2.2.14/servers/slapd/back-perl/Makefile.in	2004-06-20 18:43:41.000000000 -0700
+--- a/servers/slapd/back-perl/Makefile.in
++++ b/servers/slapd/back-perl/Makefile.in
 @@ -31,7 +31,7 @@
  
  shared_LDAP_LIBS = $(LDAP_LIBLDAP_R_LA) $(LDAP_LIBLBER_LA)

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.11-libldap_r.patch

@@ -1,6 +1,5 @@
-diff -Nuar openldap-2.4.11.orig/servers/slapd/slapi/Makefile.in openldap-2.4.11/servers/slapd/slapi/Makefile.in
---- openldap-2.4.11.orig/servers/slapd/slapi/Makefile.in	2008-02-11 15:26:49.000000000 -0800
-+++ openldap-2.4.11/servers/slapd/slapi/Makefile.in	2008-10-14 02:10:18.402799262 -0700
+--- a/servers/slapd/slapi/Makefile.in
++++ b/servers/slapd/slapi/Makefile.in
 @@ -37,6 +37,7 @@
  XLIBS = $(LIBRARY)
  XXLIBS = 

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.15-ppolicy.patch

@@ -1,5 +1,5 @@
---- openldap-2.4.15/clients/tools/common.c.orig	2009-02-05 15:05:03.000000000 -0800
-+++ openldap-2.4.15/clients/tools/common.c	2009-03-21 01:45:14.000000000 -0700
+--- a/clients/tools/common.c
++++ b/clients/tools/common.c
 @@ -1315,8 +1315,8 @@
  	int		nsctrls = 0;
  

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.17-gcc44.patch

@@ -1,6 +1,5 @@
-diff -ur openldap-2.4.17.orig/contrib/ldapc++/src/SaslInteractionHandler.cpp openldap-2.4.17/contrib/ldapc++/src/SaslInteractionHandler.cpp
---- openldap-2.4.17.orig/contrib/ldapc++/src/SaslInteractionHandler.cpp	2008-04-15 02:09:26.000000000 +0300
-+++ openldap-2.4.17/contrib/ldapc++/src/SaslInteractionHandler.cpp	2009-08-10 13:21:24.000000000 +0300
+--- a/contrib/ldapc++/src/SaslInteractionHandler.cpp
++++ b/contrib/ldapc++/src/SaslInteractionHandler.cpp
 @@ -13,6 +13,7 @@
  #include <termios.h>
  #endif

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.28-fix-dash.patch

@@ -11,8 +11,6 @@ Patch unbreaks build when /bin/sh points to dash:
     eval: 1: base_compile+= x86_64-pc-linux-gnu-gcc: not found
     ...
     make[2]: *** [decode.lo] Error 1
-diff --git a/build/top.mk b/build/top.mk
-index 6fea488..ea324e3 100644
 --- a/build/top.mk
 +++ b/build/top.mk
 @@ -20,7 +20,7 @@ VERSION= @VERSION@

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.28-gnutls-gcrypt.patch

@@ -1,5 +1,5 @@
---- openldap-2.4.28/configure.in.orig	2012-02-11 22:40:36.004360795 +0000
-+++ openldap-2.4.28/configure.in	2012-02-11 22:40:13.410986851 +0000
+--- a/configure.in
++++ b/configure.in
 @@ -1214,7 +1214,7 @@
  				ol_with_tls=gnutls
  				ol_link_tls=yes

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.35-contrib-samba4.patch

@@ -1,6 +1,5 @@
-diff -Nuar openldap-2.4.35.orig/contrib/slapd-modules/samba4/Makefile openldap-2.4.35/contrib/slapd-modules/samba4/Makefile
---- openldap-2.4.35.orig/contrib/slapd-modules/samba4/Makefile	2013-03-28 15:41:51.000000000 +0000
-+++ openldap-2.4.35/contrib/slapd-modules/samba4/Makefile	2013-04-16 02:16:40.651868432 +0000
+--- a/contrib/slapd-modules/samba4/Makefile
++++ b/contrib/slapd-modules/samba4/Makefile
 @@ -20,7 +20,8 @@
  
  LIBTOOL = $(LDAP_BUILD)/libtool

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.35-contrib-smbk5pwd.patch

@@ -1,6 +1,5 @@
-diff -Nuar openldap-2.4.35.orig/contrib/slapd-modules/smbk5pwd/Makefile openldap-2.4.35/contrib/slapd-modules/smbk5pwd/Makefile
---- openldap-2.4.35.orig/contrib/slapd-modules/smbk5pwd/Makefile	2013-03-28 15:41:51.000000000 +0000
-+++ openldap-2.4.35/contrib/slapd-modules/smbk5pwd/Makefile	2013-04-16 02:13:38.939913119 +0000
+--- a/contrib/slapd-modules/smbk5pwd/Makefile
++++ b/contrib/slapd-modules/smbk5pwd/Makefile
 @@ -21,16 +21,23 @@
  SSL_INC = 
  SSL_LIB = -lcrypto

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.42-mdb-unbundle.patch

@@ -1,5 +1,5 @@
---- ./build/top.mk.orig	2014-10-24 14:34:59.260827298 +0200
-+++ ./build/top.mk	2014-10-24 14:35:25.281168893 +0200
+--- a/build/top.mk
++++ b/build/top.mk
 @@ -160,6 +160,7 @@
  LTHREAD_LIBS = @LTHREAD_LIBS@
  
@@ -8,8 +8,8 @@
  SLAPD_NDB_LIBS = @SLAPD_NDB_LIBS@
  
  LDAP_LIBLBER_LA = $(LDAP_LIBDIR)/liblber/liblber.la
---- ./build/openldap.m4.orig	2014-10-24 10:52:02.837221734 +0200
-+++ ./build/openldap.m4	2014-10-24 11:31:02.748087966 +0200
+--- ./build/openldap.m4.orig
++++ ./build/openldap.m4
 @@ -563,6 +563,38 @@
  	], [ol_cv_bdb_compat=yes], [ol_cv_bdb_compat=no])])
  ])
@@ -49,8 +49,8 @@
  dnl
  dnl ====================================================================
  dnl Check POSIX Thread version 
---- ./servers/slapd/back-mdb/Makefile.in.orig	2014-10-24 10:31:30.860931076 +0200
-+++ ./servers/slapd/back-mdb/Makefile.in	2014-10-24 14:33:33.803705424 +0200
+--- a/servers/slapd/back-mdb/Makefile.in
++++ b/servers/slapd/back-mdb/Makefile.in
 @@ -25,11 +25,10 @@
  	extended.lo operational.lo \
  	attr.lo index.lo key.lo filterindex.lo \
@@ -85,8 +85,8 @@
 -
  veryclean-local-lib: FORCE
  	$(RM) $(XXHEADERS) $(XXSRCS) .links
---- ./configure.in.orig	2014-10-24 10:46:53.289139847 +0200
-+++ ./configure.in	2014-10-24 10:51:34.372846374 +0200
+--- a/configure.in
++++ b/configure.in
 @@ -519,6 +519,7 @@
  dnl Initialize vars
  LDAP_LIBS=

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.45-fix-lmpasswd-gnutls-symbols.patch

@@ -7,8 +7,8 @@ X-Gentoo-Bug: http://bugs.gentoo.org/show_bug.cgi?id=233633
 X-Upstream-Bug: http://www.openldap.org/its/index.cgi/Software%20Enhancements?id=4997
 X-Debian-Bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=245341
 
---- openldap-2.4.17.orig/libraries/liblutil/passwd.c	2009-07-27 18:59:19.635995474 -0700
-+++ openldap-2.4.17/libraries/liblutil/passwd.c	2009-07-27 19:01:13.588069010 -0700
+--- a/libraries/liblutil/passwd.c
++++ b/libraries/liblutil/passwd.c
 @@ -51,6 +51,26 @@ typedef unsigned char des_data_block[8];
  typedef PK11Context *des_context[1];
  #define DES_ENCRYPT CKA_ENCRYPT

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.47-libressl.patch

@@ -1,58 +0,0 @@
-diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
-index b0277dfe9..8a3f47a74 100644
---- a/libraries/libldap/tls_o.c
-+++ b/libraries/libldap/tls_o.c
-@@ -50,7 +50,7 @@
- #include <ssl.h>
- #endif
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
- #define ASN1_STRING_data(x)	ASN1_STRING_get0_data(x)
- #endif
- 
-@@ -200,7 +200,7 @@ tlso_init( void )
- 	(void) tlso_seed_PRNG( lo->ldo_tls_randfile );
- #endif
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000
-+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
- 	SSL_load_error_strings();
- 	SSL_library_init();
- 	OpenSSL_add_all_digests();
-@@ -252,7 +252,7 @@ static void
- tlso_ctx_ref( tls_ctx *ctx )
- {
- 	tlso_ctx *c = (tlso_ctx *)ctx;
--#if OPENSSL_VERSION_NUMBER < 0x10100000
-+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
- #define	SSL_CTX_up_ref(ctx)	CRYPTO_add( &(ctx->references), 1, CRYPTO_LOCK_SSL_CTX )
- #endif
- 	SSL_CTX_up_ref( c );
-@@ -511,7 +511,7 @@ tlso_session_my_dn( tls_session *sess, struct berval *der_dn )
- 	if (!x) return LDAP_INVALID_CREDENTIALS;
- 	
- 	xn = X509_get_subject_name(x);
--#if OPENSSL_VERSION_NUMBER < 0x10100000
-+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
- 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
- 	der_dn->bv_val = xn->bytes->data;
- #else
-@@ -547,7 +547,7 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn )
- 		return LDAP_INVALID_CREDENTIALS;
- 
- 	xn = X509_get_subject_name(x);
--#if OPENSSL_VERSION_NUMBER < 0x10100000
-+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
- 	der_dn->bv_len = i2d_X509_NAME( xn, NULL );
- 	der_dn->bv_val = xn->bytes->data;
- #else
-@@ -768,7 +768,7 @@ struct tls_data {
- 	Sockbuf_IO_Desc		*sbiod;
- };
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000
-+#if OPENSSL_VERSION_NUMBER < 0x10100000 || defined(LIBRESSL_VERSION_NUMBER)
- #define BIO_set_init(b, x)	b->init = x
- #define BIO_set_data(b, x)	b->ptr = x
- #define BIO_clear_flags(b, x)	b->flags &= ~(x)

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.47-warnings.patch

@@ -1,5 +1,3 @@
-diff --git a/include/ldap.h b/include/ldap.h
-index c245651c2..7f14f1051 100644
 --- a/include/ldap.h
 +++ b/include/ldap.h
 @@ -2041,6 +2041,10 @@ LDAP_F( int )
@@ -13,8 +11,6 @@ index c245651c2..7f14f1051 100644
  LDAP_F( int )
  ldap_url_parse LDAP_P((
  	LDAP_CONST char *url,
-diff --git a/include/ldap_int_thread.h b/include/ldap_int_thread.h
-index e2dd8a942..bbc07c845 100644
 --- a/include/ldap_int_thread.h
 +++ b/include/ldap_int_thread.h
 @@ -33,7 +33,7 @@ LDAP_END_DECL
@@ -26,8 +22,6 @@ index e2dd8a942..bbc07c845 100644
  #include <pthread.h>
  #ifdef HAVE_SCHED_H
  #include <sched.h>
-diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
-index d25c190ea..639f598e7 100644
 --- a/libraries/libldap/tls2.c
 +++ b/libraries/libldap/tls2.c
 @@ -76,6 +76,8 @@ static oid_name oids[] = {

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.4.6-evolution-ntlm.patch

@@ -1,6 +1,5 @@
-diff -up evo-openldap-2.4.14/include/ldap.h.evolution-ntlm evo-openldap-2.4.14/include/ldap.h
---- evo-openldap-2.4.14/include/ldap.h.evolution-ntlm	2009-01-27 00:29:53.000000000 +0100
-+++ evo-openldap-2.4.14/include/ldap.h	2009-02-17 10:10:00.000000000 +0100
+--- a/include/ldap.h
++++ b/include/ldap.h
 @@ -2461,5 +2461,26 @@ ldap_parse_deref_control LDAP_P((
  	LDAPControl	**ctrls,
  	LDAPDerefRes	**drp ));
@@ -28,9 +27,8 @@ diff -up evo-openldap-2.4.14/include/ldap.h.evolution-ntlm evo-openldap-2.4.14/i
 +
  LDAP_END_DECL
  #endif /* _LDAP_H */
-diff -up evo-openldap-2.4.14/libraries/libldap/Makefile.in.evolution-ntlm evo-openldap-2.4.14/libraries/libldap/Makefile.in
---- evo-openldap-2.4.14/libraries/libldap/Makefile.in.evolution-ntlm	2009-01-27 00:29:53.000000000 +0100
-+++ evo-openldap-2.4.14/libraries/libldap/Makefile.in	2009-02-17 10:10:00.000000000 +0100
+--- a/libraries/libldap/Makefile.in
++++ b/libraries/libldap/Makefile.in
 @@ -20,7 +20,7 @@ PROGRAMS = apitest dntest ftest ltest ur
  SRCS	= bind.c open.c result.c error.c compare.c search.c \
  	controls.c messages.c references.c extended.c cyrus.c \
@@ -49,9 +47,8 @@ diff -up evo-openldap-2.4.14/libraries/libldap/Makefile.in.evolution-ntlm evo-op
  	filter.lo free.lo sort.lo passwd.lo whoami.lo \
  	getdn.lo getentry.lo getattr.lo getvalues.lo addentry.lo \
  	request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \
-diff -up /dev/null evo-openldap-2.4.14/libraries/libldap/ntlm.c
---- /dev/null	2009-02-17 09:19:52.829004420 +0100
-+++ evo-openldap-2.4.14/libraries/libldap/ntlm.c	2009-02-17 10:10:00.000000000 +0100
+--- /dev/null
++++ b/libraries/libldap/ntlm.c
 @@ -0,0 +1,137 @@
 +/* $OpenLDAP: pkg/ldap/libraries/libldap/ntlm.c,v 1.1.4.10 2002/01/04 20:38:21 kurt Exp $ */
 +/*

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-cloak.patch

@@ -0,0 +1,21 @@
+--- a/contrib/slapd-modules/cloak/cloak.c
++++ b/contrib/slapd-modules/cloak/cloak.c
+@@ -29,6 +29,7 @@
+ #include "ac/socket.h"
+ 
+ #include "lutil.h"
++#include "attr.h"
+ #include "slap.h"
+ #include "slap-config.h"
+ 
+--- a/servers/slapd/attr.h
++++ b/servers/slapd/attr.h
+@@ -0,0 +1,8 @@
++#ifndef OPENLDAP_SERVERS_SLAPD_ATTR_H_
++#define OPENLDAP_SERVERS_SLAPD_ATTR_H_
++
++#endif //OPENLDAP_SERVERS_SLAPD_ATTR_H_
++
++#include "slap.h"
++
++void attr_clean( Attribute *a );

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-fix-bashism-configure.patch

@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -2055,7 +2055,7 @@ dnl
+ WITH_SYSTEMD=no
+ systemdsystemunitdir=
+ ol_link_systemd=no
+-if test $ol_enable_slapd == no && test $ol_enable_balancer != yes ; then
++if test $ol_enable_slapd = no && test $ol_enable_balancer != yes ; then
+ 	if test $ol_with_systemd != no ; then
+ 		AC_MSG_WARN([servers disabled, ignoring --with-systemd=$ol_with_systemd argument])
+ 		ol_with_systemd=no

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-fix-missing-mapping.patch

@@ -0,0 +1,15 @@
+From 59e013602d7b1aa0d7da79d65367c9ec391b96f8 Mon Sep 17 00:00:00 2001
+From: Simon Pichugin <spichugi@redhat.com>
+Date: Wed, 3 Nov 2021 19:03:40 -0700
+Subject: [PATCH] Fix missing mapping
+
+--- a/libraries/liblber/lber.map
++++ b/libraries/liblber/lber.map
+@@ -121,6 +121,7 @@ OPENLDAP_2.200
+     ber_sockbuf_io_fd;
+     ber_sockbuf_io_readahead;
+     ber_sockbuf_io_tcp;
++    ber_sockbuf_io_udp;
+     ber_sockbuf_remove_io;
+     ber_sos_dump;
+     ber_start;

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-flags.patch

@@ -0,0 +1,352 @@
+--- a/contrib/slapd-modules/acl/Makefile
++++ b/contrib/slapd-modules/acl/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/addpartial/Makefile
++++ b/contrib/slapd-modules/addpartial/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/adremap/Makefile
++++ b/contrib/slapd-modules/adremap/Makefile
+@@ -19,7 +19,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_ADREMAP=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/allop/Makefile
++++ b/contrib/slapd-modules/allop/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/allowed/Makefile
++++ b/contrib/slapd-modules/allowed/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_ALLOWED=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/authzid/Makefile
++++ b/contrib/slapd-modules/authzid/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/autogroup/Makefile
++++ b/contrib/slapd-modules/autogroup/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/cloak/Makefile
++++ b/contrib/slapd-modules/cloak/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_CLOAK=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/comp_match/Makefile
++++ b/contrib/slapd-modules/comp_match/Makefile
+@@ -31,7 +31,7 @@ SSL_LIB = -lcrypto -L$(SSL_DIR)/lib
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DLDAP_COMPONENT
+ INCS = $(LDAP_INC) $(SNACC_INC) $(SSL_INC)
+ LIBS = $(LDAP_LIB) $(SNACC_LIB) $(SSL_LIB)
+--- a/contrib/slapd-modules/datamorph/Makefile
++++ b/contrib/slapd-modules/datamorph/Makefile
+@@ -22,7 +22,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_DATAMORPH=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/denyop/Makefile
++++ b/contrib/slapd-modules/denyop/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_DENYOP=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/dsaschema/Makefile
++++ b/contrib/slapd-modules/dsaschema/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/dupent/Makefile
++++ b/contrib/slapd-modules/dupent/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_DUPENT=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/kinit/Makefile
++++ b/contrib/slapd-modules/kinit/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB) -lkrb5
+--- a/contrib/slapd-modules/lastbind/Makefile
++++ b/contrib/slapd-modules/lastbind/Makefile
+@@ -19,7 +19,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_LASTBIND=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/lastmod/Makefile
++++ b/contrib/slapd-modules/lastmod/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_LASTMOD=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/noopsrch/Makefile
++++ b/contrib/slapd-modules/noopsrch/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2 -Wall
++OPT = -Wall -Wall
+ DEFS = -DSLAPD_OVER_NOOPSRCH=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/nops/Makefile
++++ b/contrib/slapd-modules/nops/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_NOPS=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/nssov/Makefile
++++ b/contrib/slapd-modules/nssov/Makefile
+@@ -27,7 +27,7 @@ NLDAPD_INC=-Inss-pam-ldapd
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+-OPT = -g -O2
++OPT = -Wall
+ CC = gcc
+ DEFS =
+ INCS = $(LDAP_INC) $(NLDAPD_INC)
+--- a/contrib/slapd-modules/passwd/Makefile
++++ b/contrib/slapd-modules/passwd/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/passwd/pbkdf2/Makefile
++++ b/contrib/slapd-modules/passwd/pbkdf2/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ #DEFS = -DSLAPD_PBKDF2_DEBUG
+ 
+ SSL_INC =
+--- a/contrib/slapd-modules/passwd/sha2/Makefile
++++ b/contrib/slapd-modules/passwd/sha2/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ #DEFS = -DSLAPD_SHA2_DEBUG
+ INCS = $(LDAP_INC)
+--- a/contrib/slapd-modules/passwd/totp/Makefile
++++ b/contrib/slapd-modules/passwd/totp/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/ppm/Makefile
++++ b/contrib/slapd-modules/ppm/Makefile
+@@ -18,7 +18,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/liblber/liblber.la $(LDAP_BUILD)/libraries/li
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2 -fpic
++OPT = -Wall -fpic
+ 
+ # To skip linking against CRACKLIB make CRACK=no
+ CRACK=yes
+--- a/contrib/slapd-modules/proxyOld/Makefile
++++ b/contrib/slapd-modules/proxyOld/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/rbac/Makefile
++++ b/contrib/slapd-modules/rbac/Makefile
+@@ -9,7 +9,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_RBAC=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/samba4/Makefile
++++ b/contrib/slapd-modules/samba4/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_RDNVAL=SLAPD_MOD_DYNAMIC \
+ 	-DSLAPD_OVER_PGUID=SLAPD_MOD_DYNAMIC \
+ 	-DSLAPD_OVER_VERNUM=SLAPD_MOD_DYNAMIC
+--- a/contrib/slapd-modules/smbk5pwd/Makefile
++++ b/contrib/slapd-modules/smbk5pwd/Makefile
+@@ -27,7 +27,7 @@ HEIMDAL_LIB = -L/usr/heimdal/lib -lkrb5 -lkadm5srv
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ # Omit DO_KRB5, DO_SAMBA or DO_SHADOW if you don't want to support it.
+ DEFS = -DDO_KRB5 -DDO_SAMBA -DDO_SHADOW
+ INCS = $(LDAP_INC) $(HEIMDAL_INC) $(SSL_INC)
+--- a/contrib/slapd-modules/trace/Makefile
++++ b/contrib/slapd-modules/trace/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_TRACE=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/usn/Makefile
++++ b/contrib/slapd-modules/usn/Makefile
+@@ -8,7 +8,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_USN=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/variant/Makefile
++++ b/contrib/slapd-modules/variant/Makefile
+@@ -22,7 +22,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ INSTALL = /usr/bin/install
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = -DSLAPD_OVER_VARIANT=SLAPD_MOD_DYNAMIC
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)
+--- a/contrib/slapd-modules/vc/Makefile
++++ b/contrib/slapd-modules/vc/Makefile
+@@ -20,7 +20,7 @@ LDAP_LIB = $(LDAP_BUILD)/libraries/libldap/libldap.la \
+ 
+ LIBTOOL = $(LDAP_BUILD)/libtool
+ CC = gcc
+-OPT = -g -O2
++OPT = -Wall
+ DEFS = 
+ INCS = $(LDAP_INC)
+ LIBS = $(LDAP_LIB)

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-make-flags.patch

@@ -0,0 +1,59 @@
+https://github.com/openldap/openldap/commit/8e3f87f86a51e78bffefb85968e5684213422cb7
+
+From: Orgad Shaneh <orgad.shaneh@audiocodes.com>
+Date: Tue, 25 Jan 2022 17:38:46 +0200
+Subject: [PATCH] ITS#9788 Fix make jobserver warnings
+
+Running make -j8 issues the following warning for each directory with
+make 4.3:
+make[2]: warning: -j8 forced in submake: resetting jobserver mode.
+
+There is no need to pass MFLAGS. Make picks it up from the
+environment anyway.
+--- a/build/dir.mk
++++ b/build/dir.mk
+@@ -21,7 +21,7 @@ all-common: FORCE
+ 	@echo "Making all in `$(PWD)`"
+ 	@for i in $(SUBDIRS) $(ALLDIRS); do 		\
+ 		echo "  Entering subdirectory $$i";		\
+-		( cd $$i && $(MAKE) $(MFLAGS) all );		\
++		( cd $$i && $(MAKE) all );		\
+ 		if test $$? != 0 ; then exit 1; fi ;	\
+ 		echo " ";								\
+ 	done
+@@ -30,7 +30,7 @@ install-common: FORCE
+ 	@echo "Making install in `$(PWD)`"
+ 	@for i in $(SUBDIRS) $(INSTALLDIRS); do 	\
+ 		echo "  Entering subdirectory $$i";		\
+-		( cd $$i && $(MAKE) $(MFLAGS) install );	\
++		( cd $$i && $(MAKE) install );	\
+ 		if test $$? != 0 ; then exit 1; fi ;	\
+ 		echo " ";								\
+ 	done
+@@ -39,7 +39,7 @@ clean-common: FORCE
+ 	@echo "Making clean in `$(PWD)`"
+ 	@for i in $(SUBDIRS) $(CLEANDIRS); do		\
+ 		echo "  Entering subdirectory $$i";		\
+-		( cd $$i && $(MAKE) $(MFLAGS) clean );	\
++		( cd $$i && $(MAKE) clean );	\
+ 		if test $$? != 0 ; then exit 1; fi ;	\
+ 		echo " ";								\
+ 	done
+@@ -48,7 +48,7 @@ veryclean-common: FORCE
+ 	@echo "Making veryclean in `$(PWD)`"
+ 	@for i in $(SUBDIRS) $(CLEANDIRS); do		\
+ 		echo "  Entering subdirectory $$i";		\
+-		( cd $$i && $(MAKE) $(MFLAGS) veryclean );	\
++		( cd $$i && $(MAKE) veryclean );	\
+ 		if test $$? != 0 ; then exit 1; fi ;	\
+ 		echo " ";								\
+ 	done
+@@ -57,7 +57,7 @@ depend-common: FORCE
+ 	@echo "Making depend in `$(PWD)`"
+ 	@for i in $(SUBDIRS) $(DEPENDDIRS); do		\
+ 		echo "  Entering subdirectory $$i";		\
+-		( cd $$i && $(MAKE) $(MFLAGS) depend );	\
++		( cd $$i && $(MAKE) depend );	\
+ 		if test $$? != 0 ; then exit 1; fi ;	\
+ 		echo " ";								\
+ 	done

