diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index 7f5f5df7a6..635b751d19 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -14,10 +14,11 @@ DIST binutils-2.38-patches-4.tar.xz 193852 BLAKE2B 5a83e20008e58464ed563a6817a36
 DIST binutils-2.38.tar.xz 23651408 BLAKE2B 19ede396ec97b88e632aded2f69f4684cc5053109e06c3c4a1934944e3f0ceaa9e4a2604528a440189771f778cb5d75edd510163970eeea31afba87fa256feba SHA512 8bf0b0d193c9c010e0518ee2b2e5a830898af206510992483b427477ed178396cd210235e85fd7bd99a96fc6d5eedbeccbd48317a10f752b7336ada8b2bb826d
 DIST binutils-2.39-patches-6.tar.xz 92380 BLAKE2B 39f490f1134fb0e7dc80924a280d3113efe0ed094ee15de97c42ab751c83d2f5aa7448966d8cbbcde722b2af4999a36c1e5aa2f37ca6d2e3942b97b6d90ff152 SHA512 213cd7a86da83987966675f3195e843d898ca4ff412dfc29fd33ed80adb7bbf80a0b2919cd8e7dd49208c73a621ab7b720970f2259418bdc82ed2a568ff62064
 DIST binutils-2.39.tar.xz 25167756 BLAKE2B ac6a5296c6586d53eaadcbffc5c399a6d79edf72450b9bb8b3525ce525129cef3d2eb90c85ef3bb3270b5a03b0e1ffb8f0b705f028158726f9777ebb8685066f SHA512 68e038f339a8c21faa19a57bbc447a51c817f47c2e06d740847c6e9cc3396c025d35d5369fa8c3f8b70414757c89f0e577939ddc0d70f283182504920f53b0a3
-DIST binutils-2.40-patches-5.tar.xz 293628 BLAKE2B b7ed1d1fbf38b420661f984b9519b3d863da45b2a873773a521310021b0c1d5d7c24c152adb3e8a999d40f5619c0e54962114590ec9528380089977af0c30b74 SHA512 6e6df932b18ca20fe245b3ff8d3d06dbdae4daadaec3b668fa44e086d4e8ff56439681b2d810ebc74173b6348020edacb176e8c3cbf20657cce04297b97f4f83
 DIST binutils-2.40-patches-7.tar.xz 299188 BLAKE2B 170cd2432e0458889b240c3603461d0b4bfa62d5314634b101a629db455d87235ac14ad44c63920b713d5235fa8b73902960df1019153873ef06a33aa7050b4b SHA512 a60da163caee68fe1fa355385d404e8998ebed0e390d50e0713e95334733a8b4e37bc63d522817284c027953e43848dbc98042461a47131fb53bc69203b4ee87
 DIST binutils-2.40.tar.xz 25241484 BLAKE2B 8d799f7c595f878b9af5b17a490021dd8b8300ac2fe0ed8574c012929d22d2d0493e003a3e631a9436e8e712da801779b777c566167fe42b0bde119ffa5ad1c2 SHA512 a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925
 DIST binutils-2.41-patches-2.tar.xz 20288 BLAKE2B 1cc29e868ded12845856c5da567f23798fe3017961ce079325c20f456b837cab11560d896065f70953b0bab55bf565288541579e9c3e0991a87083edf2a85fa5 SHA512 75619a5e17b75d72f9bdd9d5e5ee3b566c94de64410bfc074f1a9bfb9f08db9ecf8be216efa1053263468aa8ec99b8aa3b2b095e63cb95f3566500ac0c3b9432
 DIST binutils-2.41-patches-4.tar.xz 86580 BLAKE2B 32748fd0e81a7e323e9f56f0864f2a1755b8fe1b09c777075e31a292297e365c47b47003f8f1bffacc254ed8dccf1c655b7b13f61da751c9db090e56d819fbb2 SHA512 90dcf38c1ed2ae015eb9de922e946e2be62355bd51276075e7f1c0a06cd52408057c4151a2d2d4c07e33c1d2c5998001cba5509819e5722cce45f70172465ea5
 DIST binutils-2.41-patches-5.tar.xz 95176 BLAKE2B bbc94b3c7d70653a1056afe57a120b6eac9f0c8f51f05e95a1b5f80f2b7ef35e6355d740b49bc1ec2f3a13a838d5210ff4a205aa2bde5a72bc55c12100bce726 SHA512 ad293f97116f71322993f381c1af69fad1719a159f127ff16ddeca62f9b9b62aaf141abfa661985a61e9be7ae0639772148e69293a97364eebbf49182babb691
 DIST binutils-2.41.tar.xz 26765692 BLAKE2B 3bccec2b52f7e82a727121bf2a2e51a6249ba63dcd74c665fd834e858645c912ffd8245d848435288b938852830b482905606f55c40df4061215fd75c52ffc75 SHA512 5df45d0bd6ddabdce4f35878c041e46a92deef01e7dea5facc97fd65cc06b59abc6fba0eb454b68e571c7e14038dc823fe7f2263843e6e627b7444eaf0fe9374
+DIST binutils-2.42-patches-3.tar.xz 34768 BLAKE2B e4bfaf3b42147408a8a3dcb00f50378a6b49aef8e939731a92598680cfbf42dfdf842c3f5bf3458867f79c534eb92385bc64f34f7b1d6462ec4182b5f424fbe5 SHA512 3d75e0684bbfa2cc3fc6dfcb5488ac571db58f1a5833fcc754f231664137001ccb0f2ec750947b8021fa12daf614eb2cd21b598bd962d71a34bb8ea38805850d
+DIST binutils-2.42.tar.xz 27567160 BLAKE2B e67a5c028fba70e70088fd11b38ec8c9c4ed5a019badefda25abeb6275997b16f0891e7ff3424c4b82bbfae92e8992669826920dd53df61cd48469d8f7cd5bd1 SHA512 155f3ba14cd220102f4f29a4f1e5cfee3c48aa03b74603460d05afb73c70d6657a9d87eee6eb88bf13203fe6f31177a5c9addc04384e956e7da8069c8ecd20a6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r5.ebuild
index 1dd8b1bda2..2ca7809134 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.41-r5.ebuild
@@ -32,7 +32,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 #
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r1.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r1.ebuild
index caa14408bc..b00b5196aa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.42-r1.ebuild
@@ -9,7 +9,7 @@ DESCRIPTION="Tools necessary to build programs"
 HOMEPAGE="https://sourceware.org/binutils/"
 