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/openldap-2.6.1-system-mdb.patch

@@ -0,0 +1,140 @@
+--- a/build/openldap.m4
++++ b/build/openldap.m4
+@@ -243,6 +243,40 @@ OL_RESOLVER_TRY(ol_cv_resolver_none)
+ OL_RESOLVER_TRY(ol_cv_resolver_resolv,[-lresolv])
+ OL_RESOLVER_TRY(ol_cv_resolver_bind,[-lbind])
+ ])
++
++dnl --------------------------------------------------------------------
++dnl Check for version compatility with back-mdb
++AC_DEFUN([OL_MDB_COMPAT],
++[AC_CACHE_CHECK([if LMDB version supported by MDB backends], [ol_cv_mdb_compat],[
++	AC_EGREP_CPP(__mdb_version_compat,[
++#include <lmdb.h>
++
++/* require 0.9.18 or later */
++#if MDB_VERSION_FULL >= 0x000000090012
++	__mdb_version_compat
++#endif
++	], [ol_cv_mdb_compat=yes], [ol_cv_mdb_compat=no])])
++])
++
++dnl
++dnl --------------------------------------------------------------------
++dnl Find any MDB
++AC_DEFUN([OL_MDB],
++[ol_cv_mdb=no
++AC_CHECK_HEADERS(lmdb.h)
++if test $ac_cv_header_lmdb_h = yes; then
++	OL_MDB_COMPAT
++
++	if test $ol_cv_mdb_compat != yes ; then
++		AC_MSG_ERROR([LMDB version incompatible with MDB backends])
++	fi
++
++	ol_cv_lib_mdb=-llmdb
++	ol_cv_mdb=yes
++fi
++])
++
++
+ dnl
+ dnl ====================================================================
+ dnl Check POSIX Thread version 
+--- a/build/top.mk
++++ b/build/top.mk
+@@ -164,6 +164,7 @@ CLIENT_LIBS = @CLIENT_LIBS@
+ LUTIL_LIBS = @LUTIL_LIBS@
+ LTHREAD_LIBS = @LTHREAD_LIBS@
+ 
++MDB_LIBS = @MDB_LIBS@
+ SLAPD_NDB_LIBS = @SLAPD_NDB_LIBS@
+ WT_LIBS = @WT_LIBS@
+ 
+--- a/configure.ac
++++ b/configure.ac
+@@ -547,6 +547,7 @@ AC_MSG_RESULT(done)
+ dnl ----------------------------------------------------------------
+ dnl Initialize vars
+ LDAP_LIBS=
++MDB_LIBS=
+ SLAPD_NDB_LIBS=
+ SLAPD_NDB_INCS=
+ LTHREAD_LIBS=
+@@ -646,6 +647,32 @@ dnl Checks for programs
+ 
+ AC_DEFINE(HAVE_MKVERSION, 1, [define this if you have mkversion])
+ 
++dnl ----------------------------------------------------------------
++ol_link_mdb=no
++
++AS_IF([test x$ol_enable_mdb != xno], [
++	OL_MDB
++
++	if test $ol_cv_mdb = no ; then
++		AC_MSG_ERROR(MDB: LMDB not available)
++	fi
++
++	AC_DEFINE(HAVE_MDB,1,
++		[define this if LMDB is available])
++
++	dnl $ol_cv_lib_mdb should be yes or -llmdb
++	dnl (it could be no, but that would be an error
++	if test $ol_cv_lib_mdb != yes ; then
++		MDB_LIBS="$MDB_LIBS $ol_cv_lib_mdb"
++	fi
++
++	SLAPD_LIBS="$SLAPD_LIBS \$(MDB_LIBS)"
++
++	ol_link_mdb=yes
++])
++
++dnl ----------------------------------------------------------------
++
+ dnl ----------------------------------------------------------------
+ dnl
+ dnl Determine which C translator to use
+@@ -3150,6 +3177,7 @@ dnl pwmods
+ AC_SUBST(LDAP_LIBS)
+ AC_SUBST(CLIENT_LIBS)
+ AC_SUBST(SLAPD_LIBS)
++AC_SUBST(MDB_LIBS)
+ AC_SUBST(BALANCER_LIBS)
+ AC_SUBST(SLAPD_NDB_LIBS)
+ AC_SUBST(SLAPD_NDB_INCS)
+--- a/servers/slapd/back-mdb/Makefile.in
++++ b/servers/slapd/back-mdb/Makefile.in
+@@ -25,11 +25,10 @@ OBJS = init.lo tools.lo config.lo \
+ 	extended.lo operational.lo \
+ 	attr.lo index.lo key.lo filterindex.lo \
+ 	dn2entry.lo dn2id.lo id2entry.lo idl.lo \
+-	nextid.lo monitor.lo mdb.lo midl.lo
++	nextid.lo monitor.lo
+ 
+ LDAP_INCDIR= ../../../include       
+ LDAP_LIBDIR= ../../../libraries
+-MDB_SUBDIR = $(srcdir)/$(LDAP_LIBDIR)/liblmdb
+ 
+ BUILD_OPT = "--enable-mdb"
+ BUILD_MOD = @BUILD_MDB@
+@@ -44,7 +43,7 @@ UNIX_LINK_LIBS = $(@BUILD_LIBS_DYNAMIC@_LDAP_LIBS)
+ 
+ LIBBASE = back_mdb
+ 
+-XINCPATH = -I.. -I$(srcdir)/.. -I$(MDB_SUBDIR)
++XINCPATH = -I.. -I$(srcdir)/..
+ XDEFS = $(MODULES_CPPFLAGS)
+ 
+ all-local-lib:	../.backend
+@@ -52,11 +51,5 @@ all-local-lib:	../.backend
+ ../.backend: lib$(LIBBASE).a
+ 	@touch $@
+ 
+-mdb.lo:	$(MDB_SUBDIR)/mdb.c
+-	$(LTCOMPILE_MOD) $(MDB_SUBDIR)/mdb.c
+-
+-midl.lo:	$(MDB_SUBDIR)/midl.c
+-	$(LTCOMPILE_MOD) $(MDB_SUBDIR)/midl.c
+-
+ veryclean-local-lib: FORCE
+ 	$(RM) $(XXHEADERS) $(XXSRCS) .links

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/slapd-2.6.1.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=OpenLDAP Server Daemon
+After=network.target
+
+[Service]
+Type=notify
+PIDFile=/run/openldap/slapd.pid
+ExecStartPre=/usr/sbin/slaptest -Q -u $SLAPD_OPTIONS
+ExecStart=/usr/lib/openldap/slapd -u ldap -h ${SLAPD_URLS} $SLAPD_OPTIONS
+
+[Install]
+WantedBy=multi-user.target

sdk_container/src/third_party/portage-stable/net-nds/openldap/files/slapd-confd-2.6.1

@@ -0,0 +1,26 @@
+# conf.d file for openldap
+#
+# To enable both the standard unciphered server and the ssl encrypted
+# one uncomment this line or set any other server starting options
+# you may desire.
+
+# If you have multiple slapd instances per #376699, this will provide a default config
+INSTANCE="openldap${SVCNAME#slapd}"
+
+# If you use the classical configuration file:
+OPTS_CONF="-f /etc/${INSTANCE}/slapd.conf"
+# Uncomment this instead to use the new slapd.d configuration directory for openldap 2.3
+#OPTS_CONF="-F /etc/${INSTANCE}/slapd.d"
+# (the OPTS_CONF variable is also passed to slaptest during startup)
+
+OPTS="${OPTS_CONF} -h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock'"
+# Optional connectionless LDAP:
+#OPTS="${OPTS_CONF} -h 'ldaps:// ldap:// ldapi://%2frun%2fopenldap%2fslapd.sock cldap://'"
+
+# If you change the above listen statement to bind on a specific IP for
+# listening, you should ensure that interface is up here (change eth0 as
+# needed).
+#rc_need="net.eth0"
+
+# Specify the kerberos keytab file
+#KRB5_KTNAME=/etc/openldap/krb5-ldap.keytab

sdk_container/src/third_party/portage-stable/net-nds/openldap/metadata.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
 	<maintainer type="person">
 		<email>zlogene@gentoo.org</email>
@@ -9,6 +9,9 @@
 		<email>ldap-bugs@gentoo.org</email>
 	</maintainer>
 	<use>
+		<flag name="argon2">Enable password hashing algorithm from <pkg>app-crypt/argon2</pkg></flag>
+		<flag name="autoca">Automatic Certificate Authority overlay</flag>
+		<flag name="cleartext">Enable use of cleartext passwords</flag>
 		<flag name="experimental">Enable experimental backend options</flag>
 		<flag name="kinit">Enable support for kerberos init</flag>
 		<flag name="odbc">Enable ODBC and SQL backend options</flag>
@@ -19,6 +22,8 @@
 		<flag name="sha2">Enable support for pw-sha2 password hashes</flag>
 	</use>
 	<upstream>
+		<bugs-to>https://bugs.openldap.org/</bugs-to>
 		<remote-id type="cpe">cpe:/a:openldap:openldap</remote-id>
+		<remote-id type="gitlab">openldap/openldap</remote-id>
 	</upstream>
 </pkgmetadata>

sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.57-r2.ebuild

@@ -1,9 +1,9 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
 
-inherit autotools db-use flag-o-matic multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+inherit autotools db-use flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
 
 BIS_PN=rfc2307bis.schema
 BIS_PV=20140524
@@ -22,14 +22,14 @@ SRC_URI="
 
 LICENSE="OPENLDAP GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x86-solaris"
 
 IUSE_DAEMON="crypt samba tcpd experimental minimal"
 IUSE_BACKEND="+berkdb"
 IUSE_OVERLAY="overlays perl"
-IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 libressl +syslog selinux static-libs test"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 +syslog selinux static-libs test"
 IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
-IUSE_CONTRIB="${IUSE_CONTRIB} -cxx"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
 
 RESTRICT="!test? ( test )"
@@ -42,7 +42,7 @@ REQUIRED_USE="cxx? ( sasl )
 # Do not add any AGPL-3 BDB here!
 # See bug 525110, comment 15.
 # Advanced usage: OPENLDAP_BDB_SLOTS in the environment can be used to force a slot during build.
-BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 5.1 4.8 4.7 4.6 4.5 4.4}"
+BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 4.8}"
 BDB_PKGS=''
 for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
 
@@ -50,8 +50,7 @@ for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
 COMMON_DEPEND="
 	ssl? (
 		!gnutls? (
-			!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-			libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
 		)
 		gnutls? (
 			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
@@ -61,23 +60,22 @@ COMMON_DEPEND="
 	sasl? ( dev-libs/cyrus-sasl:= )
 	!minimal? (
 		dev-libs/libltdl
-		sys-libs/e2fsprogs-libs
+		sys-fs/e2fsprogs
 		>=dev-db/lmdb-0.9.18:=
+		crypt? ( virtual/libcrypt:= )
 		tcpd? ( sys-apps/tcp-wrappers )
 		odbc? ( !iodbc? ( dev-db/unixODBC )
 			iodbc? ( dev-db/libiodbc ) )
 		perl? ( dev-lang/perl:=[-build(-)] )
 		samba? (
-			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl:0= )
+			dev-libs/openssl:0=
 		)
 		berkdb? (
 			<sys-libs/db-6.0:=
 			|| ( ${BDB_PKGS} )
 			)
 		smbkrb5passwd? (
-			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl:0= )
+			dev-libs/openssl:0=
 			kerberos? ( app-crypt/heimdal )
 			)
 		kerberos? (
@@ -96,14 +94,13 @@ RDEPEND="${COMMON_DEPEND}
 
 # The user/group are only used for running daemons which are
 # disabled in minimal builds, so elide the accounts too.
-# for tracking versions
-
 BDEPEND="!minimal? (
 		acct-group/ldap
 		acct-user/ldap
 )
 "
 
+# for tracking versions
 OPENLDAP_VERSIONTAG=".version-tag"
 OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
 
@@ -177,9 +174,6 @@ PATCHES=(
 	# unbundle lmdb
 	"${FILESDIR}"/${PN}-2.4.42-mdb-unbundle.patch
 
-	# bug #622464
-	"${FILESDIR}"/${PN}-2.4.47-libressl.patch
-
 	# fix some compiler warnings
 	"${FILESDIR}"/${PN}-2.4.47-warnings.patch
 )
@@ -867,6 +861,8 @@ pkg_preinst() {
 
 pkg_postinst() {
 	if ! use minimal ; then
+		tmpfiles_process slapd.conf
+
 		# You cannot build SSL certificates during src_install that will make
 		# binary packages containing your SSL key, which is both a security risk
 		# and a misconfiguration if multiple machines use the same key and cert.

sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.58-r2.ebuild

@@ -0,0 +1,905 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools db-use flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+
+BIS_PN=rfc2307bis.schema
+BIS_PV=20140524
+BIS_P="${BIS_PN}-${BIS_PV}"
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="https://www.OpenLDAP.org/"
+
+# upstream mirrors are mostly not working, using canonical URI
+SRC_URI="
+	https://openldap.org/software/download/OpenLDAP/openldap-release/${P}.tgz
+	http://gpl.savoirfairelinux.net/pub/mirrors/openldap/openldap-release/${P}.tgz
+	http://repository.linagora.org/OpenLDAP/openldap-release/${P}.tgz
+	http://mirror.eu.oneandone.net/software/openldap/openldap-release/${P}.tgz
+	mirror://gentoo/${BIS_P}"
+
+LICENSE="OPENLDAP GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~x86-solaris"
+
+IUSE_DAEMON="crypt samba tcpd experimental minimal"
+IUSE_BACKEND="+berkdb"
+IUSE_OVERLAY="overlays perl"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 +syslog selinux static-libs test"
+IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
+IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+
+RESTRICT="!test? ( test )"
+REQUIRED_USE="cxx? ( sasl )
+	pbkdf2? ( ssl )
+	test? ( berkdb )
+	?? ( test minimal )"
+
+# always list newer first
+# Do not add any AGPL-3 BDB here!
+# See bug 525110, comment 15.
+# Advanced usage: OPENLDAP_BDB_SLOTS in the environment can be used to force a slot during build.
+BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 4.8}"
+BDB_PKGS=''
+for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
+
+# openssl is needed to generate lanman-passwords required by samba
+COMMON_DEPEND="
+	ssl? (
+		!gnutls? (
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+		)
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}]
+		)
+	)
+	sasl? ( dev-libs/cyrus-sasl:= )
+	!minimal? (
+		dev-libs/libltdl
+		sys-fs/e2fsprogs
+		>=dev-db/lmdb-0.9.18:=
+		crypt? ( virtual/libcrypt:= )
+		tcpd? ( sys-apps/tcp-wrappers )
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		perl? ( dev-lang/perl:=[-build(-)] )
+		samba? (
+			dev-libs/openssl:0=
+		)
+		berkdb? (
+			<sys-libs/db-6.0:=
+			|| ( ${BDB_PKGS} )
+			)
+		smbkrb5passwd? (
+			dev-libs/openssl:0=
+			kerberos? ( app-crypt/heimdal )
+			)
+		kerberos? (
+			virtual/krb5
+			kinit? ( !app-crypt/heimdal )
+			)
+		cxx? ( dev-libs/cyrus-sasl:= )
+	)
+"
+DEPEND="${COMMON_DEPEND}
+	sys-apps/groff
+"
+RDEPEND="${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-ldap )
+"
+
+# The user/group are only used for running daemons which are
+# disabled in minimal builds, so elide the accounts too.
+BDEPEND="!minimal? (
+		acct-group/ldap
+		acct-user/ldap
+)
+"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# USE=cxx
+	/usr/include/LDAPAsynConnection.h
+	/usr/include/LDAPAttrType.h
+	/usr/include/LDAPAttribute.h
+	/usr/include/LDAPAttributeList.h
+	/usr/include/LDAPConnection.h
+	/usr/include/LDAPConstraints.h
+	/usr/include/LDAPControl.h
+	/usr/include/LDAPControlSet.h
+	/usr/include/LDAPEntry.h
+	/usr/include/LDAPEntryList.h
+	/usr/include/LDAPException.h
+	/usr/include/LDAPExtResult.h
+	/usr/include/LDAPMessage.h
+	/usr/include/LDAPMessageQueue.h
+	/usr/include/LDAPModList.h
+	/usr/include/LDAPModification.h
+	/usr/include/LDAPObjClass.h
+	/usr/include/LDAPRebind.h
+	/usr/include/LDAPRebindAuth.h
+	/usr/include/LDAPReferenceList.h
+	/usr/include/LDAPResult.h
+	/usr/include/LDAPSaslBindResult.h
+	/usr/include/LDAPSchema.h
+	/usr/include/LDAPSearchReference.h
+	/usr/include/LDAPSearchResult.h
+	/usr/include/LDAPSearchResults.h
+	/usr/include/LDAPUrl.h
+	/usr/include/LDAPUrlList.h
+	/usr/include/LdifReader.h
+	/usr/include/LdifWriter.h
+	/usr/include/SaslInteraction.h
+	/usr/include/SaslInteractionHandler.h
+	/usr/include/StringList.h
+	/usr/include/TlsOptions.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.17-gcc44.patch
+
+	"${FILESDIR}"/${PN}-2.2.14-perlthreadsfix.patch
+	"${FILESDIR}"/${PN}-2.4.15-ppolicy.patch
+
+	# bug #116045 - still present in 2.4.28
+	"${FILESDIR}"/${PN}-2.4.35-contrib-smbk5pwd.patch
+	# bug #408077 - samba4
+	"${FILESDIR}"/${PN}-2.4.35-contrib-samba4.patch
+
+	# bug #189817
+	"${FILESDIR}"/${PN}-2.4.11-libldap_r.patch
+
+	# bug #233633
+	"${FILESDIR}"/${PN}-2.4.45-fix-lmpasswd-gnutls-symbols.patch
+
+	# bug #281495
+	"${FILESDIR}"/${PN}-2.4.28-gnutls-gcrypt.patch
+
+	# bug #294350
+	"${FILESDIR}"/${PN}-2.4.6-evolution-ntlm.patch
+
+	# unbreak /bin/sh -> dash
+	"${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
+
+	# bug #420959
+	"${FILESDIR}"/${PN}-2.4.31-gcc47.patch
+
+	# unbundle lmdb
+	"${FILESDIR}"/${PN}-2.4.42-mdb-unbundle.patch
+
+	# fix some compiler warnings
+	"${FILESDIR}"/${PN}-2.4.47-warnings.patch
+)
+
+openldap_filecount() {
+	local dir="$1"
+	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
+}
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
+	fi
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	have_files=0
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${ROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
+			einfo "- Checking ${each}..."
+			if [[ -r "${CURRENT_TAG}" ]] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
+
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
+
+				# are we on the same branch?
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ "${have_files}" == "1" ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
+				if [[ "${have_files}" == "1" ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					openldap_upgrade_howto
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
+
+	# Now we must check for the major version of sys-libs/db linked against.
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
+		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
+			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
+		if use berkdb; then
+			# find which one would be used
+			for bdb_slot in ${BDB_SLOTS} ; do
+				NEWVER="$(db_findver "=sys-libs/db-${bdb_slot}*")"
+				[[ -n "${NEWVER}" ]] && break
+			done
+		fi
+		local fail=0
+		if [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			:
+			# Nothing wrong here.
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was not built against"
+			eerror "	any version of sys-libs/db, but the new one will build"
+			eerror "	against	${NEWVER} and your database may be inaccessible."
+			echo
+			fail=1
+		elif [[ -n "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
+			eerror "	built against any version and your database may be"
+			eerror "	inaccessible."
+			echo
+			fail=1
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
+			eerror "	${NEWVER} and your database would be inaccessible."
+			echo
+			fail=1
+		fi
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
+	fi
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	local d l i
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror
+	eerror "Additionally, rebuilding against different major versions of the"
+	eerror "sys-libs/db libraries will cause your database to be inaccessible."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. egrep -v '^(entry|context)CSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. check that your data is intact."
+	eerror "11. set up the new replication system."
+	eerror
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
+		die "You need to upgrade your database first"
+	else
+		eerror "You have the magical FORCE_UPGRADE=1 in place."
+		eerror "Don't say you weren't warned about data loss."
+	fi
+}
+
+pkg_setup() {
+	if ! use sasl && use cxx ; then
+		die "To build the ldapc++ library you must emerge openldap with sasl support"
+	fi
+	# Bug #322787
+	if use minimal && ! has_version "net-nds/openldap" ; then
+		einfo "No datadir scan needed, openldap not installed"
+	elif use minimal && has_version 'net-nds/openldap[minimal]' ; then
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+	else
+		openldap_find_versiontags
+	fi
+}
+
+src_prepare() {
+	# ensure correct SLAPI path by default
+	sed -e 's,\(#define LDAPI_SOCK\).*,\1 "'"${EPREFIX}"'/var/run/openldap/slapd.sock",' \
+		-i include/ldap_defaults.h || die
+
+	default
+	rm -r libraries/liblmdb || die
+
+	pushd build &>/dev/null || die "pushd build"
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to block stripping"
+	popd &>/dev/null || die
+
+	# wrong assumption that /bin/sh is /bin/bash
+	sed \
+		-e 's|/bin/sh|/bin/bash|g' \
+		-i tests/scripts/* || die "sed failed"
+
+	# Required for autoconf-2.70 #765043
+	sed 's@^AM_INIT_AUTOMAKE.*@AC_PROG_MAKE_SET@' -i configure.in || die
+	AT_NOEAUTOMAKE=yes eautoreconf
+}
+
+build_contrib_module() {
+	# <dir> <sources> <outputname>
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
+	einfo "Compiling contrib-module: $3"
+	# Make sure it's uppercase
+	local define_name="$(LC_ALL=C tr '[:lower:]' '[:upper:]' <<< "SLAPD_OVER_${1}")"
+	"${lt}" --mode=compile --tag=CC \
+		"${CC}" \
+		-D${define_name}=SLAPD_MOD_DYNAMIC \
+		-I"${BUILD_DIR}"/include \
+		-I../../../include -I../../../servers/slapd ${CFLAGS} \
+		-o ${2%.c}.lo -c $2 || die "compiling $3 failed"
+	einfo "Linking contrib-module: $3"
+	"${lt}" --mode=link --tag=CC \
+		"${CC}" -module \
+		${CFLAGS} \
+		${LDFLAGS} \
+		-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+		-o $3.la ${2%.c}.lo || die "linking $3 failed"
+	popd &>/dev/null || die
+}
+
+src_configure() {
+	# connectionless ldap per bug #342439
+	append-cppflags -DLDAP_CONNECTIONLESS
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myconf=()
+
+	use debug && myconf+=( $(use_enable debug) )
+
+	# ICU exists only in the configure, nowhere in the codebase, bug #510858
+	export ac_cv_header_unicode_utypes_h=no ol_cv_lib_icu=no
+
+	if ! use minimal && multilib_is_native_abi; then
+		local CPPFLAGS=${CPPFLAGS}
+
+		# re-enable serverside overlay chains per bug #296567
+		# see ldap docs chaper 12.3.1 for details
+		myconf+=( --enable-ldap )
+
+		# backends
+		myconf+=( --enable-slapd )
+		if use berkdb ; then
+			einfo "Using Berkeley DB for local backend"
+			myconf+=( --enable-bdb --enable-hdb )
+			DBINCLUDE=$(db_includedir ${BDB_SLOTS})
+			einfo "Using ${DBINCLUDE} for sys-libs/db version"
+			# We need to include the slotted db.h dir for FreeBSD
+			append-cppflags -I${DBINCLUDE}
+		else
+			myconf+=( --disable-bdb --disable-hdb )
+		fi
+		for backend in dnssrv ldap mdb meta monitor null passwd relay shell sock; do
+			myconf+=( --enable-${backend}=mod )
+		done
+
+		myconf+=( $(use_enable perl perl mod) )
+
+		myconf+=( $(use_enable odbc sql mod) )
+		if use odbc ; then
+			local odbc_lib="unixodbc"
+			if use iodbc ; then
+				odbc_lib="iodbc"
+				append-cppflags -I"${EPREFIX}"/usr/include/iodbc
+			fi
+			myconf+=( --with-odbc=${odbc_lib} )
+		fi
+
+		# slapd options
+		myconf+=(
+			$(use_enable crypt)
+			--disable-slp
+			$(use_enable samba lmpasswd)
+			$(use_enable syslog)
+		)
+		if use experimental ; then
+			myconf+=(
+				--enable-dynacl
+				--enable-aci=mod
+			)
+		fi
+		for option in aci cleartext modules rewrite rlookups slapi; do
+			myconf+=( --enable-${option} )
+		done
+
+		# slapd overlay options
+		# Compile-in the syncprov, the others as module
+		myconf+=( --enable-syncprov=yes )
+		use overlays && myconf+=( --enable-overlays=mod )
+
+	else
+		myconf+=(
+			--disable-backends
+			--disable-slapd
+			--disable-bdb
+			--disable-hdb
+			--disable-mdb
+			--disable-overlays
+			--disable-syslog
+		)
+	fi
+
+	# basic functionality stuff
+	myconf+=(
+		$(use_enable ipv6)
+		$(multilib_native_use_with sasl cyrus-sasl)
+		$(multilib_native_use_enable sasl spasswd)
+		$(use_enable tcpd wrappers)
+	)
+
+	# Some cross-compiling tests don't pan out well.
+	tc-is-cross-compiler && myconf+=(
+		--with-yielding-select=yes
+	)
+
+	local ssl_lib="no"
+	if use ssl || ( ! use minimal && use samba ) ; then
+		ssl_lib="openssl"
+		use gnutls && ssl_lib="gnutls"
+	fi
+
+	myconf+=( --with-tls=${ssl_lib} )
+
+	for basicflag in dynamic local proctitle shared; do
+		myconf+=( --enable-${basicflag} )
+	done
+
+	tc-export AR CC CXX
+	CONFIG_SHELL="/bin/sh" \
+	ECONF_SOURCE="${S}" \
+	STRIP=/bin/true \
+	econf \
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
+		$(use_enable static-libs static) \
+		"${myconf[@]}"
+	emake depend
+}
+
+src_configure_cxx() {
+	# This needs the libraries built by the first build run.
+	# So we have to run it AFTER the main build, not just after the main
+	# configure.
+	local myconf_ldapcpp=(
+		--with-ldap-includes="${S}"/include
+	)
+
+	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+
+	local LDFLAGS=${LDFLAGS} CPPFLAGS=${CPPFLAGS}
+	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs \
+		-L"${BUILD_DIR}"/libraries/libldap/.libs
+	append-cppflags -I"${BUILD_DIR}"/include
+	ECONF_SOURCE=${S}/contrib/ldapc++ \
+	econf "${myconf_ldapcpp[@]}" \
+		CC="${CC}" \
+		CXX="${CXX}"
+	popd &>/dev/null || die
+}
+
+multilib_src_compile() {
+	tc-export AR CC CXX
+	emake CC="${CC}" AR="${AR}" SHELL="${EPREFIX}"/bin/sh
+	local lt="${BUILD_DIR}/libtool"
+	export echo="echo"
+
+	if ! use minimal && multilib_is_native_abi ; then
+		if use cxx ; then
+			einfo "Building contrib library: ldapc++"
+			src_configure_cxx
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake CC="${CC}" CXX="${CXX}"
+			popd &>/dev/null || die
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
+
+			MY_DEFS="-DDO_SHADOW"
+			if use samba ; then
+				MY_DEFS="${MY_DEFS} -DDO_SAMBA"
+				MY_KRB5_INC=""
+			fi
+			if use kerberos ; then
+				MY_DEFS="${MY_DEFS} -DDO_KRB5"
+				MY_KRB5_INC="$(krb5-config --cflags)"
+			fi
+
+			emake \
+				DEFS="${MY_DEFS}" \
+				KRB5_INC="${MY_KRB5_INC}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use overlays ; then
+			einfo "Building contrib-module: samba4"
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
+
+			emake \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="${CC}" libexecdir="/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use kerberos ; then
+			if use kinit ; then
+				build_contrib_module "kinit" "kinit.c" "kinit"
+			fi
+			pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
+			einfo "Compiling contrib-module: pw-kerberos"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../include \
+				${CFLAGS} \
+				$(krb5-config --cflags) \
+				-DHAVE_KRB5 \
+				-o kerberos.lo \
+				-c kerberos.c || die "compiling pw-kerberos failed"
+			einfo "Linking contrib-module: pw-kerberos"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-kerberos.la \
+				kerberos.lo || die "linking pw-kerberos failed"
+			popd &>/dev/null || die
+		fi
+
+		if use pbkdf2; then
+			pushd "${S}/contrib/slapd-modules/passwd/pbkdf2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/pbkdf2"
+			einfo "Compiling contrib-module: pw-pbkdf2"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o pbkdf2.lo \
+				-c pw-pbkdf2.c || die "compiling pw-pbkdf2 failed"
+			einfo "Linking contrib-module: pw-pbkdf2"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-pbkdf2.la \
+				pbkdf2.lo || die "linking pw-pbkdf2 failed"
+			popd &>/dev/null || die
+		fi
+
+		if use sha2 ; then
+			pushd "${S}/contrib/slapd-modules/passwd/sha2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/sha2"
+			einfo "Compiling contrib-module: pw-sha2"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o sha2.lo \
+				-c sha2.c || die "compiling pw-sha2 failed"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o slapd-sha2.lo \
+				-c slapd-sha2.c || die "compiling pw-sha2 failed"
+			einfo "Linking contrib-module: pw-sha2"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-sha2.la \
+				sha2.lo slapd-sha2.lo || die "linking pw-sha2 failed"
+			popd &>/dev/null || die
+		fi
+
+		# We could build pw-radius if GNURadius would install radlib.h
+		pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
+		einfo "Compiling contrib-module: pw-netscape"
+		"${lt}" --mode=compile --tag=CC \
+			"${CC}" \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CFLAGS} \
+			-o netscape.lo \
+			-c netscape.c || die "compiling pw-netscape failed"
+		einfo "Linking contrib-module: pw-netscape"
+		"${lt}" --mode=link --tag=CC \
+			"${CC}" -module \
+			${CFLAGS} \
+			${LDFLAGS} \
+			-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+			-o pw-netscape.la \
+			netscape.lo || die "linking pw-netscape failed"
+
+		#build_contrib_module "acl" "posixgroup.c" "posixGroup" # example code only
+		#build_contrib_module "acl" "gssacl.c" "gss" # example code only, also needs kerberos
+		build_contrib_module "addpartial" "addpartial-overlay.c" "addpartial-overlay"
+		build_contrib_module "allop" "allop.c" "overlay-allop"
+		build_contrib_module "allowed" "allowed.c" "allowed"
+		build_contrib_module "autogroup" "autogroup.c" "autogroup"
+		build_contrib_module "cloak" "cloak.c" "cloak"
+		# build_contrib_module "comp_match" "comp_match.c" "comp_match" # really complex, adds new external deps, questionable demand
+		build_contrib_module "denyop" "denyop.c" "denyop-overlay"
+		build_contrib_module "dsaschema" "dsaschema.c" "dsaschema-plugin"
+		build_contrib_module "dupent" "dupent.c" "dupent"
+		build_contrib_module "lastbind" "lastbind.c" "lastbind"
+		# lastmod may not play well with other overlays
+		build_contrib_module "lastmod" "lastmod.c" "lastmod"
+		build_contrib_module "noopsrch" "noopsrch.c" "noopsrch"
+		#build_contrib_module "nops" "nops.c" "nops-overlay" https://bugs.gentoo.org/641576
+		#build_contrib_module "nssov" "nssov.c" "nssov-overlay" RESO:LATER
+		build_contrib_module "trace" "trace.c" "trace"
+		popd &>/dev/null || die
+		# build slapi-plugins
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
+		einfo "Building contrib-module: addrdnvalues plugin"
+		"${CC}" -shared \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CFLAGS} \
+			-fPIC \
+			${LDFLAGS} \
+			-o libaddrdnvalues-plugin.so \
+			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
+		popd &>/dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		cd tests || die
+		emake tests
+	fi
+}
+
+multilib_src_install() {
+	local lt="${BUILD_DIR}/libtool"
+	emake DESTDIR="${D}" SHELL="${EPREFIX}"/bin/sh install
+
+	if ! use minimal && multilib_is_native_abi; then
+		# openldap modules go here
+		# TODO: write some code to populate slapd.conf with moduleload statements
+		keepdir /usr/$(get_libdir)/openldap/openldap/
+
+		# initial data storage dir
+		keepdir /var/lib/openldap-data
+		use prefix || fowners ldap:ldap /var/lib/openldap-data
+		fperms 0700 /var/lib/openldap-data
+
+		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+		# use our config
+		rm "${ED}"/etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf
+		configfile="${ED}"/etc/openldap/slapd.conf
+
+		# populate with built backends
+		ebegin "populate config with built backends"
+		for x in "${ED}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			einfo "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
+		use prefix || fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default || die
+		eend
+
+		# install our own init scripts and systemd unit files
+		einfo "Install init scripts"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-initd-2.4.40-r2 > "${T}"/slapd || die
+		doinitd "${T}"/slapd
+		newconfd "${FILESDIR}"/slapd-confd-2.4.28-r1 slapd
+
+		einfo "Install systemd service"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd.service > "${T}"/slapd.service || die
+		systemd_dounit "${T}"/slapd.service
+		systemd_install_serviced "${FILESDIR}"/slapd.service.conf
+		newtmpfiles "${FILESDIR}"/slapd.tmpfilesd slapd.conf
+
+		# If built without SLP, we don't need to be before avahi
+			sed -i \
+				-e '/before/{s/avahi-daemon//g}' \
+				"${ED}"/etc/init.d/slapd \
+				|| die
+
+		if use cxx ; then
+			einfo "Install the ldapc++ library"
+			cd "${BUILD_DIR}/contrib/ldapc++" || die
+			emake DESTDIR="${D}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			cd "${S}"/contrib/ldapc++ || die
+			newdoc README ldapc++-README
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README smbk5pwd-README
+		fi
+
+		if use overlays ; then
+			einfo "Install the samba4 module"
+			cd "${S}/contrib/slapd-modules/samba4" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="/usr/$(get_libdir)/openldap" install
+			newdoc README samba4-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules" || die
+		for l in */*.la */*/*.la; do
+			[[ -e ${l} ]] || continue
+			"${lt}" --mode=install cp ${l} \
+				"${ED}"/usr/$(get_libdir)/openldap/openldap || \
+				die "installing ${l} failed"
+		done
+
+		dodoc "${FILESDIR}"/DB_CONFIG.fast.example
+		docinto contrib
+		doman */*.5
+		#newdoc acl/README*
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		newdoc allowed/README allowed-README
+		newdoc autogroup/README autogroup-README
+		newdoc dsaschema/README dsaschema-README
+		newdoc passwd/README passwd-README
+		cd "${S}/contrib/slapi-plugins" || die
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins */*.so
+		docinto contrib
+		newdoc addrdnvalues/README addrdnvalues-README
+
+		insinto /etc/openldap/schema
+		newins "${DISTDIR}"/${BIS_P} ${BIS_PN}
+
+		docinto back-sock ; dodoc "${S}"/servers/slapd/back-sock/searchexample*
+		docinto back-shell ; dodoc "${S}"/servers/slapd/back-shell/searchexample*
+		docinto back-perl ; dodoc "${S}"/servers/slapd/back-perl/SampleLDAP.pm
+
+		dosbin "${S}"/contrib/slapd-tools/statslog
+		newdoc "${S}"/contrib/slapd-tools/README README.statslog
+	fi
+
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README
+	docinto rfc ; dodoc doc/rfc/*.txt
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib /usr/$(get_libdir)/{liblber,libldap_r,liblber}-2.3$(get_libname 0)
+	# bug 440470, only display the getting started help there was no openldap before,
+	# or we are going to a non-minimal build
+	! has_version net-nds/openldap || has_version 'net-nds/openldap[minimal]'
+	OPENLDAP_PRINT_MESSAGES=$((! $?))
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		tmpfiles_process slapd.conf
+
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			use prefix || chown ldap:ldap "${EROOT}"/etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT allow' if you want to use them."
+		fi
+
+		if use prefix; then
+			# Warn about prefix issues with slapd
+			eerror "slapd might NOT be usable on Prefix systems as it requires root privileges"
+			eerror "to start up, and requires that certain files directories be owned by"
+			eerror "ldap:ldap.  As Prefix does not support changing ownership of files and"
+			eerror "directories, you will have to manually fix this yourself."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		if [[ -d "${EROOT}"/var/run/openldap ]]; then
+			use prefix || { chown ldap:ldap "${EROOT}"/var/run/openldap || die; }
+			chmod 0755 "${EROOT}"/var/run/openldap || die
+		fi
+		use prefix || chown root:ldap "${EROOT}"/etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${EROOT}"/etc/openldap/slapd.conf{,.default} || die
+		use prefix || chown ldap:ldap "${EROOT}"/var/lib/openldap-data
+	fi
+
+	if has_version 'net-nds/openldap[-minimal]' && ((${OPENLDAP_PRINT_MESSAGES})); then
+		elog "Getting started using OpenLDAP? There is some documentation available:"
+		elog "Gentoo Guide to OpenLDAP Authentication"
+		elog "(https://wiki.gentoo.org/wiki/Centralized_authentication_using_OpenLDAP)"
+		elog "---"
+		elog "An example file for tuning BDB backends with openldap is"
+		elog "DB_CONFIG.fast.example in /usr/share/doc/${PF}/"
+	fi
+
+	preserve_old_lib_notify /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.3$(get_libname 0)
+}

sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.59-r2.ebuild

@@ -1,9 +1,9 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
 
-inherit autotools db-use flag-o-matic multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+inherit autotools db-use flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
 
 BIS_PN=rfc2307bis.schema
 BIS_PV=20140524
@@ -27,9 +27,9 @@ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~
 IUSE_DAEMON="crypt samba tcpd experimental minimal"
 IUSE_BACKEND="+berkdb"
 IUSE_OVERLAY="overlays perl"
-IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 libressl +syslog selinux static-libs test"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 +syslog selinux static-libs test"
 IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
-IUSE_CONTRIB="${IUSE_CONTRIB} -cxx"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
 
 RESTRICT="!test? ( test )"
@@ -42,7 +42,7 @@ REQUIRED_USE="cxx? ( sasl )
 # Do not add any AGPL-3 BDB here!
 # See bug 525110, comment 15.
 # Advanced usage: OPENLDAP_BDB_SLOTS in the environment can be used to force a slot during build.
-BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 5.1 4.8 4.7 4.6 4.5 4.4}"
+BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 4.8}"
 BDB_PKGS=''
 for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
 
@@ -50,8 +50,7 @@ for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
 COMMON_DEPEND="
 	ssl? (
 		!gnutls? (
-			!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-			libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
 		)
 		gnutls? (
 			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
@@ -61,23 +60,22 @@ COMMON_DEPEND="
 	sasl? ( dev-libs/cyrus-sasl:= )
 	!minimal? (
 		dev-libs/libltdl
-		sys-libs/e2fsprogs-libs
+		sys-fs/e2fsprogs
 		>=dev-db/lmdb-0.9.18:=
+		crypt? ( virtual/libcrypt:= )
 		tcpd? ( sys-apps/tcp-wrappers )
 		odbc? ( !iodbc? ( dev-db/unixODBC )
 			iodbc? ( dev-db/libiodbc ) )
 		perl? ( dev-lang/perl:=[-build(-)] )
 		samba? (
-			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl:0= )
+			dev-libs/openssl:0=
 		)
 		berkdb? (
 			<sys-libs/db-6.0:=
 			|| ( ${BDB_PKGS} )
 			)
 		smbkrb5passwd? (
-			!libressl? ( dev-libs/openssl:0= )
-			libressl? ( dev-libs/libressl:0= )
+			dev-libs/openssl:0=
 			kerberos? ( app-crypt/heimdal )
 			)
 		kerberos? (
@@ -96,14 +94,13 @@ RDEPEND="${COMMON_DEPEND}
 
 # The user/group are only used for running daemons which are
 # disabled in minimal builds, so elide the accounts too.
-# for tracking versions
-
 BDEPEND="!minimal? (
 		acct-group/ldap
 		acct-user/ldap
 )
 "
 
+# for tracking versions
 OPENLDAP_VERSIONTAG=".version-tag"
 OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
 
@@ -177,9 +174,6 @@ PATCHES=(
 	# unbundle lmdb
 	"${FILESDIR}"/${PN}-2.4.42-mdb-unbundle.patch
 
-	# bug #622464
-	"${FILESDIR}"/${PN}-2.4.47-libressl.patch
-
 	# fix some compiler warnings
 	"${FILESDIR}"/${PN}-2.4.47-warnings.patch
 )
@@ -867,6 +861,8 @@ pkg_preinst() {
 
 pkg_postinst() {
 	if ! use minimal ; then
+		tmpfiles_process slapd.conf
+
 		# You cannot build SSL certificates during src_install that will make
 		# binary packages containing your SSL key, which is both a security risk
 		# and a misconfiguration if multiple machines use the same key and cert.

sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.4-r1.ebuild

@@ -0,0 +1,837 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+
+BIS_PN=rfc2307bis.schema
+BIS_PV=20140524
+BIS_P="${BIS_PN}-${BIS_PV}"
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="https://www.OpenLDAP.org/"
+
+# upstream mirrors are mostly not working, using canonical URI
+SRC_URI="
+	https://openldap.org/software/download/OpenLDAP/openldap-release/${P}.tgz
+	http://gpl.savoirfairelinux.net/pub/mirrors/openldap/openldap-release/${P}.tgz
+	http://repository.linagora.org/OpenLDAP/openldap-release/${P}.tgz
+	http://mirror.eu.oneandone.net/software/openldap/openldap-release/${P}.tgz
+	mirror://gentoo/${BIS_P}"
+
+LICENSE="OPENLDAP GPL-2"
+SLOT="0"
+KEYWORDS=""
+
+IUSE_DAEMON="crypt samba tcpd experimental minimal"
+IUSE_OVERLAY="overlays perl"
+IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 +syslog selinux static-libs test"
+IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
+IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+
+RESTRICT="!test? ( test )"
+REQUIRED_USE="cxx? ( sasl )
+	pbkdf2? ( ssl )
+	?? ( test minimal )"
+
+# always list newer first
+# Do not add any AGPL-3 BDB here!
+# See bug 525110, comment 15.
+# Advanced usage: OPENLDAP_BDB_SLOTS in the environment can be used to force a slot during build.
+BDB_SLOTS="${OPENLDAP_BDB_SLOTS:=5.3 4.8}"
+BDB_PKGS=''
+for _slot in $BDB_SLOTS; do BDB_PKGS="${BDB_PKGS} sys-libs/db:${_slot}" ; done
+
+# openssl is needed to generate lanman-passwords required by samba
+COMMON_DEPEND="
+	ssl? (
+		!gnutls? (
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+		)
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}]
+		)
+	)
+	sasl? ( dev-libs/cyrus-sasl:= )
+	!minimal? (
+		dev-libs/libltdl
+		sys-fs/e2fsprogs
+		>=dev-db/lmdb-0.9.18:=
+		crypt? ( virtual/libcrypt:= )
+		tcpd? ( sys-apps/tcp-wrappers )
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		perl? ( dev-lang/perl:=[-build(-)] )
+		samba? (
+			dev-libs/openssl:0=
+		)
+		smbkrb5passwd? (
+			dev-libs/openssl:0=
+			kerberos? ( app-crypt/heimdal )
+			)
+		kerberos? (
+			virtual/krb5
+			kinit? ( !app-crypt/heimdal )
+			)
+		cxx? ( dev-libs/cyrus-sasl:= )
+	)
+"
+DEPEND="${COMMON_DEPEND}
+	sys-apps/groff
+"
+RDEPEND="${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-ldap )
+"
+
+# The user/group are only used for running daemons which are
+# disabled in minimal builds, so elide the accounts too.
+BDEPEND="!minimal? (
+		acct-group/ldap
+		acct-user/ldap
+)
+"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# USE=cxx
+	/usr/include/LDAPAsynConnection.h
+	/usr/include/LDAPAttrType.h
+	/usr/include/LDAPAttribute.h
+	/usr/include/LDAPAttributeList.h
+	/usr/include/LDAPConnection.h
+	/usr/include/LDAPConstraints.h
+	/usr/include/LDAPControl.h
+	/usr/include/LDAPControlSet.h
+	/usr/include/LDAPEntry.h
+	/usr/include/LDAPEntryList.h
+	/usr/include/LDAPException.h
+	/usr/include/LDAPExtResult.h
+	/usr/include/LDAPMessage.h
+	/usr/include/LDAPMessageQueue.h
+	/usr/include/LDAPModList.h
+	/usr/include/LDAPModification.h
+	/usr/include/LDAPObjClass.h
+	/usr/include/LDAPRebind.h
+	/usr/include/LDAPRebindAuth.h
+	/usr/include/LDAPReferenceList.h
+	/usr/include/LDAPResult.h
+	/usr/include/LDAPSaslBindResult.h
+	/usr/include/LDAPSchema.h
+	/usr/include/LDAPSearchReference.h
+	/usr/include/LDAPSearchResult.h
+	/usr/include/LDAPSearchResults.h
+	/usr/include/LDAPUrl.h
+	/usr/include/LDAPUrlList.h
+	/usr/include/LdifReader.h
+	/usr/include/LdifWriter.h
+	/usr/include/SaslInteraction.h
+	/usr/include/SaslInteractionHandler.h
+	/usr/include/StringList.h
+	/usr/include/TlsOptions.h
+)
+
+openldap_filecount() {
+	local dir="$1"
+	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
+}
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
+	fi
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	have_files=0
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${ROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
+			einfo "- Checking ${each}..."
+			if [[ -r "${CURRENT_TAG}" ]] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
+
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
+
+				# are we on the same branch?
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ "${have_files}" == "1" ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
+				if [[ "${have_files}" == "1" ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					openldap_upgrade_howto
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
+
+	# Now we must check for the major version of sys-libs/db linked against.
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
+		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
+			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
+		local fail=0
+		if [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			:
+			# Nothing wrong here.
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was not built against"
+			eerror "	any version of sys-libs/db, but the new one will build"
+			eerror "	against	${NEWVER} and your database may be inaccessible."
+			echo
+			fail=1
+		elif [[ -n "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
+			eerror "	built against any version and your database may be"
+			eerror "	inaccessible."
+			echo
+			fail=1
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
+			eerror "	${NEWVER} and your database would be inaccessible."
+			echo
+			fail=1
+		fi
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
+	fi
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	local d l i
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror
+	eerror "Additionally, rebuilding against different major versions of the"
+	eerror "sys-libs/db libraries will cause your database to be inaccessible."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. egrep -v '^(entry|context)CSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. check that your data is intact."
+	eerror "11. set up the new replication system."
+	eerror
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
+		die "You need to upgrade your database first"
+	else
+		eerror "You have the magical FORCE_UPGRADE=1 in place."
+		eerror "Don't say you weren't warned about data loss."
+	fi
+}
+
+pkg_setup() {
+	if ! use sasl && use cxx ; then
+		die "To build the ldapc++ library you must emerge openldap with sasl support"
+	fi
+	# Bug #322787
+	if use minimal && ! has_version "net-nds/openldap" ; then
+		einfo "No datadir scan needed, openldap not installed"
+	elif use minimal && has_version 'net-nds/openldap[minimal]' ; then
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+	else
+		openldap_find_versiontags
+	fi
+}
+
+src_prepare() {
+	# ensure correct SLAPI path by default
+	sed -e 's,\(#define LDAPI_SOCK\).*,\1 "'"${EPREFIX}"'/var/run/openldap/slapd.sock",' \
+		-i include/ldap_defaults.h || die
+
+	default
+	rm -r libraries/liblmdb || die
+
+	pushd build &>/dev/null || die "pushd build"
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to block stripping"
+	popd &>/dev/null || die
+
+	AT_NOEAUTOMAKE=yes eautoreconf
+}
+
+build_contrib_module() {
+	# <dir> <sources> <outputname>
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
+	einfo "Compiling contrib-module: $3"
+	# Make sure it's uppercase
+	local define_name="$(LC_ALL=C tr '[:lower:]' '[:upper:]' <<< "SLAPD_OVER_${1}")"
+	"${lt}" --mode=compile --tag=CC \
+		"${CC}" \
+		-D${define_name}=SLAPD_MOD_DYNAMIC \
+		-I"${BUILD_DIR}"/include \
+		-I../../../include -I../../../servers/slapd ${CFLAGS} \
+		-o ${2%.c}.lo -c $2 || die "compiling $3 failed"
+	einfo "Linking contrib-module: $3"
+	"${lt}" --mode=link --tag=CC \
+		"${CC}" -module \
+		${CFLAGS} \
+		${LDFLAGS} \
+		-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+		-o $3.la ${2%.c}.lo || die "linking $3 failed"
+	popd &>/dev/null || die
+}
+
+src_configure() {
+	# connectionless ldap per bug #342439
+	append-cppflags -DLDAP_CONNECTIONLESS
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myconf=()
+
+	use debug && myconf+=( $(use_enable debug) )
+
+	# ICU exists only in the configure, nowhere in the codebase, bug #510858
+	export ac_cv_header_unicode_utypes_h=no ol_cv_lib_icu=no
+
+	if ! use minimal && multilib_is_native_abi; then
+		local CPPFLAGS=${CPPFLAGS}
+
+		# re-enable serverside overlay chains per bug #296567
+		# see ldap docs chaper 12.3.1 for details
+		myconf+=( --enable-ldap )
+
+		# backends
+		myconf+=( --enable-slapd )
+		for backend in dnssrv ldap mdb meta monitor null passwd relay shell sock; do
+			myconf+=( --enable-${backend}=mod )
+		done
+
+		myconf+=( $(use_enable perl perl mod) )
+
+		myconf+=( $(use_enable odbc sql mod) )
+		if use odbc ; then
+			local odbc_lib="unixodbc"
+			if use iodbc ; then
+				odbc_lib="iodbc"
+				append-cppflags -I"${EPREFIX}"/usr/include/iodbc
+			fi
+			myconf+=( --with-odbc=${odbc_lib} )
+		fi
+
+		# slapd options
+		myconf+=(
+			$(use_enable crypt)
+			--disable-slp
+			$(use_enable samba lmpasswd)
+			$(use_enable syslog)
+		)
+		if use experimental ; then
+			myconf+=(
+				--enable-dynacl
+				--enable-aci=mod
+			)
+		fi
+		for option in aci cleartext modules rewrite rlookups slapi; do
+			myconf+=( --enable-${option} )
+		done
+
+		# slapd overlay options
+		# Compile-in the syncprov, the others as module
+		myconf+=( --enable-syncprov=yes )
+		use overlays && myconf+=( --enable-overlays=mod )
+
+	else
+		myconf+=(
+			--disable-backends
+			--disable-slapd
+			--disable-mdb
+			--disable-overlays
+			--disable-syslog
+		)
+	fi
+
+	# basic functionality stuff
+	myconf+=(
+		$(use_enable ipv6)
+		$(multilib_native_use_with sasl cyrus-sasl)
+		$(multilib_native_use_enable sasl spasswd)
+		$(use_enable tcpd wrappers)
+	)
+
+	# Some cross-compiling tests don't pan out well.
+	tc-is-cross-compiler && myconf+=(
+		--with-yielding-select=yes
+	)
+
+	local ssl_lib="no"
+	if use ssl || ( ! use minimal && use samba ) ; then
+		ssl_lib="openssl"
+		use gnutls && ssl_lib="gnutls"
+	fi
+
+	myconf+=( --with-tls=${ssl_lib} )
+
+	for basicflag in dynamic local shared; do
+		myconf+=( --enable-${basicflag} )
+	done
+
+	tc-export AR CC CXX
+	CONFIG_SHELL="/bin/sh" \
+	ECONF_SOURCE="${S}" \
+	STRIP=/bin/true \
+	econf \
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
+		$(use_enable static-libs static) \
+		"${myconf[@]}"
+	emake depend
+}
+
+src_configure_cxx() {
+	# This needs the libraries built by the first build run.
+	# So we have to run it AFTER the main build, not just after the main
+	# configure.
+	local myconf_ldapcpp=(
+		--with-ldap-includes="${S}"/include
+	)
+
+	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+
+	local LDFLAGS=${LDFLAGS} CPPFLAGS=${CPPFLAGS}
+	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs \
+		-L"${BUILD_DIR}"/libraries/libldap/.libs
+	append-cppflags -I"${BUILD_DIR}"/include
+	ECONF_SOURCE=${S}/contrib/ldapc++ \
+	econf "${myconf_ldapcpp[@]}" \
+		CC="${CC}" \
+		CXX="${CXX}"
+	popd &>/dev/null || die
+}
+
+multilib_src_compile() {
+	tc-export AR CC CXX
+	emake CC="${CC}" AR="${AR}" SHELL="${EPREFIX}"/bin/sh
+	local lt="${BUILD_DIR}/libtool"
+	export echo="echo"
+
+	if ! use minimal && multilib_is_native_abi ; then
+		if use cxx ; then
+			einfo "Building contrib library: ldapc++"
+			src_configure_cxx
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake CC="${CC}" CXX="${CXX}"
+			popd &>/dev/null || die
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
+
+			MY_DEFS="-DDO_SHADOW"
+			if use samba ; then
+				MY_DEFS="${MY_DEFS} -DDO_SAMBA"
+				MY_KRB5_INC=""
+			fi
+			if use kerberos ; then
+				MY_DEFS="${MY_DEFS} -DDO_KRB5"
+				MY_KRB5_INC="$(krb5-config --cflags)"
+			fi
+
+			emake \
+				DEFS="${MY_DEFS}" \
+				KRB5_INC="${MY_KRB5_INC}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use overlays ; then
+			einfo "Building contrib-module: samba4"
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
+
+			emake \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="${CC}" libexecdir="/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use kerberos ; then
+			if use kinit ; then
+				build_contrib_module "kinit" "kinit.c" "kinit"
+			fi
+			pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
+			einfo "Compiling contrib-module: pw-kerberos"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../include \
+				${CFLAGS} \
+				$(krb5-config --cflags) \
+				-DHAVE_KRB5 \
+				-o kerberos.lo \
+				-c kerberos.c || die "compiling pw-kerberos failed"
+			einfo "Linking contrib-module: pw-kerberos"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-kerberos.la \
+				kerberos.lo || die "linking pw-kerberos failed"
+			popd &>/dev/null || die
+		fi
+
+		if use pbkdf2; then
+			pushd "${S}/contrib/slapd-modules/passwd/pbkdf2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/pbkdf2"
+			einfo "Compiling contrib-module: pw-pbkdf2"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o pbkdf2.lo \
+				-c pw-pbkdf2.c || die "compiling pw-pbkdf2 failed"
+			einfo "Linking contrib-module: pw-pbkdf2"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-pbkdf2.la \
+				pbkdf2.lo || die "linking pw-pbkdf2 failed"
+			popd &>/dev/null || die
+		fi
+
+		if use sha2 ; then
+			pushd "${S}/contrib/slapd-modules/passwd/sha2" &>/dev/null || die "pushd contrib/slapd-modules/passwd/sha2"
+			einfo "Compiling contrib-module: pw-sha2"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o sha2.lo \
+				-c sha2.c || die "compiling pw-sha2 failed"
+			"${lt}" --mode=compile --tag=CC \
+				"${CC}" \
+				-I"${BUILD_DIR}"/include \
+				-I../../../../include \
+				${CFLAGS} \
+				-o slapd-sha2.lo \
+				-c slapd-sha2.c || die "compiling pw-sha2 failed"
+			einfo "Linking contrib-module: pw-sha2"
+			"${lt}" --mode=link --tag=CC \
+				"${CC}" -module \
+				${CFLAGS} \
+				${LDFLAGS} \
+				-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+				-o pw-sha2.la \
+				sha2.lo slapd-sha2.lo || die "linking pw-sha2 failed"
+			popd &>/dev/null || die
+		fi
+
+		# We could build pw-radius if GNURadius would install radlib.h
+		pushd "${S}/contrib/slapd-modules/passwd" &>/dev/null || die "pushd contrib/slapd-modules/passwd"
+		einfo "Compiling contrib-module: pw-netscape"
+		"${lt}" --mode=compile --tag=CC \
+			"${CC}" \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CFLAGS} \
+			-o netscape.lo \
+			-c netscape.c || die "compiling pw-netscape failed"
+		einfo "Linking contrib-module: pw-netscape"
+		"${lt}" --mode=link --tag=CC \
+			"${CC}" -module \
+			${CFLAGS} \
+			${LDFLAGS} \
+			-rpath "${EPREFIX}"/usr/$(get_libdir)/openldap/openldap \
+			-o pw-netscape.la \
+			netscape.lo || die "linking pw-netscape failed"
+
+		#build_contrib_module "acl" "posixgroup.c" "posixGroup" # example code only
+		#build_contrib_module "acl" "gssacl.c" "gss" # example code only, also needs kerberos
+		build_contrib_module "addpartial" "addpartial-overlay.c" "addpartial-overlay"
+		build_contrib_module "allop" "allop.c" "overlay-allop"
+		build_contrib_module "allowed" "allowed.c" "allowed"
+		build_contrib_module "autogroup" "autogroup.c" "autogroup"
+		build_contrib_module "cloak" "cloak.c" "cloak"
+		# build_contrib_module "comp_match" "comp_match.c" "comp_match" # really complex, adds new external deps, questionable demand
+		build_contrib_module "denyop" "denyop.c" "denyop-overlay"
+		build_contrib_module "dsaschema" "dsaschema.c" "dsaschema-plugin"
+		build_contrib_module "dupent" "dupent.c" "dupent"
+		build_contrib_module "lastbind" "lastbind.c" "lastbind"
+		# lastmod may not play well with other overlays
+		build_contrib_module "lastmod" "lastmod.c" "lastmod"
+		build_contrib_module "noopsrch" "noopsrch.c" "noopsrch"
+		#build_contrib_module "nops" "nops.c" "nops-overlay" https://bugs.gentoo.org/641576
+		#build_contrib_module "nssov" "nssov.c" "nssov-overlay" RESO:LATER
+		build_contrib_module "trace" "trace.c" "trace"
+		popd &>/dev/null || die
+		# build slapi-plugins
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
+		einfo "Building contrib-module: addrdnvalues plugin"
+		"${CC}" -shared \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CFLAGS} \
+			-fPIC \
+			${LDFLAGS} \
+			-o libaddrdnvalues-plugin.so \
+			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
+		popd &>/dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		cd tests || die
+		emake tests
+	fi
+}
+
+multilib_src_install() {
+	local lt="${BUILD_DIR}/libtool"
+	emake DESTDIR="${D}" SHELL="${EPREFIX}"/bin/sh install
+
+	if ! use minimal && multilib_is_native_abi; then
+		# openldap modules go here
+		# TODO: write some code to populate slapd.conf with moduleload statements
+		keepdir /usr/$(get_libdir)/openldap/openldap/
+
+		# initial data storage dir
+		keepdir /var/lib/openldap-data
+		use prefix || fowners ldap:ldap /var/lib/openldap-data
+		fperms 0700 /var/lib/openldap-data
+
+		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+		# use our config
+		rm "${ED}"/etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf
+		configfile="${ED}"/etc/openldap/slapd.conf
+
+		# populate with built backends
+		ebegin "populate config with built backends"
+		for x in "${ED}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			einfo "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
+		use prefix || fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default || die
+		eend
+
+		# install our own init scripts and systemd unit files
+		einfo "Install init scripts"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-initd-2.4.40-r2 > "${T}"/slapd || die
+		doinitd "${T}"/slapd
+		newconfd "${FILESDIR}"/slapd-confd-2.4.28-r1 slapd
+
+		einfo "Install systemd service"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd.service > "${T}"/slapd.service || die
+		systemd_dounit "${T}"/slapd.service
+		systemd_install_serviced "${FILESDIR}"/slapd.service.conf
+		newtmpfiles "${FILESDIR}"/slapd.tmpfilesd slapd.conf
+
+		# If built without SLP, we don't need to be before avahi
+			sed -i \
+				-e '/before/{s/avahi-daemon//g}' \
+				"${ED}"/etc/init.d/slapd \
+				|| die
+
+		if use cxx ; then
+			einfo "Install the ldapc++ library"
+			cd "${BUILD_DIR}/contrib/ldapc++" || die
+			emake DESTDIR="${D}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			cd "${S}"/contrib/ldapc++ || die
+			newdoc README ldapc++-README
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README smbk5pwd-README
+		fi
+
+		if use overlays ; then
+			einfo "Install the samba4 module"
+			cd "${S}/contrib/slapd-modules/samba4" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="/usr/$(get_libdir)/openldap" install
+			newdoc README samba4-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules" || die
+		for l in */*.la */*/*.la; do
+			[[ -e ${l} ]] || continue
+			"${lt}" --mode=install cp ${l} \
+				"${ED}"/usr/$(get_libdir)/openldap/openldap || \
+				die "installing ${l} failed"
+		done
+
+		dodoc "${FILESDIR}"/DB_CONFIG.fast.example
+		docinto contrib
+		doman */*.5
+		#newdoc acl/README*
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		newdoc allowed/README allowed-README
+		newdoc autogroup/README autogroup-README
+		newdoc dsaschema/README dsaschema-README
+		newdoc passwd/README passwd-README
+		cd "${S}/contrib/slapi-plugins" || die
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins */*.so
+		docinto contrib
+		newdoc addrdnvalues/README addrdnvalues-README
+
+		insinto /etc/openldap/schema
+		newins "${DISTDIR}"/${BIS_P} ${BIS_PN}
+
+		docinto back-sock ; dodoc "${S}"/servers/slapd/back-sock/searchexample*
+		docinto back-shell ; dodoc "${S}"/servers/slapd/back-shell/searchexample*
+		docinto back-perl ; dodoc "${S}"/servers/slapd/back-perl/SampleLDAP.pm
+
+		dosbin "${S}"/contrib/slapd-tools/statslog
+		newdoc "${S}"/contrib/slapd-tools/README README.statslog
+	fi
+
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README
+	docinto rfc ; dodoc doc/rfc/*.txt
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib /usr/$(get_libdir)/{liblber,libldap_r,liblber}-2.3$(get_libname 0)
+	# bug 440470, only display the getting started help there was no openldap before,
+	# or we are going to a non-minimal build
+	! has_version net-nds/openldap || has_version 'net-nds/openldap[minimal]'
+	OPENLDAP_PRINT_MESSAGES=$((! $?))
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		tmpfiles_process slapd.conf
+
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			use prefix || chown ldap:ldap "${EROOT}"/etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT allow' if you want to use them."
+		fi
+
+		if use prefix; then
+			# Warn about prefix issues with slapd
+			eerror "slapd might NOT be usable on Prefix systems as it requires root privileges"
+			eerror "to start up, and requires that certain files directories be owned by"
+			eerror "ldap:ldap.  As Prefix does not support changing ownership of files and"
+			eerror "directories, you will have to manually fix this yourself."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		if [[ -d "${EROOT}"/var/run/openldap ]]; then
+			use prefix || { chown ldap:ldap "${EROOT}"/var/run/openldap || die; }
+			chmod 0755 "${EROOT}"/var/run/openldap || die
+		fi
+		use prefix || chown root:ldap "${EROOT}"/etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${EROOT}"/etc/openldap/slapd.conf{,.default} || die
+		use prefix || chown ldap:ldap "${EROOT}"/var/lib/openldap-data
+	fi
+
+	if has_version 'net-nds/openldap[-minimal]' && ((${OPENLDAP_PRINT_MESSAGES})); then
+		elog "Getting started using OpenLDAP? There is some documentation available:"
+		elog "Gentoo Guide to OpenLDAP Authentication"
+		elog "(https://wiki.gentoo.org/wiki/Centralized_authentication_using_OpenLDAP)"
+		elog "---"
+		elog "An example file for tuning BDB backends with openldap is"
+		elog "DB_CONFIG.fast.example in /usr/share/doc/${PF}/"
+	fi
+
+	preserve_old_lib_notify /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.3$(get_libname 0)
+}

sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.1-r1.ebuild

@@ -0,0 +1,799 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic multilib multilib-minimal preserve-libs ssl-cert toolchain-funcs systemd tmpfiles
+
+MY_PV="$(ver_rs 1-2 _)"
+
+BIS_PN=rfc2307bis.schema
+BIS_PV=20140524
+BIS_P="${BIS_PN}-${BIS_PV}"
+
+DESCRIPTION="LDAP suite of application and development tools"
+HOMEPAGE="https://www.OpenLDAP.org/"
+
+SRC_URI="
+	https://gitlab.com/openldap/${PN}/-/archive/OPENLDAP_REL_ENG_${MY_PV}/${PN}-OPENLDAP_REL_ENG_${MY_PV}.tar.gz
+	mirror://gentoo/${BIS_P}"
+
+LICENSE="OPENLDAP GPL-2"
+# Subslot added for bug #835654
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x86-solaris"
+
+IUSE_DAEMON="argon2 +cleartext crypt experimental minimal samba tcpd"
+IUSE_OVERLAY="overlays perl autoca"
+IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog test"
+IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
+IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
+IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
+RESTRICT="!test? ( test )"
+
+RESTRICT="!test? ( test )"
+REQUIRED_USE="cxx? ( sasl )
+	pbkdf2? ( ssl )
+	test? ( cleartext sasl )
+	autoca? ( !gnutls )
+	?? ( test minimal )"
+
+S=${WORKDIR}/${PN}-OPENLDAP_REL_ENG_${MY_PV}
+
+# openssl is needed to generate lanman-passwords required by samba
+COMMON_DEPEND="
+	kernel_linux? ( sys-apps/util-linux )
+	ssl? (
+		!gnutls? (
+			>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
+		)
+		gnutls? (
+			>=net-libs/gnutls-2.12.23-r6:=[${MULTILIB_USEDEP}]
+			>=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}]
+		)
+	)
+	sasl? ( dev-libs/cyrus-sasl:= )
+	!minimal? (
+		dev-libs/libltdl
+		sys-fs/e2fsprogs
+		>=dev-db/lmdb-0.9.18:=
+		argon2? ( app-crypt/argon2:= )
+		crypt? ( virtual/libcrypt:= )
+		tcpd? ( sys-apps/tcp-wrappers )
+		odbc? ( !iodbc? ( dev-db/unixODBC )
+			iodbc? ( dev-db/libiodbc ) )
+		perl? ( dev-lang/perl:=[-build(-)] )
+		samba? (
+			dev-libs/openssl:0=
+		)
+		smbkrb5passwd? (
+			dev-libs/openssl:0=
+			kerberos? ( app-crypt/heimdal )
+			)
+		kerberos? (
+			virtual/krb5
+			kinit? ( !app-crypt/heimdal )
+		)
+	)
+"
+DEPEND="${COMMON_DEPEND}
+	sys-apps/groff
+"
+RDEPEND="${COMMON_DEPEND}
+	selinux? ( sec-policy/selinux-ldap )
+"
+
+# The user/group are only used for running daemons which are
+# disabled in minimal builds, so elide the accounts too.
+BDEPEND="!minimal? (
+		acct-group/ldap
+		acct-user/ldap
+)
+"
+
+# for tracking versions
+OPENLDAP_VERSIONTAG=".version-tag"
+OPENLDAP_DEFAULTDIR_VERSIONTAG="/var/lib/openldap-data"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# USE=cxx
+	/usr/include/LDAPAsynConnection.h
+	/usr/include/LDAPAttrType.h
+	/usr/include/LDAPAttribute.h
+	/usr/include/LDAPAttributeList.h
+	/usr/include/LDAPConnection.h
+	/usr/include/LDAPConstraints.h
+	/usr/include/LDAPControl.h
+	/usr/include/LDAPControlSet.h
+	/usr/include/LDAPEntry.h
+	/usr/include/LDAPEntryList.h
+	/usr/include/LDAPException.h
+	/usr/include/LDAPExtResult.h
+	/usr/include/LDAPMessage.h
+	/usr/include/LDAPMessageQueue.h
+	/usr/include/LDAPModList.h
+	/usr/include/LDAPModification.h
+	/usr/include/LDAPObjClass.h
+	/usr/include/LDAPRebind.h
+	/usr/include/LDAPRebindAuth.h
+	/usr/include/LDAPReferenceList.h
+	/usr/include/LDAPResult.h
+	/usr/include/LDAPSaslBindResult.h
+	/usr/include/LDAPSchema.h
+	/usr/include/LDAPSearchReference.h
+	/usr/include/LDAPSearchResult.h
+	/usr/include/LDAPSearchResults.h
+	/usr/include/LDAPUrl.h
+	/usr/include/LDAPUrlList.h
+	/usr/include/LdifReader.h
+	/usr/include/LdifWriter.h
+	/usr/include/SaslInteraction.h
+	/usr/include/SaslInteractionHandler.h
+	/usr/include/StringList.h
+	/usr/include/TlsOptions.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.4.28-fix-dash.patch
+	"${FILESDIR}"/${PN}-2.6.1-system-mdb.patch
+	"${FILESDIR}"/${PN}-2.6.1-cloak.patch
+	"${FILESDIR}"/${PN}-2.6.1-flags.patch
+	"${FILESDIR}"/${PN}-2.6.1-fix-missing-mapping.patch
+	"${FILESDIR}"/${PN}-2.6.1-make-flags.patch
+	"${FILESDIR}"/${PN}-2.6.1-fix-bashism-configure.patch
+)
+
+openldap_filecount() {
+	local dir="$1"
+	find "${dir}" -type f ! -name '.*' ! -name 'DB_CONFIG*' | wc -l
+}
+
+openldap_find_versiontags() {
+	# scan for all datadirs
+	local openldap_datadirs=()
+	if [[ -f "${EROOT}"/etc/openldap/slapd.conf ]]; then
+		openldap_datadirs=( $(awk '{if($1 == "directory") print $2 }' "${EROOT}"/etc/openldap/slapd.conf) )
+	fi
+	openldap_datadirs+=( ${OPENLDAP_DEFAULTDIR_VERSIONTAG} )
+
+	einfo
+	einfo "Scanning datadir(s) from slapd.conf and"
+	einfo "the default installdir for Versiontags"
+	einfo "(${OPENLDAP_DEFAULTDIR_VERSIONTAG} may appear twice)"
+	einfo
+
+	# scan datadirs if we have a version tag
+	openldap_found_tag=0
+	have_files=0
+	for each in ${openldap_datadirs[@]} ; do
+		CURRENT_TAGDIR="${ROOT}$(sed "s:\/::" <<< ${each})"
+		CURRENT_TAG="${CURRENT_TAGDIR}/${OPENLDAP_VERSIONTAG}"
+		if [[ -d "${CURRENT_TAGDIR}" ]] && [[ "${openldap_found_tag}" == 0 ]] ; then
+			einfo "- Checking ${each}..."
+			if [[ -r "${CURRENT_TAG}" ]] ; then
+				# yey, we have one :)
+				einfo "   Found Versiontag in ${each}"
+				source "${CURRENT_TAG}"
+				if [[ "${OLDPF}" == "" ]] ; then
+					eerror "Invalid Versiontag found in ${CURRENT_TAGDIR}"
+					eerror "Please delete it"
+					eerror
+					die "Please kill the invalid versiontag in ${CURRENT_TAGDIR}"
+				fi
+
+				OLD_MAJOR=$(ver_cut 2-3 ${OLDPF})
+
+				[[ "$(openldap_filecount ${CURRENT_TAGDIR})" -gt 0 ]] && have_files=1
+
+				# are we on the same branch?
+				if [[ "${OLD_MAJOR}" != "${PV:0:3}" ]] ; then
+					ewarn "   Versiontag doesn't match current major release!"
+					if [[ "${have_files}" == "1" ]] ; then
+						eerror "   Versiontag says other major and you (probably) have datafiles!"
+						echo
+						openldap_upgrade_howto
+					else
+						einfo "   No real problem, seems there's no database."
+					fi
+				else
+					einfo "   Versiontag is fine here :)"
+				fi
+			else
+				einfo "   Non-tagged dir ${each}"
+				[[ "$(openldap_filecount ${each})" -gt 0 ]] && have_files=1
+				if [[ "${have_files}" == "1" ]] ; then
+					einfo "   EEK! Non-empty non-tagged datadir, counting `ls -a ${each} | wc -l` files"
+					echo
+
+					eerror
+					eerror "Your OpenLDAP Installation has a non tagged datadir that"
+					eerror "possibly contains a database at ${CURRENT_TAGDIR}"
+					eerror
+					eerror "Please export data if any entered and empty or remove"
+					eerror "the directory, installation has been stopped so you"
+					eerror "can take required action"
+					eerror
+					eerror "For a HOWTO on exporting the data, see instructions in the ebuild"
+					eerror
+					openldap_upgrade_howto
+					die "Please move the datadir ${CURRENT_TAGDIR} away"
+				fi
+			fi
+			einfo
+		fi
+	done
+	[[ "${have_files}" == "1" ]] && einfo "DB files present" || einfo "No DB files present"
+
+	# Now we must check for the major version of sys-libs/db linked against.
+	# TODO: remove this as we dropped bdb support (gone upstream) in 2.6.1?
+	SLAPD_PATH="${EROOT}/usr/$(get_libdir)/openldap/slapd"
+	if [[ "${have_files}" == "1" ]] && [[ -f "${SLAPD_PATH}" ]]; then
+		OLDVER="$(/usr/bin/ldd ${SLAPD_PATH} \
+			| awk '/libdb-/{gsub("^libdb-","",$1);gsub(".so$","",$1);print $1}')"
+		local fail=0
+		if [[ -z "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			:
+			# Nothing wrong here.
+		elif [[ -z "${OLDVER}" ]] && [[ -n "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was not built against"
+			eerror "	any version of sys-libs/db, but the new one will build"
+			eerror "	against	${NEWVER} and your database may be inaccessible."
+			echo
+			fail=1
+		elif [[ -n "${OLDVER}" ]] && [[ -z "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will not be"
+			eerror "	built against any version and your database may be"
+			eerror "	inaccessible."
+			echo
+			fail=1
+		elif [[ "${OLDVER}" != "${NEWVER}" ]]; then
+			eerror "	Your existing version of OpenLDAP was built against"
+			eerror "	sys-libs/db:${OLDVER}, but the new one will build against"
+			eerror "	${NEWVER} and your database would be inaccessible."
+			echo
+			fail=1
+		fi
+		[[ "${fail}" == "1" ]] && openldap_upgrade_howto
+	fi
+
+	echo
+	einfo
+	einfo "All datadirs are fine, proceeding with merge now..."
+	einfo
+}
+
+openldap_upgrade_howto() {
+	local d l i
+	eerror
+	eerror "A (possible old) installation of OpenLDAP was detected,"
+	eerror "installation will not proceed for now."
+	eerror
+	eerror "As major version upgrades can corrupt your database,"
+	eerror "you need to dump your database and re-create it afterwards."
+	eerror
+	eerror "Additionally, rebuilding against different major versions of the"
+	eerror "sys-libs/db libraries will cause your database to be inaccessible."
+	eerror ""
+	d="$(date -u +%s)"
+	l="/root/ldapdump.${d}"
+	i="${l}.raw"
+	eerror " 1. /etc/init.d/slapd stop"
+	eerror " 2. slapcat -l ${i}"
+	eerror " 3. egrep -v '^(entry|context)CSN:' <${i} >${l}"
+	eerror " 4. mv /var/lib/openldap-data/ /var/lib/openldap-data-backup/"
+	eerror " 5. emerge --update \=net-nds/${PF}"
+	eerror " 6. etc-update, and ensure that you apply the changes"
+	eerror " 7. slapadd -l ${l}"
+	eerror " 8. chown ldap:ldap /var/lib/openldap-data/*"
+	eerror " 9. /etc/init.d/slapd start"
+	eerror "10. check that your data is intact."
+	eerror "11. set up the new replication system."
+	eerror
+	if [[ "${FORCE_UPGRADE}" != "1" ]]; then
+		die "You need to upgrade your database first"
+	else
+		eerror "You have the magical FORCE_UPGRADE=1 in place."
+		eerror "Don't say you weren't warned about data loss."
+	fi
+}
+
+pkg_setup() {
+	if ! use sasl && use cxx ; then
+		die "To build the ldapc++ library you must emerge openldap with sasl support"
+	fi
+	# Bug #322787
+	if use minimal && ! has_version "net-nds/openldap" ; then
+		einfo "No datadir scan needed, openldap not installed"
+	elif use minimal && has_version 'net-nds/openldap[minimal]' ; then
+		einfo "Skipping scan for previous datadirs as requested by minimal useflag"
+	else
+		openldap_find_versiontags
+	fi
+}
+
+src_prepare() {
+	rm -r libraries/liblmdb || die 'could not removed bundled lmdb directory'
+
+	for filename in doc/drafts/draft-ietf-ldapext-acl-model-xx.txt; do
+		iconv -f iso-8859-1 -t utf-8 "$filename" > "$filename.utf8"
+		mv "$filename.utf8" "$filename"
+	done
+
+	default
+
+	sed -i \
+		-e "s:\$(localstatedir)/run:${EPREFIX}/run:" \
+		servers/slapd/Makefile.in || die 'adjusting slapd Makefile.in failed'
+
+	pushd build &>/dev/null || die "pushd build"
+	einfo "Making sure upstream build strip does not do stripping too early"
+	sed -i.orig \
+		-e '/^STRIP/s,-s,,g' \
+		top.mk || die "Failed to remove to early stripping"
+	popd &>/dev/null || die
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+build_contrib_module() {
+	# <dir> [<target>]
+	pushd "${S}/contrib/slapd-modules/$1" &>/dev/null || die "pushd contrib/slapd-modules/$1"
+	einfo "Compiling contrib-module: $1"
+	local target="${2:-all}"
+	emake \
+		LDAP_BUILD="${BUILD_DIR}" prefix="${EPREFIX}/usr" \
+		CC="${CC}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" \
+		"$target"
+	popd &>/dev/null || die
+}
+
+multilib_src_configure() {
+	# Optional Features
+	myconf+=(
+		--enable-option-checking
+		$(use_enable debug)
+		--enable-dynamic
+		$(use_enable syslog)
+		$(use_enable ipv6)
+		--enable-local
+	)
+
+	# Optional Packages
+	myconf+=(
+		--without-fetch
+	)
+
+	if ! use minimal && multilib_is_native_abi; then
+		# SLAPD (Standalone LDAP Daemon) Options
+		# overlay chaining requires '--enable-ldap' #296567
+		# see https://www.openldap.org/doc/admin26/overlays.html#Chaining
+		myconf+=(
+			--enable-ldap=yes
+			--enable-slapd
+			$(use_enable cleartext)
+			$(use_enable crypt)
+			$(multilib_native_use_enable sasl spasswd)
+			--disable-slp
+			$(use_enable tcpd wrappers)
+		)
+		if use experimental ; then
+			# connectionless ldap per bug #342439
+			# connectionless is a unsupported feature according to Howard Chu
+			# see https://bugs.openldap.org/show_bug.cgi?id=9739
+			append-cppflags -DLDAP_CONNECTIONLESS
+
+			myconf+=(
+				--enable-dynacl
+				# ACI build as dynamic module not supported (yet)
+				--enable-aci=yes
+			)
+		fi
+
+		for option in modules rlookups slapi; do
+			myconf+=( --enable-${option} )
+		done
+
+		# static SLAPD backends
+		for backend in mdb; do
+			myconf+=( --enable-${backend}=yes )
+		done
+
+		# module SLAPD backends
+		for backend in asyncmeta dnssrv meta null passwd relay sock; do
+			# missing modules: wiredtiger (not available in portage)
+			myconf+=( --enable-${backend}=mod )
+		done
+
+		use perl && myconf+=( --enable-perl=mod )
+
+		if use odbc ; then
+			myconf+=( --enable-sql=mod )
+			if use iodbc ; then
+				myconf+=( --with-odbc="iodbc" )
+				append-cflags -I"${EPREFIX}"/usr/include/iodbc
+			else
+				myconf+=( --with-odbc="unixodbc" )
+			fi
+		fi
+
+		use overlays && myconf+=( --enable-overlays=mod )
+		use autoca && myconf+=( --enable-autoca=mod ) || myconf+=( --enable-autoca=no )
+		# compile-in the syncprov
+		myconf+=( --enable-syncprov=yes )
+
+		# SLAPD Password Module Options
+		myconf+=(
+			$(use_enable argon2)
+		)
+
+		# Optional Packages
+		myconf+=(
+			$(use_with systemd)
+			$(multilib_native_use_with sasl cyrus-sasl)
+		)
+	else
+		myconf+=(
+			--disable-backends
+			--disable-slapd
+			--disable-mdb
+			--disable-overlays
+			--disable-autoca
+			--disable-syslog
+			--without-systemd
+		)
+	fi
+
+	# Library Generation & Linking Options
+	myconf+=(
+		$(use_enable static-libs static)
+		--enable-shared
+		--enable-versioning
+		--with-pic
+	)
+
+	# some cross-compiling tests don't pan out well.
+	tc-is-cross-compiler && myconf+=(
+		--with-yielding-select=yes
+	)
+
+	local ssl_lib="no"
+	if use ssl || ( ! use minimal && use samba ) ; then
+		if use gnutls ; then
+			myconf+=( --with-tls="gnutls" )
+		else
+			# disable MD2 hash function
+			append-cflags -DOPENSSL_NO_MD2
+			myconf+=( --with-tls="openssl" )
+		fi
+	else
+		myconf+=( --with-tls="no" )
+	fi
+
+	tc-export AR CC CXX
+
+	ECONF_SOURCE="${S}" econf \
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)/openldap \
+		--localstatedir="${EPREFIX}"/var \
+		--runstatedir="${EPREFIX}"/run \
+		--sharedstatedir="${EPREFIX}"/var/lib \
+		"${myconf[@]}"
+
+	# argument '--runstatedir' seems to have no effect therefore this workaround
+	sed -i \
+		-e 's:^runstatedir=.*:runstatedir=${EPREFIX}/run:' \
+		configure contrib/ldapc++/configure contrib/ldaptcl/configure || die 'could not set runstatedir'
+
+	sed -i \
+		-e "s:/var/run/sasl2/mux:${EPREFIX}/run/sasl2/mux:" \
+		doc/guide/admin/security.sdf || die 'could not fix run path in doc'
+
+	emake depend
+}
+
+src_configure_cxx() {
+	# This needs the libraries built by the first build run.
+	# we have to run it AFTER the main build, not just after the main configure
+	local myconf_ldapcpp=(
+		--with-libldap="${E}/lib"
+		--with-ldap-includes="${S}/include"
+	)
+
+	mkdir -p "${BUILD_DIR}"/contrib/ldapc++ || die "could not create ${BUILD_DIR}/contrib/ldapc++ directory"
+	pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+	local LDFLAGS=${LDFLAGS}
+	local CPPFLAGS=${CPPFLAGS}
+	append-ldflags -L"${BUILD_DIR}"/libraries/liblber/.libs \
+		-L"${BUILD_DIR}"/libraries/libldap/.libs
+	append-cppflags -I"${BUILD_DIR}"/include
+	ECONF_SOURCE=${S}/contrib/ldapc++ \
+	econf "${myconf_ldapcpp[@]}"
+	popd &>/dev/null || die "popd contrib/ldapc++"
+}
+
+multilib_src_compile() {
+	tc-export AR CC CXX
+	emake CC="$(tc-getCC)" SHELL="${EPREFIX}"/bin/sh
+
+	if ! use minimal && multilib_is_native_abi ; then
+		if use cxx ; then
+			einfo "Building contrib library: ldapc++"
+			src_configure_cxx
+			pushd "${BUILD_DIR}/contrib/ldapc++" &>/dev/null || die "pushd contrib/ldapc++"
+			emake
+			popd &>/dev/null || die
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Building contrib-module: smbk5pwd"
+			pushd "${S}/contrib/slapd-modules/smbk5pwd" &>/dev/null || die "pushd contrib/slapd-modules/smbk5pwd"
+
+			MY_DEFS="-DDO_SHADOW"
+			if use samba ; then
+				MY_DEFS="${MY_DEFS} -DDO_SAMBA"
+				MY_KRB5_INC=""
+			fi
+			if use kerberos ; then
+				MY_DEFS="${MY_DEFS} -DDO_KRB5"
+				MY_KRB5_INC="$(krb5-config --cflags)"
+			fi
+
+			emake \
+				DEFS="${MY_DEFS}" \
+				KRB5_INC="${MY_KRB5_INC}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use overlays ; then
+			einfo "Building contrib-module: samba4"
+			pushd "${S}/contrib/slapd-modules/samba4" &>/dev/null || die "pushd contrib/slapd-modules/samba4"
+
+			emake \
+				LDAP_BUILD="${BUILD_DIR}" \
+				CC="$(tc-getCC)" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap"
+			popd &>/dev/null || die
+		fi
+
+		if use kerberos ; then
+			if use kinit ; then
+				build_contrib_module "kinit" "kinit.c" "kinit"
+			fi
+			build_contrib_module "passwd" "pw-kerberos.la"
+		fi
+
+		if use pbkdf2; then
+			build_contrib_module "passwd/pbkdf2"
+		fi
+
+		if use sha2 ; then
+			build_contrib_module "passwd/sha2"
+		fi
+
+		# We could build pw-radius if GNURadius would install radlib.h
+		build_contrib_module "passwd" "pw-netscape.la"
+
+		#build_contrib_module "acl" "posixgroup.la" # example code only
+		#build_contrib_module "acl" "gssacl.la" # example code only, also needs kerberos
+		build_contrib_module "addpartial"
+		build_contrib_module "allop"
+		build_contrib_module "allowed"
+		build_contrib_module "autogroup"
+		build_contrib_module "cloak"
+		# build_contrib_module "comp_match" # really complex, adds new external deps, questionable demand
+		build_contrib_module "denyop"
+		build_contrib_module "dsaschema"
+		build_contrib_module "dupent"
+		build_contrib_module "lastbind"
+		# lastmod may not play well with other overlays
+		build_contrib_module "lastmod"
+		build_contrib_module "noopsrch"
+		#build_contrib_module "nops" https://bugs.gentoo.org/641576
+		#build_contrib_module "nssov" RESO:LATER
+		build_contrib_module "trace"
+		# build slapi-plugins
+		pushd "${S}/contrib/slapi-plugins/addrdnvalues" &>/dev/null || die "pushd contrib/slapi-plugins/addrdnvalues"
+		einfo "Building contrib-module: addrdnvalues plugin"
+		$(tc-getCC) -shared \
+			-I"${BUILD_DIR}"/include \
+			-I../../../include \
+			${CFLAGS} \
+			-fPIC \
+			${LDFLAGS} \
+			-o libaddrdnvalues-plugin.so \
+			addrdnvalues.c || die "Building libaddrdnvalues-plugin.so failed"
+		popd &>/dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		cd "tests"
+		pwd
+		# emake test => runs only lloadd & mdb, in serial; skips ldif,sql,wt,regression
+		# emake partests => runs ALL of the tests in parallel
+		# wt/WiredTiger is not supported in Gentoo
+		TESTS=( plloadd pmdb )
+		#TESTS+=( pldif ) # not done by default, so also exclude here
+		#use odbc && TESTS+=( psql ) # not done by default, so also exclude here
+		emake "${TESTS[@]}"
+	fi
+}
+
+multilib_src_install() {
+	emake CC="$(tc-getCC)" \
+		DESTDIR="${D}" SHELL="${EPREFIX}"/bin/sh install
+
+	if ! use minimal && multilib_is_native_abi; then
+		# openldap modules go here
+		# TODO: write some code to populate slapd.conf with moduleload statements
+		keepdir /usr/$(get_libdir)/openldap/openldap/
+
+		# initial data storage dir
+		keepdir /var/lib/openldap-data
+		use prefix || fowners ldap:ldap /var/lib/openldap-data
+		fperms 0700 /var/lib/openldap-data
+
+		echo "OLDPF='${PF}'" > "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# do NOT delete this. it is used"	>> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+		echo "# to track versions for upgrading." >> "${ED}${OPENLDAP_DEFAULTDIR_VERSIONTAG}/${OPENLDAP_VERSIONTAG}"
+
+		# use our config
+		rm "${ED}"/etc/openldap/slapd.conf
+		insinto /etc/openldap
+		newins "${FILESDIR}"/${PN}-2.4.40-slapd-conf slapd.conf
+		configfile="${ED}"/etc/openldap/slapd.conf
+
+		# populate with built backends
+		ebegin "populate config with built backends"
+		for x in "${ED}"/usr/$(get_libdir)/openldap/openldap/back_*.so; do
+			einfo "Adding $(basename ${x})"
+			sed -e "/###INSERTDYNAMICMODULESHERE###$/a# moduleload\t$(basename ${x})" -i "${configfile}" || die
+		done
+		sed -e "s:###INSERTDYNAMICMODULESHERE###$:# modulepath\t${EPREFIX}/usr/$(get_libdir)/openldap/openldap:" -i "${configfile}"
+		use prefix || fowners root:ldap /etc/openldap/slapd.conf
+		fperms 0640 /etc/openldap/slapd.conf
+		cp "${configfile}" "${configfile}".default || die
+		eend $?
+
+		# install our own init scripts and systemd unit files
+		einfo "Install init scripts"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-initd-2.4.40-r2 > "${T}"/slapd || die
+		doinitd "${T}"/slapd
+		newconfd "${FILESDIR}"/slapd-confd-2.6.1 slapd
+
+		einfo "Install systemd service"
+		sed -e "s,/usr/lib/,/usr/$(get_libdir)/," "${FILESDIR}"/slapd-2.6.1.service > "${T}"/slapd.service || die
+		systemd_dounit "${T}"/slapd.service
+		systemd_install_serviced "${FILESDIR}"/slapd.service.conf
+		newtmpfiles "${FILESDIR}"/slapd.tmpfilesd slapd.conf
+
+		# if built without SLP, we don't need to be before avahi
+			sed -i \
+				-e '/before/{s/avahi-daemon//g}' \
+				"${ED}"/etc/init.d/slapd \
+				|| die
+
+		if use cxx ; then
+			einfo "Install the ldapc++ library"
+			cd "${BUILD_DIR}/contrib/ldapc++" || die
+			emake DESTDIR="${D}" libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			cd "${S}"/contrib/ldapc++ || die
+			newdoc README ldapc++-README
+		fi
+
+		if use smbkrb5passwd ; then
+			einfo "Install the smbk5pwd module"
+			cd "${S}/contrib/slapd-modules/smbk5pwd" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README smbk5pwd-README
+		fi
+
+		if use overlays ; then
+			einfo "Install the samba4 module"
+			cd "${S}/contrib/slapd-modules/samba4" || die
+			emake DESTDIR="${D}" \
+				LDAP_BUILD="${BUILD_DIR}" \
+				libexecdir="${EPREFIX}/usr/$(get_libdir)/openldap" install
+			newdoc README samba4-README
+		fi
+
+		einfo "Installing contrib modules"
+		cd "${S}/contrib/slapd-modules" || die
+		for l in */*.la */*/*.la; do
+			[[ -e ${l} ]] || continue
+			libtool --mode=install cp ${l} \
+				"${ED}"/usr/$(get_libdir)/openldap/openldap || \
+				die "installing ${l} failed"
+		done
+
+		dodoc "${FILESDIR}"/DB_CONFIG.fast.example
+		docinto contrib
+		doman */*.5
+		#newdoc acl/README*
+		newdoc addpartial/README addpartial-README
+		newdoc allop/README allop-README
+		newdoc allowed/README allowed-README
+		newdoc autogroup/README autogroup-README
+		newdoc dsaschema/README dsaschema-README
+		newdoc passwd/README passwd-README
+		cd "${S}/contrib/slapi-plugins" || die
+		insinto /usr/$(get_libdir)/openldap/openldap
+		doins */*.so
+		docinto contrib
+		newdoc addrdnvalues/README addrdnvalues-README
+
+		insinto /etc/openldap/schema
+		newins "${DISTDIR}"/${BIS_P} ${BIS_PN}
+
+		docinto back-sock ; dodoc "${S}"/servers/slapd/back-sock/searchexample*
+		docinto back-perl ; dodoc "${S}"/servers/slapd/back-perl/SampleLDAP.pm
+
+		dosbin "${S}"/contrib/slapd-tools/statslog
+		newdoc "${S}"/contrib/slapd-tools/README README.statslog
+	fi
+
+	if ! use static-libs ; then
+		find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+	fi
+}
+
+multilib_src_install_all() {
+	dodoc ANNOUNCEMENT CHANGES COPYRIGHT README
+	docinto rfc ; dodoc doc/rfc/*.txt
+}
+
+pkg_preinst() {
+	# keep old libs if any
+	preserve_old_lib /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+	# bug 440470, only display the getting started help there was no openldap before,
+	# or we are going to a non-minimal build
+	! has_version net-nds/openldap || has_version 'net-nds/openldap[minimal]'
+	OPENLDAP_PRINT_MESSAGES=$((! $?))
+}
+
+pkg_postinst() {
+	if ! use minimal ; then
+		tmpfiles_process slapd.conf
+
+		# You cannot build SSL certificates during src_install that will make
+		# binary packages containing your SSL key, which is both a security risk
+		# and a misconfiguration if multiple machines use the same key and cert.
+		if use ssl; then
+			install_cert /etc/openldap/ssl/ldap
+			use prefix || chown ldap:ldap "${EROOT}"/etc/openldap/ssl/ldap.*
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "Self-signed SSL certificates are treated harshly by OpenLDAP 2.[12]"
+			ewarn "add 'TLS_REQCERT allow' if you want to use them."
+		fi
+
+		if use prefix; then
+			# Warn about prefix issues with slapd
+			eerror "slapd might NOT be usable on Prefix systems as it requires root privileges"
+			eerror "to start up, and requires that certain files directories be owned by"
+			eerror "ldap:ldap.  As Prefix does not support changing ownership of files and"
+			eerror "directories, you will have to manually fix this yourself."
+		fi
+
+		# These lines force the permissions of various content to be correct
+		if [[ -d "${EROOT}"/var/run/openldap ]]; then
+			use prefix || { chown ldap:ldap "${EROOT}"/var/run/openldap || die; }
+			chmod 0755 "${EROOT}"/var/run/openldap || die
+		fi
+		use prefix || chown root:ldap "${EROOT}"/etc/openldap/slapd.conf{,.default}
+		chmod 0640 "${EROOT}"/etc/openldap/slapd.conf{,.default} || die
+		use prefix || chown ldap:ldap "${EROOT}"/var/lib/openldap-data
+	fi
+
+	if has_version 'net-nds/openldap[-minimal]' && ((${OPENLDAP_PRINT_MESSAGES})); then
+		elog "Getting started using OpenLDAP? There is some documentation available:"
+		elog "Gentoo Guide to OpenLDAP Authentication"
+		elog "(https://wiki.gentoo.org/wiki/Centralized_authentication_using_OpenLDAP)"
+	fi
+
+	preserve_old_lib_notify /usr/$(get_libdir)/{liblber,libldap,libldap_r}-2.4$(get_libname 0)
+}

sdk_container/src/third_party/portage-stable/profiles/arch.list

@@ -4,6 +4,7 @@ arm
 arm64
 hppa
 ia64
+loong
 m68k
 mips
 ppc

sdk_container/src/third_party/portage-stable/profiles/arch/alpha/make.defaults

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 ARCH="alpha"
@@ -21,7 +21,7 @@ LIBDIR_alpha="lib"
 