 LICENSE="GPL-3+"
-IUSE="cet doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla zstd"
+IUSE="cet debuginfod doc gold gprofng hardened multitarget +nls pgo +plugins static-libs test vanilla zstd"
 
 # Variables that can be set here  (ignored for live ebuilds)
 # PATCH_VER          - the patchset version
@@ -19,7 +19,7 @@ IUSE="cet doc gold gprofng multitarget +nls pgo +plugins static-libs test vanill
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=5
+PATCH_VER=3
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999* ]]; then
@@ -32,7 +32,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 #
@@ -52,6 +52,9 @@ is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
 RDEPEND="
 	>=sys-devel/binutils-config-3
 	sys-libs/zlib
+	debuginfod? (
+		dev-libs/elfutils[debuginfod(-)]
+	)
 	zstd? ( app-arch/zstd:= )
 "
 DEPEND="${RDEPEND}"
@@ -115,7 +118,10 @@ src_prepare() {
 
 			# This is applied conditionally for now just out of caution.
 			# It should be okay on non-prefix systems though. See bug #892549.
-			use prefix && eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch
+			if is_cross || use prefix; then
+				eapply "${FILESDIR}"/binutils-2.40-linker-search-path.patch \
+					   "${FILESDIR}"/binutils-2.41-linker-prefix.patch
+			fi
 		fi
 	fi
 
@@ -242,30 +248,20 @@ src_configure() {
 		--libdir="${EPREFIX}"${LIBPATH}
 		--libexecdir="${EPREFIX}"${LIBPATH}
 		--includedir="${EPREFIX}"${INCPATH}
+		# portage's econf() does not detect presence of --d-d-t
+		# because it greps only top-level ./configure. But not
+		# libiberty's or bfd's configure.
+		--disable-dependency-tracking
+		--disable-silent-rules
 		--enable-obsolete
 		--enable-shared
 		--enable-threads
-		# Newer versions (>=2.27) offer a configure flag now.
 		--enable-relro
-		# Newer versions (>=2.24) make this an explicit option, bug #497268
 		--enable-install-libiberty
-		# Available from 2.35 on
-		--enable-textrel-check=warning
-
-		# These hardening options are available from 2.39+ but
-		# they unconditionally enable the behaviour even on arches
-		# where e.g. execstacks can't be avoided.
-		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
-		#--enable-warn-execstack
-		#--enable-warn-rwx-segments
-		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
-
+		--enable-textrel-check=$(usex hardened error warning)
 		# Things to think about
 		#--enable-deterministic-archives
-
-		# Works better than vapier's patch, bug #808787
 		--enable-new-dtags
-
 		--disable-jansson
 		--disable-werror
 		--with-bugurl="$(toolchain-binutils_bugurl)"
@@ -275,16 +271,12 @@ src_configure() {
 