 # Donnie Berkholz <dberkholz@gentoo.org> (2006-08-18)
 # Defaults for video drivers
-VIDEO_CARDS="fbdev glint mga nv r128 radeon"
+VIDEO_CARDS="fbdev mga nv r128 radeon"
 
 # Tobias Klausmann <klausman@gentoo.org> (2018-06-25)
 # Enable USE=libtirpc by default, to ease dependency resolution during

sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.force

@@ -1,6 +1,10 @@
-# Copyright 1999-2015 Gentoo Foundation
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2022-02-19)
+# New enough SpiderMonkey not keyworded here, bug #753221
+sys-auth/polkit duktape
+
 # Tobias Klausmann <klausman@gentoo.org> 2014-12-04
 # The Firefox/Mozilla build system is broken in regards to linking the shipped
 # ICU library. Bug 529944

sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask

@@ -1,15 +1,56 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2022-04-29)
+# Needs unkeyworded dev-util/umockdev
+sys-power/upower test
+
+# Michał Górny <mgorny@gentoo.org> (2022-04-26)
+# Unkeyworded dependencies.
+dev-python/click doc
+
+# Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
+# Dependencies are missing keywords
+media-libs/imlib2 svg heif jpegxl
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-18)
+# app-text/nuspell is not keyworded
+app-text/enchant nuspell
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-16)
+# sys-auth/seatd is not keyworded
+dev-libs/weston seatd
+
+# Lars Wendler <polynomial-c@gentoo.org> (2022-04-01)
+# gnome-base/librsvg missing keywords
+media-libs/freetype svg
+
+# Sam James <sam@gentoo.org> (2022-03-26)
+# media-libs/libjxl not keyworded here
+media-gfx/graphicsmagick jpegxl
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# Untested useflag on other arches, needs keywording
+media-video/ffmpeg vmaf
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-02-17)
+# Mask AMF keyword on non-amd64 arches
+# It is unusable, for now, in other arches
+media-video/ffmpeg amf
+
+# Sam James <sam@gentoo.org> (2022-01-29)
+# app-text/ronn-ng not keyworded here, bug #801103
+app-accessibility/espeak-ng man
+
+# James Beddek <telans@posteo.de> (2022-01-15)
+# media-libs/svt-av1 is not keyworded here
+media-video/ffmpeg svt-av1
+
 # Michał Górny <mgorny@gentoo.org> (2021-12-30)
 # Don't apply stable masks to python-exec since we're forcing every
 # impl there anyway. Please keep this in sync with use.mask.
 dev-lang/python-exec -python_targets_python3_10
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
-
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Avoid keywording unnecessary depenencies for now, bug #804115
 dev-python/scipy pythran
@@ -59,6 +100,7 @@ media-libs/rubberband jni
 # media-libs/libheif isn't keyworded here
 # media-libs/libavif isn't keyworded here
 media-libs/gd avif heif
+media-gfx/graphicsmagick heif
 
 # Sam James <sam@gentoo.org> (2021-02-26)
 # dev-libs/efl not keyworded here
@@ -144,10 +186,6 @@ xfce-extra/tumbler epub
 # Requires dev-python/networkx.
 app-portage/nattka depgraph-order
 
-# Matt Turner <mattst88@gentoo.org> (2020-06-09)
-# Requires unsupported dev-python/eventlet and fails tests with gevent
-dev-python/socketpool eventlet gevent
-
 # Mikle Kolyada <zlogene@gentoo.org> (2020-06-08)
 # clisp is keyworded on alpha
 app-text/texlive-core -xindy
@@ -171,10 +209,6 @@ net-libs/gnome-online-accounts gnome
 # Requires media-libs/mesa[llvm], which is masked.
 dev-python/pyopengl test
 
-# Lars Wendler <polynomial-c@gentoo.org> (2020-04-20)
-# Not keyworded on alpha
-net-misc/whois xcrypt
-
 # Matt Turner <mattst88@gentoo.org> (2020-03-17)
 # Requires an insane (and always growing) number of ruby deps
 sys-block/thin-provisioning-tools test
@@ -282,6 +316,7 @@ net-libs/gnutls test-full
 # Michał Górny <mgorny@gentoo.org> (2017-08-08)
 # Requires USE=bluetooth that is masked in this profile.
 media-sound/pulseaudio native-headset
+media-sound/pulseaudio-daemon native-headset
 
 # Tobias Klausmann <klausman@gentoo.org> (2017-05-18)
 # Stack protector code is not ported to alpha (and may not ever be)
@@ -364,6 +399,7 @@ net-misc/networkmanager wext
 # Tobias Klausmann <klausman@gentoo.org> (2015-08-10)
 # Opting out of the net-misc/ofono dep tree until we have a user request
 >=media-sound/pulseaudio-6.0 ofono-headset
+media-sound/pulseaudio-daemon ofono-headset
 
 # Gilles Dartiguelongue <eva@gentoo.org> (2015-06-09)
 # dev-lua/lgi lacks alpha keyword, bug #551540
@@ -461,7 +497,7 @@ x11-misc/xscreensaver new-login
 
 # Alexey Shvetsov <alexxy@gentoo.org> (2011-12-17)
 # mask use numa for openmpi
-sys-cluster/openmpi openmpi_fabrics_psm openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_fabrics_dapl openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_connectx-xrc openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl openmpi_ofed_features_failover
+sys-cluster/openmpi openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl
 
 # Raúl Porcel <armin76@gentoo.org> (2011-10-08)
 # Needs media-sound/lilypond
@@ -474,8 +510,6 @@ media-video/x264-encoder ffmpegsource
 # Alexey Shvetsov <alexxy@gentoo.org> (2011-08-31)
 # Mask numa use flag per bug #381313
 sys-apps/hwloc numa
-# This mask also implies masking the numa flag on openmpi
-sys-cluster/openmpi numa
 
 # Pacho Ramos <pacho@gentoo.org> (2011-06-30)
 # Needed plugins are not keyworded on this arch

sdk_container/src/third_party/portage-stable/profiles/arch/alpha/use.mask

@@ -1,9 +1,13 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -alpha
 
+# Matt Turner <mattst88@gentoo.org> (2022-02-21)
+# app-crypt/tpm2-tss is not keyworded here
+tpm
+
 # James Le Cuirot <chewi@gentoo.org> (2021-08-10)
 # media-video/pipewire is not keyworded. Bug #807616.
 pipewire
@@ -96,7 +100,6 @@ dmi
 # Stuff that doesn't work on alpha, or not tested
 clang
 djbfft
-emboss
 hardened
 mecab
 netbeans
@@ -177,10 +180,6 @@ llvm
 # net-misc/connman is not keyworded
 connman
 
-# Anthony G. Basile <blueness@gentoo.org> (2012-04-15)
-# Pulls in net-libs/axtls which is not keyworded for arch
-curl_ssl_axtls
-
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
 # media-libs/xine-lib is not keyworded
 xine

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/no-multilib/package.mask

@@ -78,6 +78,8 @@ games-fps/ut2003-demo
 games-fps/ut2004-demo
 games-misc/little-inferno
 games-misc/papers-please
+games-puzzle/braid-hb
+games-puzzle/braid-gog
 games-puzzle/triptych
 games-roguelike/adom
 games-rpg/baldurs-gate-ee

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # When you add an entry to the top of this file, add your name, the date, and
@@ -18,7 +18,7 @@
 #--- END OF EXAMPLES ---
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-11-01)
-# requires sys-apps/dbus-broker, which keyworded here.
+# requires sys-apps/dbus-broker, which is keyworded here.
 sys-apps/systemd -hostnamed-fallback
 
 # James Le Cuirot <chewi@gentoo.org> (2021-10-22)
@@ -47,10 +47,6 @@ dev-util/diffoscope -haskell
 x11-base/xwayland -video_cards_nvidia
 x11-wm/mutter -video_cards_nvidia
 
-# Mike Gilbert <floppym@gentoo.org> (2021-03-29)
-# Unmask TPM on supported archs.
-sys-apps/systemd -tpm
-
 # Michael Orlitzky <mjo@gentoo.org> (2021-03-27)
 # Unmask the use of 64-bit dev-lisp/clozurecl on 64-bit arches.
 # Only maxima makes a distinction between the 32-bit and 64-bit
@@ -127,17 +123,6 @@ sci-physics/root -cudnn
 mail-client/thunderbird -eme-free
 www-client/firefox -eme-free
 
-# Mart Raudsepp <leio@gentoo.org> (2020-03-01)
-# dev-util/sysprof-capture is keyworded on amd64
-x11-wm/mutter -sysprof
-dev-libs/gjs -sysprof
-dev-libs/glib -sysprof
-gnome-extra/cjs -sysprof
-x11-libs/gtk+ -sysprof
-net-libs/libsoup -sysprof
-x11-libs/pango -sysprof
-gui-libs/gtk -sysprof
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2020-02-26)
 # Vulkan is available on amd64.
 dev-qt/qt3d -vulkan
@@ -295,6 +280,7 @@ sys-boot/grub:2 -grub_platforms_xen-32
 # Mike Gilbert <floppym@gentoo.org> (2015-09-05)
 # sys-boot/gnu-efi is not supported on all archs.
 sys-apps/systemd -gnuefi
+sys-apps/systemd-utils -boot
 
 # Ben de Groot <yngwin@gentoo.org> (2015-03-15)
 # media-libs/libbdplus is keyworded on amd64, so unmask the useflag
@@ -354,6 +340,7 @@ app-arch/zpaq -jit
 # webrtc-audio-processing is only supported on x86/amd64. Possibly arm can be
 # added.
 media-sound/pulseaudio -webrtc-aec
+media-sound/pulseaudio-daemon -webrtc-aec
 
 # Bernard Cafarelli <voyageur@gentoo.org> (2012-02-27)
 # Masked in base profile, supported on this arch
@@ -417,7 +404,7 @@ media-sound/mpg123 cpu_flags_x86_mmx cpu_flags_x86_3dnow cpu_flags_x86_3dnowext
 # Alistair Bush <ali_bush@gentoo.org> (2007-05-08)
 # Mask doc flag for fop as nearly impossible to
 # run javadoc target.  see #177585
->=dev-java/fop-0.93 doc
+dev-java/fop:0 doc
 
 # Alexis Ballier <aballier@gentoo.org> (2008-08-08)
 # x86 asm only, it won't be built on amd64 if mmx useflag is enabled but that

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # When you add an entry to the top of this file, add your name, the date, and
@@ -17,6 +17,18 @@
 
 #--- END OF EXAMPLES ---
 
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# needs stabilizing
+media-video/ffmpeg vmaf
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-02-17)
+# needs stabilizing
+media-video/ffmpeg amf
+
+# Sam James <sam@gentoo.org> (2022-02-01)
+# sys-cluster/ucx is not marked stable on amd64
+sys-cluster/slurm ucx
+
 # Joonas Niilola <juippis@gentoo.org> (2021-08-13)
 # dev-libs/efl is stabilized on amd64.
 app-crypt/pinentry -efl
@@ -41,11 +53,6 @@ app-office/libreoffice base
 # dev-util/nvidia-cuda-toolkit has no stable keywords
 app-metrics/collectd collectd_plugins_slurm collectd_plugins_gpu_nvidia
 
-# Joonas Niilola <juippis@gentoo.org> (2020-06-21)
-# sys-apps/apparmor doesn't have stable keywords.
-app-containers/lxc apparmor
-app-containers/lxd apparmor
-
 # Thomas Deutschmann <whissi@gentoo.org> (2019-10-28)
 # net-libs/quiche is an early HTTP/3 implementation
 # not yet ready for everyone.
@@ -82,7 +89,7 @@ virtual/wine staging
 
 # Christoph Junghans <junghans@gentoo.org> (2017-02-26)
 # Stable mask some fabrics (bug #525534)
-sys-cluster/openmpi openmpi_fabrics_psm openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_fabrics_dapl openmpi_rm_pbs openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_connectx-xrc openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl openmpi_ofed_features_failover
+sys-cluster/openmpi openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_rm_pbs openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl
 
 # Brian Evans <grknight@gentoo.org> (2017-01-17)
 # Stable mask groonga on mariadb as I don't know how stable

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask

@@ -1,10 +1,17 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -amd64
 
-# SECTION: Unmask
+# Matt Turner <mattst88@gentoo.org> (2022-04-16)
+# dev-util/sysprof-capture is keyworded on amd64
+-sysprof
+
+# David Seifert <soap@gentoo.org> (2022-03-13)
+# Cuda/NVENC works here
+-cuda
+-nvenc
 
 # Michał Górny <mgorny@gentoo.org> (2021-01-07)
 # Prebuilt kernels are supported here.
@@ -39,10 +46,6 @@
 # sys-libs/libapparmor
 -apparmor
 
-# Alexey Shvetsov <alexxy@gentoo.org> (2014-04-08)
-# Cuda works here
--cuda
-
 # Michał Górny <mgorny@gentoo.org> (2014-03-30)
 # PyPy is keyworded on this arch.
 -python_targets_pypy3
@@ -91,14 +94,6 @@
 -sane_backends_mustek_pp
 -sane_backends_qcam
 
-# Alex Legler <a3li@gentoo.org> (2010-05-03)
-# Add support for Ruby Enterprise Edition targets where rubyee is available
-# -ruby_targets_ree18
-
-# Hans de Graaff <graaff@gentoo.org> (2011-10-21)
-# Add support for Rubinius targets where rbx is available
-#-ruby_targets_rbx
-
 # Lilo works on amd64, so ...
 -lilo
 
@@ -153,13 +148,9 @@
 # Unmask as it works on amd64
 -lcd_devices_luise
 
-# SECTION: Unavailable/Broken
-
 # 2004-06-22 - Taken from 2004.0 profile
 # masked
 3dfx
 
 # fdk-aac is already keyworded here
 -fdk
-
-# NOT NECESSARY - SECTION

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask

@@ -1,11 +1,20 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2022-02-13)
+# Requires qtwebengine
+sci-electronics/eagle
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2021-09-09)
 # Jupyterlab and friends require net-libs/nodejs
 dev-python/jupyterlab
 dev-python/jupyterlab-lsp
 sci-misc/jupyterlab-desktop-bin
+dev-python/plotly
+dev-python/plotly-geo
+dev-python/chart-studio
+sci-visualization/dash
+sci-visualization/jupyter-dash
 
 # Bernd Waibel <waebbl-gentoo@posteo.net> (2021-02-13)
 # Is reverse-dependency of dev-qt/qtwebengine
@@ -22,6 +31,7 @@ app-editors/ghostwriter
 app-editors/notepadqq
 app-editors/retext
 app-misc/anki
+app-office/kalendar:5
 app-office/kmymoney:5
 app-office/skrooge:5
 app-office/texmaker
@@ -32,12 +42,8 @@ app-text/kchmviewer
 app-text/sigil
 dev-lang/typescript
 dev-python/spyder
-dev-python/spyder-line-profiler
-dev-python/spyder-memory-profiler
-dev-python/spyder-notebook
 dev-python/spyder-terminal
 dev-python/spyder-unittest
-dev-python/spyder-vim
 dev-util/kdevelop:5
 dev-util/kdevelop-php:5
 dev-util/kdevelop-python:5

sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2021-02-09)
@@ -46,7 +46,6 @@ dev-ruby/rails asset-pipeline
 dev-ruby/sprockets test
 dev-ruby/tilt test
 net-analyzer/netdata nodejs
-www-apps/gitea build-client
 www-apps/jekyll test
 www-apps/xpra-html5 minify
 dev-python/QtPy test

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4/package.mask

@@ -1,4 +1,4 @@
-# Copyright 2017-2020 Gentoo Authors
+# Copyright 2017-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Anthony Ryan <anthonyryan1@gmail.com> (2017-01-21)
@@ -27,3 +27,7 @@ virtual/rust
 gnome-base/gdm
 gnome-extra/chrome-gnome-shell
 gnome-extra/gnome-tweaks
+>=dev-python/cryptography-36
+>=dev-python/pyopenssl-22
+dev-python/setuptools-rust
+dev-python/watchfiles

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4/package.use.mask

@@ -1,10 +1,11 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
+# Sam James <sam@gentoo.org> (2022-04-22)
+# Needs Rustified librsvg
+>=media-libs/freetype-2.12.0 svg
+media-libs/imlib2 svg
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gdm requires gnome-shell requires rustified librsvg.
 x11-misc/xscreensaver gdm

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4/use.mask

@@ -1,6 +1,6 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gnome-shell requires rustified librsvg.
 gnome-shell

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4t/package.mask

@@ -1,4 +1,4 @@
-# Copyright 2017-2020 Gentoo Authors
+# Copyright 2017-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Anthony Ryan <anthonyryan1@gmail.com> (2017-01-21)
@@ -27,3 +27,7 @@ virtual/rust
 gnome-base/gdm
 gnome-extra/chrome-gnome-shell
 gnome-extra/gnome-tweaks
+>=dev-python/cryptography-36
+>=dev-python/pyopenssl-22
+dev-python/setuptools-rust
+dev-python/watchfiles

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4t/package.use.mask

@@ -1,10 +1,11 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
+# Sam James <sam@gentoo.org> (2022-04-22)
+# Needs Rustified librsvg
+>=media-libs/freetype-2.12.0 svg
+media-libs/imlib2 svg
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gdm requires gnome-shell requires rustified librsvg.
 x11-misc/xscreensaver gdm

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv4t/use.mask

@@ -1,6 +1,6 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gnome-shell requires rustified librsvg.
 gnome-shell

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv5te/package.mask

@@ -1,4 +1,4 @@
-# Copyright 2017-2020 Gentoo Authors
+# Copyright 2017-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Anthony Ryan <anthonyryan1@gmail.com> (2017-01-21)
@@ -27,3 +27,7 @@ virtual/rust
 gnome-base/gdm
 gnome-extra/chrome-gnome-shell
 gnome-extra/gnome-tweaks
+>=dev-python/cryptography-36
+>=dev-python/pyopenssl-22
+dev-python/setuptools-rust
+dev-python/watchfiles

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv5te/package.use.mask

@@ -1,10 +1,11 @@
-# Copyright 2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
+# Sam James <sam@gentoo.org> (2022-04-22)
+# Needs Rustified librsvg
+>=media-libs/freetype-2.12.0 svg
+media-libs/imlib2 svg
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gdm requires gnome-shell requires rustified librsvg.
 x11-misc/xscreensaver gdm

sdk_container/src/third_party/portage-stable/profiles/arch/arm/armv5te/use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask armv5 specific USE flags
@@ -9,6 +9,6 @@
 -cpu_flags_arm_thumb
 -cpu_flags_arm_vfp
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gnome-shell requires rustified librsvg.
 gnome-shell

sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask

@@ -1,15 +1,44 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Matt Turner <mattst88@gentoo.org> (2022-04-18)
+# app-text/nuspell is not keyworded
+app-text/enchant nuspell
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# Untested useflag on other arches, needs keywording
+media-video/ffmpeg vmaf
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2022-03-13)
+# Not yet keyworded. Bug #835037
+kde-frameworks/kfilemetadata mobi
+
+# Sam James <sam@gentoo.org> (2022-03-10)
+# Boost has support for ARM32
+# https://www.boost.org/doc/libs/1_78_0/libs/context/doc/html/context/architectures.html
+dev-libs/boost -context
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-01-17)
+# Mask AMF keyword on non-amd64 arches
+# It is unusable, for now, in other arches
+media-video/ffmpeg amf
+
+# Sam James <sam@gentoo.org> (2022-01-15)
+# Deps not yet stable:
+# app-emulation/spice
+# media-libs/virglrenderer
+# net-libs/libslirp
+# net-misc/vde
+# sys-cluster/ceph
+# sys-firmware/edk2-ovmf
+app-emulation/qemu rbd slirp spice virgl vde
+app-emulation/qemu qemu_softmmu_targets_i386 qemu_softmmu_targets_x86_64
+app-emulation/qemu qemu_softmmu_targets_ppc qemu_softmmu_targets_ppc64
+
 # Sam James <sam@gentoo.org> (2021-10-31)
 # dev-python/pyilmbase isn't keyworded on arm
 media-gfx/alembic python
 
-# Sam James <sam@gentoo.org> (2021-10-26)
-# Avoid dragging in obscure parts of dev-qt/* unless/until
-# somebody needs them. bug #816981.
-dev-python/QtPy pyside2
-
 # Tomáš Mózes <hydrapolic@gmail.com> (2021-09-25)
 # Unkeyworded dependencies.
 app-admin/syslog-ng mongodb
@@ -32,10 +61,6 @@ media-sound/easyeffects zamaudio
 # no stable virtual/jdk on this arch
 media-libs/rubberband jni
 
-# Mike Gilbert <floppym@gentoo.org> (2021-03-29)
-# Unmask TPM on supported archs.
-sys-apps/systemd -tpm
-
 # Sam James <sam@gentoo.org> (2021-02-17)
 # Unmask dev-libs/libpcre2[jit] support on PHP
 # where available
@@ -53,6 +78,7 @@ net-im/prosody selinux
 # gnuefi + systemd-boot works on arm
 # bug #729720
 sys-apps/systemd -gnuefi
+sys-apps/systemd-utils -boot
 
 # Joonas Niilola <juippis@gentoo.org> (2021-01-15)
 # Dependency not keyworded on this arch.
@@ -102,10 +128,6 @@ x11-themes/arc-theme cinnamon
 # gnome-base/librsvg, et al
 >=media-gfx/eog-3.33.1 svg
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-07-28)
-# Requires dev-libs/boost[context] which is masked on arm, bug #727138
-dev-libs/msgpack boost
-
 # Sam James <sam@gentoo.org> (2020-07-11)
 # Don't drag in qtwebengine for Plasma right now
 # Not going for nuclear option of general mask
@@ -119,15 +141,6 @@ kde-plasma/kdeplasma-addons webengine
 # Tests require Valgrind, not available on <armv7a
 dev-libs/rapidjson test
 
-# Michał Górny <mgorny@gentoo.org> (2020-06-19)
-# Requires dev-util/pahole.
-sys-kernel/gentoo-kernel debug
-sys-kernel/vanilla-kernel debug
-
-# Michał Górny <mgorny@gentoo.org> (2020-06-14)
-# Requires dev-python/networkx.
-app-portage/nattka depgraph-order
-
 # Jimi Huotari <chiitoo@gentoo.org> (2020-05-17)
 # Mask until 'app-arch/lxqt-archiver' is keyworded.
 lxqt-base/lxqt-meta archiver
@@ -136,23 +149,10 @@ lxqt-base/lxqt-meta archiver
 # no keywords
 dev-python/pbr test
 
-# Mart Raudsepp <leio@gentoo.org> (2020-04-25)
-# gnome-base/gnome-control-center not keyworded on arm
-# anymore, bug #692802
-net-libs/gnome-online-accounts gnome
-
-# Lars Wendler <polynomial-c@gentoo.org> (2020-04-20)
-# Not keyworded on arm
-net-misc/whois xcrypt
-
 # Georgy Yakovlev <gyakovlev@gentoo.org (2020-01-04)
 # zfs is not keyworded on arm
 dev-util/schroot zfs
 
-# Tomáš Mózes <hydrapolic@gmail.com> (2019-12-19)
-# dev-libs/criterion is not keyworded yet
-app-admin/syslog-ng test
-
 # Robin H. Johnson <robbat2@gentoo.org> (2019-12-06)
 # PPS should work on all arches, but only keyworded on some arches
 >=net-misc/ntp-4.2.6_p3-r1 -parse-clocks
@@ -180,10 +180,6 @@ net-analyzer/rrdtool rados
 sys-fs/multipath-tools rbd
 www-servers/uwsgi uwsgi_plugins_rados
 
-# Anthony G. Basile <blueness@gentoo.org> (2019-03-16)
-# to avoid a circular dependency
-dev-python/async_timeout test
-
 # Anthony G. Basile <blueness@gentoo.org> (2019-03-08)
 # hipe code is missing in erlang for arm
 dev-lang/erlang hipe
@@ -222,10 +218,6 @@ net-libs/gnutls test-full
 # Moved from use.mask since they are flags local to one package.
 media-tv/tvheadend hdhomerun
 
-# Michał Górny <mgorny@gentoo.org> (2017-11-29)
-# All current clang versions are broken on ARM.
-app-doc/doxygen clang
-
 # Patrice Clement <monsieurp@gentoo.org> (2017-09-24)
 # Unmask Raspberry Pi support on arm.
 media-video/mpv -raspberry-pi
@@ -247,11 +239,6 @@ sys-power/nut ups_drivers_nut-ipmipsu
 # Requires USE=opencl that is masked in this profile.
 net-misc/bfgminer adl lm-sensors
 
-# Michał Górny <mgorny@gentoo.org> (2017-06-28)
-# dev-tcltk/tcllib is not keyworded, and tests are restricted anyway, so
-# no point in pursuing it right now.
-app-shells/bash-completion test
-
 # Patrice Clement <monsieurp@gentoo.org> (2017-04-09)
 # Enable MQTT support on supported architectures
 app-metrics/collectd -collectd_plugins_mqtt
@@ -260,13 +247,9 @@ app-metrics/collectd -collectd_plugins_mqtt
 # Cannot test non-free dependency dev-libs/device-atlas-api-c
 net-proxy/haproxy device-atlas
 
-# Alon Bar-Lev <alonbl@gentoo.org> (2017-03-10)
-# net-firewall/ipset is not available on arm
-net-firewall/firehol ipset
-
 # Christoph Junghans <junghans@gentoo.org> (2017-02-05)
 # Mask some fabrics
-sys-cluster/openmpi java openmpi_fabrics_psm openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_fabrics_dapl openmpi_rm_pbs openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_connectx-xrc openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl openmpi_ofed_features_failover
+sys-cluster/openmpi java openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_rm_pbs openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl
 
 # Luke Dashjr <luke-jr+gentoobugs@utopios.org> (2017-01-04)
 # Assembly optimisations are supported on arm since 0.0.0_pre20161213
@@ -354,10 +337,6 @@ www-client/chromium widevine
 www-client/vivaldi widevine
 www-client/vivaldi-snapshot widevine
 
-# Markus Meier <maekke@gentoo.org> (2015-01-17)
-# Unkeyworded deps, bug #536226
-net-vpn/strongswan strongswan_plugins_unbound
-
 # Benda Xu <heroxbd@gentoo.org> (2015-01-03)
 # not tested
 app-i18n/scim-anthy kasumi
@@ -403,9 +382,8 @@ mail-filter/opendkim opendbx stats
 >=media-sound/easytag-2.2.0 opus test
 
 # Yixun Lan <dlan@gentoo.org> (2014-04-12)
-# app-emulation/qemu is not keyworded on arm arch.
 # app-text/pandoc is not keyworded on arm arch.
-app-emulation/xen-tools system-qemu doc
+app-emulation/xen-tools doc
 
 # Markus Meier <maekke@gentoo.org> (2013-12-26)
 # Unkeyworded deps, bug #488724
@@ -419,18 +397,10 @@ net-im/telepathy-connection-managers sipe
 # Missing keywords, bug #478254
 gnome-base/gnome classic extras
 
-# Markus Meier <maekke@gentoo.org> (2013-09-15)
-# Unkeyworded deps, bug #481462
-dev-python/ipython nbconvert
-
 # Sergey Popov <pinkbyte@gentoo.org> (2013-09-06)
 # sci-libs/hdf does not build properly on arm
 dev-perl/PDL hdf
 
-# Michael Weber <xmw@gentoo.org> (2013-08-23)
-# Unkeyworded deps
-media-gfx/fim graphicsmagick svg
-
 # Markus Meier <maekke@gentoo.org> (2013-08-04)
 # Unkeyworded deps, bug #474026
 app-admin/conky cmus irc lua-cairo lua-imlib lua-rsvg moc xmms2
@@ -453,7 +423,7 @@ dev-libs/xapian-bindings java
 
 # Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org> (2013-02-20)
 # Mask flags of calligra and dependencies due to lack of keywords
-app-office/calligra openexr spacenav
+app-office/calligra spacenav
 media-gfx/pstoedit emf
 
 # Rick Farina <zerochaos@gentoo.org> (2013-02-05)
@@ -466,7 +436,6 @@ media-libs/libjpeg-turbo java
 net-dns/libidn java
 net-misc/tigervnc java
 sys-devel/gettext java
-sys-libs/db java
 
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2013-01-22)
 # remove mask if/when media-gfx/argyllcms is keywored here.
@@ -477,10 +446,6 @@ x11-misc/colord argyllcms extra-print-profiles
 # keyworded here. Remove mask if this situation changes.
 gnome-extra/sushi office
 
-# Markus Meier <maekke@gentoo.org> (2012-Dez-25)
-# unkeyworded deps for app-accessibility/speech-dispatcher
-app-accessibility/speech-dispatcher flite
-
 # Markus Meier <maekke@gentoo.org> (2012-12-08)
 # mask app-office/libreoffice java extensions
 app-office/libreoffice libreoffice_extensions_scripting-beanshell libreoffice_extensions_scripting-javascript libreoffice_extensions_wiki-publisher coinmp

sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask

@@ -1,9 +1,22 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Sam James <sam@gentoo.org> (2021-11-20)
-# dev-python/networkx is not yet marked stable on arm*
-app-admin/setools infoflow
+# Sam James <sam@gentoo.org> (2022-01-16)
+# net-libs/gnome-online-accounts is not marked stable on arm yet
+gnome-base/gvfs google
+
+# Sam James <sam@gentoo.org> (2022-01-15)
+# dev-python/nbconvert not yet marked stable on arm
+dev-python/ipython nbconvert
+
+# Sam James <sam@gentoo.org> (2022-01-15)
+# dev-libs/criterion is not marked stable yet
+app-admin/syslog-ng test
+
+# Sam James <sam@gentoo.org> (2022-01-15)
+# Requires dev-util/pahole which is not yet marked stable on arm.
+sys-kernel/gentoo-kernel debug
+sys-kernel/vanilla-kernel debug
 
 # Sam James <sam@gentoo.org> (2021-10-25)
 # Various dependencies not yet stable on arm
@@ -20,11 +33,6 @@ app-text/htmltidy test
 # large amount of fabric. bug #763954
 sys-block/open-iscsi infiniband
 
-# Sam James <sam@gentoo.org> (2021-02-09)
-# dev-libs/libgdata is not (yet?) stable on arm
-# bug #769767, bug #769764
-mail-client/claws-mail gdata
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2020-10-05)
 # media-libs/libffado is not stable yet, which itself has unstable and
 # unmaintained/broken dependencies. bug #746722
@@ -51,17 +59,13 @@ net-misc/unison gtk
 sci-mathematics/z3 java
 media-libs/portmidi java
 
-# Mart Raudsepp <leio@gentoo.org> (2019-08-27)
-# Missing stable net-libs/webkit-gtk
-dev-util/glade webkit
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2019-02-10)
 # Needs kde-frameworks/{kwallet,ki18n,kconfig} stable
 dev-vcs/subversion kwallet
 net-libs/libproxy kde
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2019-02-10)
-# Needs kde-plasma/{polkit-kde-agent,plasma-workspace stable
+# Needs kde-plasma/{polkit-kde-agent,plasma-workspace} stable
 sys-auth/polkit kde
 virtual/notification-daemon kde
 
@@ -69,10 +73,6 @@ virtual/notification-daemon kde
 # media-libs/libmtp stabilisation timeout, bug #661162
 gnome-base/gvfs mtp
 
-# Ulrich Müller <ulm@gentoo.org> (2018-08-09)
-# Needs net-libs/webkit-gtk which is not stable, bug #663248
-app-editors/emacs xwidgets
-
 # Akinori Hattori <hattya@gentoo.org> (2018-06-23)
 # No stable Java
 dev-db/qdbm java
@@ -148,11 +148,6 @@ net-misc/networkmanager teamd
 # Missing stable, bug #529462
 media-gfx/graphviz java
 
-# Markus Meier <maekke@gentoo.org> (2015-07-30)
-# Missing stable
-x11-libs/wxGTK webkit
-dev-python/wxpython webkit
-
 # Markus Meier <maekke@gentoo.org> (2015-07-19)
 # Missing stable
 media-libs/gegl umfpack
@@ -160,9 +155,3 @@ media-libs/gegl umfpack
 # Pacho Ramos <pacho@gentoo.org> (2015-06-02)
 # Missing stable
 net-misc/connman l2tp pptp
-
-# Pacho Ramos <pacho@gentoo.org> (2014-07-02)
-# Mask due Gnome3 not going to be stabilized on this arch
-gnome-base/gvfs google
-net-libs/libproxy webkit
->=x11-libs/gtk+-3.12.2 cloudprint

sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -85,7 +85,6 @@ anthy
 # Unmask ARM-only video-cards
 -video_cards_exynos
 -video_cards_freedreno
--video_cards_imx
 -video_cards_lima
 -video_cards_omap
 -video_cards_panfrost

sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.stable.mask

@@ -1,9 +1,17 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in use.mask
 
+# Sam James <sam@gentoo.org> (2022-01-16)
+# net-libs/gnome-online-accounts is not marked stable on arm yet
+gnome-online-accounts
+
+# Sam James <sam@gentoo.org> (2022-01-15)
+# virtual/dist-kernel not yet marked stable here
+dist-kernel
+
 # Sam James <sam@gentoo.org> (2020-12-22)
 # Not yet stable
 lirc
@@ -33,4 +41,3 @@ gcl
 devhelp
 eds
 gdm
-gnome-online-accounts

sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.mask

@@ -1,2 +1,8 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
+# Sam James <sam@gentoo.org> (2022-01-22)
+# Fails to build on arm64.
+# marbling.c:181:44: error: incompatible type for argument 1 of ‘vqdmulhq_s16’
+# bug #830914
+~x11-misc/xscreensaver-6.02

sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask

@@ -1,12 +1,37 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Sam James <sam@gentoo.org> (2022-01-02)
-# sys-fabric/ofed is not keyworded here
-sys-cluster/slurm ofed
+# Matt Turner <mattst88@gentoo.org> (2022-04-18)
+# app-text/nuspell is not keyworded
+app-text/enchant nuspell
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# Untested useflag on other arches, needs keywording
+media-video/ffmpeg vmaf
+
+# Sam James <sam@gentoo.org> (2022-02-26)
+# Supports 64-bit NEON
+>=media-libs/libjpeg-turbo-2.1.3 -cpu_flags_arm_neon
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-01-11)
+# Mask AMF keyword on non-amd64 arches
+# It is unusable, for now, in other arches
+media-video/ffmpeg amf
+
+# Sam James <sam@gentoo.org> (2022-02-02)
+# sys-cluster/knem is not keyworded on arm64
+sys-cluster/openmpi openmpi_fabrics_knem
+
+# Sam James <sam@gentoo.org> (2022-02-01)
+# sys-cluster/ucx is not keyworded on arm64
+sys-cluster/slurm ucx
+
+# Sam James <sam@gentoo.org> (2022-01-22)
+# Supports 64-bit NEON
+dev-libs/libgcrypt -cpu_flags_arm_neon
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-11-16)
-# requires sys-apps/dbus-broker, which keyworded here.
+# requires sys-apps/dbus-broker, which is keyworded here.
 sys-apps/systemd -hostnamed-fallback
 
 # Sam James <sam@gentoo.org> (2021-10-31)
@@ -51,10 +76,6 @@ media-sound/easyeffects zamaudio
 # Note: libpng-compat 1.5.30 does NOT seem to.
 media-libs/libpng -cpu_flags_arm_neon
 
-# Mike Gilbert <floppym@gentoo.org> (2021-03-29)
-# Unmask TPM on supported archs.
-sys-apps/systemd -tpm
-
 # Sam James <sam@gentoo.org> (2021-03-20)
 # Supports both 'neon32' and 'neon64'
 sys-libs/zlib-ng -cpu_flags_arm_neon
@@ -91,6 +112,7 @@ media-sound/bluez-alsa man
 # gnuefi + systemd-boot works on arm64
 # bug #729720
 sys-apps/systemd -gnuefi
+sys-apps/systemd-utils -boot
 
 # Joonas Niilola <juippis@gentoo.org> (2021-01-15)
 # Dependency not keyworded on this arch.
@@ -111,10 +133,6 @@ net-proxy/haproxy device-atlas
 # media-libs/liblastfm fails to build with tests Bug #758896
 media-sound/clementine lastfm
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2020-11-08)
-# dev-util/kdevelop-php is not keyworded, bug #751337
->=kde-apps/umbrello-20.08.3 php
-
 # Sam James <sam@gentoo.org> (2020-10-03)
 # Builds & tests pass on arm64.
 # Available on: amd64, x86, arm{,64}.
@@ -175,10 +193,6 @@ lxqt-base/lxqt-meta archiver
 # static-pie works on arm64, #719444
 sys-libs/glibc -static-pie
 
-# Lars Wendler <polynomial-c@gentoo.org> (2020-04-20)
-# Not keyworded on arm64
-net-misc/whois xcrypt
-
 # Patrick McLean <chutzpah@gentoo.org> (2019-03-26)
 # Some test deps aren't keyworded on arm64
 dev-python/kazoo test
@@ -233,10 +247,6 @@ sys-apps/flashrom jlink-spi
 # dep not keyworded here
 media-gfx/gnome-photos upnp-av
 
-# Aaron Bauman <bman@gentoo.org> (2019-04-08)
-# app-text/dblatex not keyword yet
-net-firewall/nftables doc
-
 # Roy Bamford <neddyseagoon@gentoo.org> (2019-03-11)
 # net-misc/dropbox is binary amd64/x86 only
 kde-apps/kdenetwork-meta dropbox
@@ -302,7 +312,6 @@ dev-cpp/eigen test
 mate-base/mate help
 mate-base/mate-applets-meta appindicator sensors
 mate-extra/caja-extensions gajim
-net-fs/samba dmapi
 sci-libs/gdal armadillo netcdf
 sys-fs/btrfs-progs reiserfs
 www-client/chromium widevine
@@ -318,12 +327,9 @@ dev-ruby/haml test
 # USE=test-full requires USE=pkcs11 that is use.masked.
 net-libs/gnutls test-full
 
-# Mart Raudsepp <leio@gentoo.org> (2018-02-13)
-# USE=dmraid requires sys-fs/dmraid that is not keyworded yet.
-sys-libs/libblockdev dmraid
-
 # Mart Raudsepp <leio@gentoo.org> (2018-02-13)
 # USE=upnp-av requires net-misc/dleyna-server that is not keyworded yet.
+media-sound/rhythmbox upnp-av
 >=media-plugins/grilo-plugins-0.3.5 upnp-av
 
 # Mart Raudsepp <leio@gentoo.org> (2018-02-13)
@@ -392,7 +398,6 @@ net-libs/libpcap bluetooth
 # Not yet tested features/dependencies
 app-text/evince dvi nautilus postscript t1lib xps
 net-wireless/blueman appindicator
-x11-libs/gtk+ cloudprint
 
 # Markus Meier <maekke@gentoo.org> (2013-12-26)
 # Unkeyworded deps, bug #488724
@@ -402,10 +407,6 @@ app-office/gnumeric libgda
 # Missing keywords, bug #492820
 net-im/telepathy-connection-managers sipe
 
-# Pacho Ramos <pacho@gentoo.org> (2013-10-31)
-# Missing keywords, bug #478254
-gnome-base/gnome classic
-
 # Sergey Popov <pinkbyte@gentoo.org> (2013-09-06)
 # sci-libs/hdf does not build properly on arm
 dev-perl/PDL hdf

sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.stable.mask

@@ -1,15 +1,20 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2022-03-07)
+# sys-cluster/torque not marked stable on arm64
+# nor is sys-cluster/slurm yet
+sys-cluster/openmpi openmpi_rm_pbs openmpi_rm_slurm
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2022-03-03)
+# dev-util/kdevelop-php is not yet stable, bug #834530
+<kde-apps/umbrello-21.11.80 php
+
 # Michał Górny <mgorny@gentoo.org> (2021-12-31)
 # Don't apply stable masks to python-exec since we're forcing every
 # impl there anyway. Please keep this in sync with use.stable.mask.
 dev-lang/python-exec -python_targets_pypy3
 
-# Sam James <sam@gentoo.org> (2021-11-20)
-# dev-python/networkx is not yet marked stable on arm*
-app-admin/setools infoflow
-
 # Sam James <sam@gentoo.org> (2021-10-25)
 # Has unstable dependencies we don't want to drag in yet
 # bug #816981
@@ -74,20 +79,11 @@ media-sound/jack2 ieee1394
 app-emulation/qemu smartcard rbd xen virgl
 app-emulation/qemu glusterfs io-uring
 app-emulation/spice smartcard
-
-# Sam James <sam@gentoo.org> (2020-07-30)
-# glslang is not yet stable on arm64
-media-libs/mesa vulkan-overlay
-
-# Sam James <sam@gentoo.org> (2020-07-16)
-# Needs unstable dev-python/networkx
-# bug #732492
-app-portage/nattka depgraph-order
+net-misc/spice-gtk smartcard
 
 # Sam James <sam@gentoo.org> (2020-06-29)
 # Deps not yet stable
 dev-python/pymongo test
-app-shells/bash-completion test
 net-misc/ntpsec rclock_oncore rclock_pps
 dev-util/bcc test
 dev-libs/libisoburn launch-frontend launch-frontend-setuid frontend-optional

sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask

@@ -1,9 +1,17 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -arm64
 
+# David Seifert <soap@gentoo.org> (2022-03-13)
+# NVENC works here
+-nvenc
+
+# Ionen Wolkens <ionen@gentoo.org> (2022-02-17)
+# x11-drivers/nvidia-drivers' binary blob works here
+-video_cards_nvidia
+
 # Michał Górny <mgorny@gentoo.org> (2021-01-07)
 # Prebuilt kernels are supported here.
 -dist-kernel
@@ -110,7 +118,6 @@ anthy
 -video_cards_exynos
 -video_cards_freedreno
 -video_cards_lima
--video_cards_imx
 -video_cards_nouveau
 -video_cards_panfrost
 -video_cards_tegra

sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.stable.mask

@@ -1,14 +1,13 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 #
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in use.mask
 
-# Sam James <sam@gentoo.org> (2020-12-23)
-# dev-lang/luajit is not yet stable
-lua_single_target_luajit
-lua_targets_luajit
-luajit
+# Ionen Wolkens <ionen@gentoo.org> (2022-02-17)
+# x11-drivers/nvidia-drivers is not stable yet
+video_cards_nvidia
+nvenc
 
 # Sam James <sam@gentoo.org> (2020-10-08)
 # Not enough packages stable w/ PyPy3 support

sdk_container/src/third_party/portage-stable/profiles/arch/base/make.defaults

@@ -1,8 +1,8 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 USE_EXPAND_UNPREFIXED="ARCH"
 USE_EXPAND_IMPLICIT="ARCH"
-USE_EXPAND_VALUES_ARCH="alpha amd64 amd64-fbsd amd64-linux arm arm64 arm64-macos hppa ia64 m68k mips ppc ppc64 ppc64-linux ppc-macos riscv s390 sparc sparc64-solaris sparc-solaris x64-cygwin x64-macos x64-solaris x64-winnt x86 x86-fbsd x86-linux x86-solaris x86-winnt"
+USE_EXPAND_VALUES_ARCH="alpha amd64 amd64-linux arm arm64 arm64-macos hppa ia64 loong m68k mips ppc ppc64 ppc64-linux ppc-macos riscv s390 sparc sparc64-solaris sparc-solaris x64-cygwin x64-macos x64-solaris x64-winnt x86 x86-linux x86-solaris x86-winnt"
 
 PROFILE_ONLY_VARIABLES="${PROFILE_ONLY_VARIABLES} ARCH USE_EXPAND_VALUES_ARCH"

sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask

@@ -1,6 +1,21 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# WANG Xuerui <xen0n@gentoo.org> (2022-04-24)
+# This is only for bringing in the not-upstreamed-yet LoongArch patchset;
+# masked everywhere in order to minimize impact on other arches.
+# In the meantime, force-enable on loong only.
+# This is not inside use.mask, because crossdev toolchain packages would
+# want to have the flag enabled without hassle.
+dev-libs/libffi experimental-loong
+sys-kernel/linux-headers experimental-loong
+sys-libs/glibc experimental-loong
+sys-libs/libseccomp experimental-loong
+
+# James Le Cuirot <chewi@gentoo.org> (2022-02-24)
+# These GRUB platforms are only for MIPS.
+sys-boot/grub grub_platforms_loongson grub_platforms_qemu-mips
+
 # Sam James <sam@gentoo.org> (2021-11-15)
 # Only available on PPC*.
 sys-apps/util-linux rtas
@@ -39,10 +54,6 @@ x11-wm/mutter video_cards_nvidia
 # Has unpackaged depdencies, bug #795459
 >=media-libs/opencolorio-2.0.0 doc
 
-# Mike Gilbert <floppym@gentoo.org> (2021-03-29)
-# TPM only exists on some archs.
-sys-apps/systemd tpm
-
 # Michael Orlitzky <mjo@gentoo.org> (2021-03-27)
 # The clozurecl and clozurecl64 flags are now arch-specific in maxima,
 # so we mask them both by default beginning with v5.44.0-r5 where
@@ -112,17 +123,6 @@ app-metrics/collectd collectd_plugins_slurm
 # https://sourceware.org/glibc/wiki/PortStatus
 sys-libs/glibc static-pie
 