 		# Disable modules that are in a combined binutils/gdb tree, bug #490566
 		--disable-{gdb,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
+		# Strip out broken static link flags: https://gcc.gnu.org/PR56750
 		--without-stage1-ldflags
-		# Change SONAME to avoid conflict across
-		# {native,cross}/binutils, binutils-libs. bug #666100
+		# Change SONAME to avoid conflict across {native,cross}/binutils, binutils-libs. bug #666100
 		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
 
-		# Avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
+		$(use_with debuginfod)
 
 		# Avoid automagic dev-libs/msgpack dep, bug #865875
 		--without-msgpack
@@ -303,6 +295,44 @@ src_configure() {
 		$(use_enable gprofng)
 	)
 
+	case ${CTARGET} in
+		x86_64-*|aarch64*|arm64*|i[3456]*)
+			# These hardening options are available from 2.39+ but
+			# they unconditionally enable the behaviour even on arches
+			# where e.g. execstacks can't be avoided.
+			# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
+			#
+			# TODO: Get the logic for this fixed upstream so it doesn't
+			# create impossible broken combinations on some arches, like mips.
+			#
+			# TODO: Get the logic for this fixed upstream so --disable-* works
+			# as expected.
+			myconf+=(
+				--enable-warn-execstack=yes
+				--enable-warn-rwx-segments=yes
+			)
+
+			if use hardened ; then
+				myconf+=(
+					# TOOD: breaks glibc test suite
+					#--enable-error-execstack=yes
+					#--enable-error-rwx-segments=yes
+					--enable-default-execstack=no
+				)
+			fi
+			;;
+		*)
+			;;
+	esac
+
+	if use elibc_musl ; then
+		# Override our earlier setting for musl, as textrels don't
+		# work there at all. See bug #707660.
+		myconf+=(
+			--enable-textrel-check=error
+		)
+	fi
+
 	if ! is_cross ; then
 		myconf+=( $(use_enable pgo pgo-build lto) )
 
@@ -311,7 +341,7 @@ src_configure() {
 		fi
 	fi
 
-	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
 
 	# Prevent makeinfo from running if doc is unset.
 	if ! use doc ; then
@@ -325,11 +355,15 @@ src_compile() {
 	cd "${MY_BUILDDIR}" || die
 
 	# see Note [tooldir hack for ldscripts]
-	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
+	# see linker prefix patch
+	emake \
+		tooldir="${EPREFIX}${TOOLPATH}" \
+		gentoo_prefix=$(usex prefix-guest "${EPREFIX}"/usr /usr) \
+		all
 
 	# only build info pages if the user wants them
 	if use doc ; then
-		emake V=1 info
+		emake info
 	fi
 
 	# we nuke the manpages when we're left with junk
@@ -343,7 +377,7 @@ src_test() {
 	# bug #637066
 	filter-flags -Wall -Wreturn-type
 
-	emake -k V=1 check
+	emake -k check
 }
 
 src_install() {
@@ -352,7 +386,7 @@ src_install() {
 	cd "${MY_BUILDDIR}" || die
 
 	# see Note [tooldir hack for ldscripts]
-	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
+	emake DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
 	rm -rf "${ED}"/${LIBPATH}/bin || die
 	use static-libs || find "${ED}" -name '*.la' -delete
 
@@ -436,6 +470,8 @@ src_install() {
 	# Remove shared info pages
 	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
 
+	docompress "${DATAPATH}"/{info,man}
+
 	# Trim all empty dirs
 	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
index 5f745bd13e..f7eab0eff6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-9999.ebuild
@@ -314,6 +314,9 @@ src_configure() {
 
 			if use hardened ; then
 				myconf+=(
+					# TOOD: breaks glibc test suite
+					#--enable-error-execstack=yes
+					#--enable-error-rwx-segments=yes
 					--enable-default-execstack=no
 				)
 			fi