-# Mart Raudsepp <leio@gentoo.org> (2020-03-01)
-# dev-util/sysprof not keyworded on most arches yet
-x11-wm/mutter sysprof
-dev-libs/gjs sysprof
-dev-libs/glib sysprof
-gnome-extra/cjs sysprof
-x11-libs/gtk+ sysprof
-net-libs/libsoup sysprof
-x11-libs/pango sysprof
-gui-libs/gtk sysprof
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2020-02-26)
 # Vulkan support is only available on few selected arches atm.
 # Mask everywhere, unmask where appropriate.
@@ -286,6 +286,7 @@ media-video/ffmpeg-chromium mmal
 # Mike Gilbert <floppym@gentoo.org> (2015-09-05)
 # sys-boot/gnu-efi is not supported on all archs.
 sys-apps/systemd gnuefi
+sys-apps/systemd-utils boot
 
 # Ben de Groot <yngwin@gentoo.org> (2015-03-15)
 # Mask bdplus support and unmask on arches where libbdplus is keyworded.
@@ -299,10 +300,6 @@ dev-db/mariadb tokudb
 # Not working on 64bit systems
 media-sound/lmms vst
 
-# Alexey Shvetsov <alexxy@gentoo.org> (2014-04-16)
-# libehca only works on ppc*
-sys-fabric/ofed ofed_drivers_ehca
-
 # Andreas K. Huettel <dilfridge@gentoo.org> (2014-01-04)
 # Mask until dependencies are keyworded (bug 497068)
 dev-vcs/git mediawiki mediawiki-experimental
@@ -341,6 +338,7 @@ app-arch/zpaq jit
 # webrtc-audio-processing is only supported on x86/amd64. Possibly arm can be
 # added.
 media-sound/pulseaudio webrtc-aec
+media-sound/pulseaudio-daemon webrtc-aec
 
 # Christoph Junghans <junghans@gentoo.org> (2012-02-04)
 # mips only use flags

sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Michał Górny <mgorny@gentoo.org> (2021-01-07)
@@ -27,8 +27,9 @@ oci8
 # cilk has been ported only to x86 systems
 cilk
 
-# cuda only works on amd64/x86
+# cuda/NVENC only works on amd64/arm64
 cuda
+nvenc
 
 # masking here, and unmasking in arch/x86/use.mask
 vidix
@@ -141,7 +142,6 @@ video_cards_siliconmotion
 # not needed on non-arm systems
 video_cards_exynos
 video_cards_freedreno
-video_cards_imx
 video_cards_lima
 video_cards_omap
 video_cards_panfrost
@@ -164,10 +164,6 @@ input_devices_wacom
 # Only works on x86 or amd64
 lcd_devices_luise
 
-# Alex Legler <a3li@gentoo.org> (2009-12-07)
-# Rubinius is whitelisted on supported arches
-ruby_targets_rbx
-
 # Samuli Suominen <ssuominen@gentoo.org> (2011-10-03)
 # RealMagic Hollywood+/Creative DXR3 support
 # Still using obsolete V4L1 wrt bug 350211
@@ -197,8 +193,6 @@ abi_x86_x32
 abi_mips_o32
 abi_mips_n32
 abi_mips_n64
-abi_ppc_32
-abi_ppc_64
 abi_s390_32
 abi_s390_64
 
@@ -223,11 +217,11 @@ apparmor
 # Mask flags that correspond to all possible ARCH values.
 alpha
 amd64
-amd64-fbsd
 arm
 arm64
 hppa
 ia64
+loong
 m68k
 mips
 ppc
@@ -236,4 +230,3 @@ riscv
 s390
 sparc
 x86
-x86-fbsd

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/make.defaults

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 ARCH="hppa"
@@ -10,8 +10,6 @@ CXXFLAGS="${CFLAGS}"
 
 FEATURES="sandbox sfperms strict"
 
-USE="cups foomaticdb fortran gdbm gpm imlib libwww spell firefox"
-
 # Michał Górny <mgorny@gentoo.org> (2014-07-01)
 # Set ABI & DEFAULT_ABI consistently with ${ARCH}, to make ebuild
 # checks simpler.

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force

@@ -0,0 +1,6 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Sam James <sam@gentoo.org> (2022-02-19)
+# New enough SpiderMonkey not keyworded here, bug #753221
+sys-auth/polkit duktape

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask

@@ -4,9 +4,51 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
+# Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
+# Dependencies are missing keywords
+media-libs/imlib2 svg heif jpegxl
+
+# Sam James <sam@gentoo.org> (2022-04-24)
+# Requires dev-util/pahole.
+sys-kernel/gentoo-kernel debug
+sys-kernel/vanilla-kernel debug
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-18)
+# app-text/nuspell is not keyworded
+app-text/enchant nuspell
+
+# Lars Wendler <polynomial-c@gentoo.org> (2022-04-01)
+# gnome-base/librsvg missing keywords
+media-libs/freetype svg
+
+# Sam James <sam@gentoo.org> (2022-03-26)
+# media-libs/libjxl not keyworded here
+media-gfx/graphicsmagick jpegxl
+
+# Sam James <sam@gentoo.org> (2022-03-22)
+# media-libs/dav1d not keyworded here
+media-libs/xine-lib dav1d
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# Untested useflag on other arches, needs keywording
+media-video/ffmpeg vmaf
+
+# Sam James <sam@gentoo.org> (2022-03-06)
+# Unkeyworded dependencies
+net-mail/cyrus-imapd http
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-02-17)
+# Mask AMF keyword on non-amd64 arches
+# It is unusable, for now, in other arches
+media-video/ffmpeg amf
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2022-02-08)
+# bash becomes corrupted and system breaks, bug #832946
+app-shells/bash mem-scramble
+
+# Sam James <sam@gentoo.org> (2022-01-29)
+# app-text/ronn-ng not keyworded here, bug #801103
+app-accessibility/espeak-ng man
 
 # Sam James <sam@gentoo.org> (2021-11-19)
 # Avoid dragging in doc/sphinx deps where we can help it
@@ -39,10 +81,6 @@ dev-python/argon2-cffi doc
 # bug #807616
 media-libs/libsdl2 pipewire
 
-# Sam James <sam@gentoo.org> (2021-10-16)
-# Avoid unkeyworded dependencies
-x11-libs/gtk+ cloudprint
-
 # Sam James <sam@gentoo.org> (2021-09-14)
 # fdk-aac, libfreeaptx not keyworded here
 # nor is jack2
@@ -78,6 +116,7 @@ media-libs/rubberband jni
 # media-libs/libheif isn't keyworded here
 # media-libs/libavif isn't keyworded here
 media-libs/gd avif heif
+media-gfx/graphicsmagick heif
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-01-19)
 # uchardet not stable/keyworded yet on this arch
@@ -116,10 +155,6 @@ sys-block/fio -io-uring -zbc
 # Requires dev-python/networkx.
 app-portage/nattka depgraph-order
 
-# Michał Górny <mgorny@gentoo.org> (2020-05-03)
-# Requires unsupported dev-python/gevent.
-dev-python/socketpool eventlet gevent
-
 # Rolf Eike Beer <eike@sf-mail.de> (2020-04-25)
 # dependencies not yet keyworded
 dev-ruby/activemodel test
@@ -134,10 +169,6 @@ dev-python/pyopengl test
 # dev-libs/criterion not yet keyworded
 >=app-admin/syslog-ng-3.25 test
 
-# Rolf Eike Beer <eike@sf-mail.de> (2020-04-20)
-# Not keyworded on hppa
-net-misc/whois xcrypt
-
 # Rolf Eike Beer <eike@sf-mail.de> (2020-04-18)
 # nagios and icinga not stable on hppa
 sys-libs/freeipmi nagios
@@ -231,15 +262,6 @@ sys-libs/glibc systemtap
 # Requires java
 app-forensics/sleuthkit java
 
-# Michał Górny <mgorny@gentoo.org> (2017-08-08)
-# Requires USE=seccomp that is masked in this profile.
-net-libs/gnutls test-full
-
-# Michał Górny <mgorny@gentoo.org> (2017-06-28)
-# app-misc/dtach is not keyworded, and tests are restricted anyway, so
-# no point in pursuing it right now.
-app-shells/bash-completion test
-
 # Jeroen Roovers <jer@gentoo.org> (2017-02-04)
 # media-libs/libilbc has not been ported to HPPA
 # media-libs/zimg triggers a toolchain issue (bug #597152)
@@ -336,6 +358,7 @@ dev-libs/libpcre jit
 # Jeroen Roovers <jer@gentoo.org> (2014-02-18)
 # OSS is the only kernel audio interface that works on HPPA
 media-sound/pulseaudio equalizer -oss
+media-sound/pulseaudio-daemon equalizer -oss
 
 # Jeroen Roovers <jer@gentoo.org> (2012-05-21)
 # media-sound/lilypond has problems running mpost (bug #416961)

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # When you add an entry to the top of this file, add your name, the date, and
@@ -17,6 +17,23 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2022-02-02)
+# net-analyzer/net-snmp is not marked stable on HPPA
+net-analyzer/ifstat snmp
+sys-libs/openipmi snmp
+
+# Sam James <sam@gentoo.org> (2022-02-01)
+# Unstable Tcl/Tk dependencies
+dev-libs/libisoburn launch-frontend launch-frontend-setuid frontend-optional
+
+# Sam James <sam@gentoo.org> (2022-01-26)
+# Various unstable dependencies
+sys-apps/systemd fido2 http nat policykit qrcode xkb
+
+# Sam James <sam@gentoo.org> (2022-01-20)
+# net-misc/pps-tools is not marked stable on HPPA
+net-misc/chrony pps
+
 # Sam James <sam@gentoo.org> (2021-12-15)
 # Unstable dependencies (dev-libs/libnl, sys-cluster/rdma-core)
 net-libs/libpcap netlink rdma
@@ -81,11 +98,6 @@ sys-apps/iproute2 atm bpf iptables
 # dev-libs/libzip does not have stable keywords on hppa
 >=media-gfx/imagemagick-7 zip
 
-# Matt Turner <mattst88@gentoo.org> (2021-06-02)
-# dev-util/gi-docgen does not have stable keywords on hppa
-x11-libs/gdk-pixbuf gtk-doc
-x11-libs/pango gtk-doc
-
 # Sam James <sam@gentoo.org> (2021-06-01)
 # sys-apps/systemd is not stable on hppa
 sys-auth/pambase homed
@@ -218,7 +230,6 @@ dev-lang/php enchant
 # Andreas Sturmlechner <asturm@gentoo.org> (2019-06-05)
 # sys-auth/polkit stable timeout, bug #661470
 sys-apps/pcsc-lite policykit
-x11-misc/colord policykit
 
 # Sergei Trofimovich <slyfox@gentoo.org> (2019-03-17)
 # net-analyzer/nagios (or icinga) has no stable keywords, bug #676222

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -7,6 +7,10 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Matt Turner <mattst88gentoo.org> (2022-02-21)
+# app-crypt/tpm2-tss is not keyworded here
+tpm
+
 # Sam James <sam@gentoo.org> (2021-10-16)
 # media-libs/openexr is not keyworded.
 openexr
@@ -143,10 +147,6 @@ prelude
 # Lots of untested dependencies (bug #365451)
 facedetect
 
-# Jeroen Roovers <jer@gentoo.org> (2011-05-02)
-# No support for CUDA on HPPA
-cuda
-
 # Samuli Suominen <ssuominen@gentoo.org> (2010-12-25)
 # This will need stable gnome-base/gvfs.
 thunar
@@ -256,10 +256,6 @@ ieee1394
 # mono is not yet supported on hppa
 mono
 
-# Guy Martin <gmsoft@gentoo.org> (2005-02-18)
-# No emboss support on hppa for now
-emboss
-
 # Guy Martin <gmsoft@gentoo.org> (2004-08-08)
 # Wifi stuff not test yet because of lack of hardware
 wifi

sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 #
 # This file requires eapi 5 or later. New entries go on top.
@@ -122,10 +122,6 @@ pulseaudio
 # sys-auth/elogind is not stable here.
 elogind
 
-# Sergei Trofimovich <slyfox@gentoo.org> (2019-03-03)
-# No stable sys-apps/systemd on hppa.
-systemd
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2018-05-20)
 openal
 

sdk_container/src/third_party/portage-stable/profiles/arch/ia64/make.defaults

@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 ARCH="ia64"
@@ -26,6 +26,6 @@ CHOST_ia64="${CHOST}"
 
 # Donnie Berkholz <dberkholz@gentoo.org> (2006-08-18)
 # Defaults for video drivers
-#VIDEO_CARDS="fbdev glint mga nv r128 radeon"
+#VIDEO_CARDS="fbdev mga nv r128 radeon"
 INPUT_DEVICES="void"
 VIDEO_CARDS="dummy"

sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.force

@@ -1,6 +1,10 @@
-# Copyright 1999-2015 Gentoo Foundation
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2022-02-19)
+# New enough SpiderMonkey not keyworded here, bug #753221
+sys-auth/polkit duktape
+
 # Raúl Porcel <armin76@gentoo.org> (2007-10-21)
 # It segfaults without debug use-flags
 # Remove when http://bugs.php.net/bug.php?id=42893 is fixed

sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask

@@ -1,14 +1,47 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Vadim Misbakh-Soloviov <mva@gentoo.org> (2021-12-09)
-# ts-cli requires rust to be built, and rust is unavailable here ATM.
-dev-libs/tree-sitter ts-cli
+# Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
+# Dependencies are missing keywords
+media-libs/imlib2 svg heif jpegxl
+media-gfx/graphicsmagick jpegxl
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-18)
+# app-text/nuspell is not keyworded
+app-text/enchant nuspell
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-16)
+# net-misc/freerdp is not keyworded
+dev-libs/weston rdp
+
+# Matt Turner <mattst88@gentoo.org> (2022-04-16)
+# sys-auth/seatd is not keyworded
+dev-libs/weston seatd
+
+# Lars Wendler <polynomial-c@gentoo.org> (2022-04-01)
+# gnome-base/librsvg missing keywords
+media-libs/freetype svg
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
+# Untested useflag on other arches, needs keywording
+media-video/ffmpeg vmaf
+
+# Sam James <sam@gentoo.org> (2022-03-06)
+# Unkeyworded dependencies
+net-mail/cyrus-imapd http
+
+# Adel Kara Slimane <adel.ks@zegrapher.com> (2022-01-11)
+# Mask AMF keyword on non-amd64 arches
+# It is unusable, for now, in other arches
+media-video/ffmpeg amf
+
+# Sam James <sam@gentoo.org> (2022-01-29)
+# app-text/ronn-ng not keyworded here, bug #801103
+app-accessibility/espeak-ng man
 
 # Michał Górny <mgorny@gentoo.org> (2021-11-26)
 # These package flags require dev-python/cryptography which -- due
 # to the dependency on Rust -- is no longer portable to ia64.
-dev-python/passlib totp
 dev-python/twisted conch crypt
 dev-python/urllib3 test
 net-fs/samba addc addns ads
@@ -35,6 +68,7 @@ media-libs/libsdl2 pipewire
 # Sam James <sam@gentoo.org> (2021-10-17)
 # media-libs/libheif not keyworded here
 sci-libs/gdal heif
+media-gfx/graphicsmagick heif
 
 # Sam James <sam@gentoo.org> (2021-09-14)
 # JACK2 isn't keyworded here
@@ -73,6 +107,7 @@ media-libs/rubberband jni
 # media-libs/libheif isn't keyworded here
 # media-libs/libavif isn't keyworded here
 media-libs/gd avif heif
+media-gfx/graphicsmagick heif
 
 # Akinori Hattori <hattya@gentoo.org> (2021-03-03)
 # dev-lang/ruby is not keyworded
@@ -125,18 +160,10 @@ media-gfx/inkscape cdr visio
 # Requires media-libs/mesa[llvm], which is masked.
 dev-python/pyopengl test
 
-# Lars Wendler <polynomial-c@gentoo.org> (2020-04-20)
-# Not keyworded on ia64
-net-misc/whois xcrypt
-
 # Mikle Kolyada <zlogene@gentoo.org> (2020-04-20)
 # dev-lang/ruby is not keyworded (a dep)
 app-text/texlive context l10n_ja
 
-# Michał Górny <mgorny@gentoo.org> (2020-04-13)
-# Requires unsupported dev-python/gevent.
-dev-python/socketpool eventlet gevent
-
 # Sergei Trofimovich <slyfox@gentoo.org> (2020-04-12)
 # ruby-2.7 dropped ia64 support, mask dependencies requiring ruby.
 # These pull in:
@@ -263,6 +290,7 @@ media-video/ffmpeg libv4l
 # Michał Górny <mgorny@gentoo.org> (2017-08-07)
 # Requires USE=bluetooth that is masked in this profile.
 media-sound/pulseaudio native-headset
+media-sound/pulseaudio-daemon native-headset
 
 # Sergei Trofimovich <slyfox@gentoo.org> (2017-07-20)
 # pulls in unkeyworded java
@@ -272,11 +300,6 @@ sci-libs/gdal mdb
 # pulls in unkeyworded lapack
 sci-libs/gdal armadillo
 
-# Michał Górny <mgorny@gentoo.org> (2017-06-28)
-# app-misc/dtach is not keyworded, and tests are restricted anyway, so
-# no point in pursuing it right now.
-app-shells/bash-completion test
-
 # Sergei Trofimovich <slyfox@gentoo.org> (2017-06-17)
 # Pulls in dev-db/redis which is not keyworded on ia64.
 mail-filter/pyzor test
@@ -364,10 +387,12 @@ net-misc/networkmanager wext
 # Pacho Ramos <pacho@gentoo.org> (2015-09-06)
 # Missing keywords
 media-sound/pulseaudio ofono-headset
+media-sound/pulseaudio-daemon ofono-headset
 
 # Mike Gilbert <floppym@gentoo.org> (2015-09-05)
 # sys-boot/gnu-efi is not supported on all archs.
 sys-apps/systemd -gnuefi
+sys-apps/systemd-utils -boot
 
 # Pacho Ramos <pacho@gentoo.org> (2015-06-13)
 # Missing keywords, bug #513108
@@ -462,7 +487,7 @@ x11-misc/xscreensaver new-login
 
 # Alexey Shvetsov <alexxy@gentoo.org> (2011-12-17)
 # Mask use numa for openmpi
-sys-cluster/openmpi openmpi_fabrics_psm openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_fabrics_dapl openmpi_rm_slurm openmpi_fabrics_sctp openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_connectx-xrc openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl openmpi_ofed_features_failover
+sys-cluster/openmpi openmpi_fabrics_knem openmpi_fabrics_ofed openmpi_rm_slurm openmpi_ofed_features_rdmacm openmpi_ofed_features_control-hdr-padding openmpi_ofed_features_udcm openmpi_ofed_features_dynamic-sl
 
 # Raúl Porcel <armin76@gentoo.org> (2011-11-05)
 # jit not supported on ia64

sdk_container/src/third_party/portage-stable/profiles/arch/ia64/use.mask

@@ -1,14 +1,18 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -ia64
 
+# Matt Turner <mattst88@gentoo.org> (2022-02-21)
+# app-crypt/tpm2-tss is not keyworded here
+tpm
+
 # James Le Cuirot <chewi@gentoo.org> (2021-08-10)
 # media-video/pipewire is not keyworded. Bug #807616.
 pipewire
 
-# Matt Turner <mattst88@gentoo.org> (07-25-2021)
+# Matt Turner <mattst88@gentoo.org> (2021-07-25)
 # gnome-shell requires rustified librsvg.
 gnome-shell
 
@@ -72,7 +76,6 @@ lm-sensors
 # Stuff that doesn't work on ia64, or not tested
 afs
 djbfft
-emboss
 jack
 lqr
 capi
@@ -179,10 +182,6 @@ alsa_cards_wavefront
 # media-sound/fluidsynth isn't keyworded
 fluidsynth
 
-# Anthony G. Basile <blueness@gentoo.org> (2012-04-15)
-# Pulls in net-libs/axtls which is not keyworded for arch
-curl_ssl_axtls
-
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
 # net-misc/connman is not keyworded, bug 348308
 connman

sdk_container/src/third_party/portage-stable/profiles/arch/loong/eapi

@@ -0,0 +1 @@
+5

sdk_container/src/third_party/portage-stable/profiles/arch/loong/la64v100/lp64d/eapi

@@ -0,0 +1 @@
+5

sdk_container/src/third_party/portage-stable/profiles/arch/loong/la64v100/lp64d/make.defaults

@@ -0,0 +1,21 @@
+# Copyright 2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# LoongArch la64v100/lp64d no-multilib profile
+#
+# la64v100 -- the ISA as defined in LoongArch Reference Manual Volume 1, v1.00.
+
+CHOST="loongarch64-unknown-linux-gnu"
+MULTILIB_ABIS="lp64d"
+DEFAULT_ABI="lp64d"
+ABI="lp64d"
+
+CFLAGS="-O2 -pipe -march=loongarch64 -mabi=lp64d"
+CXXFLAGS="${CFLAGS}"
+FFLAGS="${CFLAGS}"
+FCFLAGS="${CFLAGS}"
+
+# We have only one ABI
+MULTILIB_ABIS="lp64d"
+DEFAULT_ABI="lp64d"
+ABI="lp64d"

sdk_container/src/third_party/portage-stable/profiles/arch/loong/make.defaults

@@ -0,0 +1,52 @@
+# Copyright 2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Main LoongArch profile directory. Common settings for all loong profiles.
+#
+# Subdirectories represent choices for base instruction set; the names come
+# from the "Base Architecture" table, in the *LoongArch Toolchain Conventions*
+# document.
+#
+# https://loongson.github.io/LoongArch-Documentation/LoongArch-toolchain-conventions-EN.html
+
+# This is not a complete profile. Use the subdirectories!
+
+ARCH="loong"
+ACCEPT_KEYWORDS="loong ~loong"
+
+USE_EXPAND_VALUES_ARCH="${USE_EXPAND_VALUES_ARCH} loong"
+
+CFLAGS="-O2 -pipe"
+CXXFLAGS="${CFLAGS}"
+FFLAGS="${CFLAGS}"
+FCFLAGS="${CFLAGS}"
+
+SYMLINK_LIB="no"
+
+# Note about LIBDIR_*:
+#
+# Unlike riscv profiles, LoongArch so far has not defined exact multilib
+# layouts for non-multiarch (i.e. non-Debian-derived) systems; also the ABIs
+# other than LP64D are underdeveloped and likely unusable. So here we only
+# give definitions for lp64d.
+#
+# Should any official spec be revised such that a multilib layout is given,
+# definitions here should be updated to stay compliant.
+
+# Flags for lp64d
+LIBDIR_lp64d="lib64"
+CFLAGS_lp64d="-mabi=lp64d"
+LDFLAGS_lp64d="-m elf64loongarch"
+CHOST_lp64d="loongarch64-unknown-linux-gnu"
+
+# Since many people will want to test this in qemu...
+FEATURES="-pid-sandbox -network-sandbox -ipc-sandbox"
+
+# We need to fetch https git repo (gcc) during bootstrap, before gcc-12.1.0
+# is officially released.
+BOOTSTRAP_USE="${BOOTSTRAP_USE} curl_ssl_openssl ssl"
+
+# The following stuff MUST be defined in subdirs:
+# ABI
+# DEFAULT_ABI
+# MULTILIB_ABIS

sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.mask

@@ -0,0 +1,7 @@
+# Copyright 2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# WANG Xuerui <xen0n@gentoo.org> (2022-05-04)
+# We have no Rust at the moment
+>=dev-python/cryptography-37
+>=gnome-base/librsvg-2.41