diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
new file mode 100644
index 0000000000..587b6b33bc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
@@ -0,0 +1,4 @@
+DIST coreutils-8.30-patches-01.tar.xz 5788 BLAKE2B a41511ce39ac570cb14b7f12d125eebef92217469a9490808719fa0665f5e5c0adb96fbd02c4bac4d280d1502295669575790a81dbc01afe2ca3a9d384cbefb0 SHA512 b1e1933637de4581d5f8c6ede4e80a012435d13f0cf5550a76ab5bbe9441e3c15ce19ef3f78a7ea3b8368d5e9a3bb17c1207c471d26171b59786f38adeba0454
+DIST coreutils-8.30.tar.xz 5359532 BLAKE2B b66ccd112a6c2c8b90e58ff1c3371e7f5827937035769329885e5bdae197466189f3715720b8f8cf0b5047fe16d6c86984dcee994117c2d3c7b8dbd597027255 SHA512 25bc132c0d89ce71c33e417f04649c9fcfce6c5ef8b19f093b2e9e2851bfde9b5a31e20499d9c427332228ba54b88d445ddb445551e1944bb8f5cbff5ffa4eda
+DIST coreutils-8.31.tar.xz 5410140 BLAKE2B e3ae6be8edbe9df9164b4c9ac8bf14dc23b147fa665f20669e18ac4c6e45ba839dc0dc99e05670eb006d22133475a4a717a5f40b00ebaedfd6e1fbab887674d5 SHA512 ef8941dae845bbf5ae5838bc49e44554a766302930601aada6fa594e8088f0fbad74e481ee392ff89633e68b99e4da3f761fcb5d31ee3b233d540fe2a2d4e1af
+DIST coreutils-8.32.tar.xz 5547836 BLAKE2B 0ad99c176c19ec214fcfd0845523e5362f0151827707c759bd46c0fe8d2501c6ad1c29c5b71266f6525857bc0d56c472db0d7fe29953b6c65e2e6c76bdf3c515 SHA512 1c8f3584efd61b4b02e7ac5db8e103b63cfb2063432caaf1e64cb2dcc56d8c657d1133bbf10bd41468d6a1f31142e6caa81d16ae68fa3e6e84075c253613a145
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.30.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.30.ebuild
new file mode 100644
index 0000000000..fda25b3b8b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.30.ebuild
@@ -0,0 +1,210 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+PYTHON_COMPAT=( python3_6 )
+
+inherit eutils flag-o-matic python-any-r1 toolchain-funcs
+
+PATCH_VER="01"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
+	mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz
+	https://dev.gentoo.org/~polynomial-c/dist/${P}-patches-${PATCH_VER}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~x86-linux"
+IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test userland_BSD vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	xattr? ( !userland_BSD? ( sys-apps/attr[static-libs] ) )"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )"
+DEPEND="${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+	app-arch/xz-utils
+	test? (
+		dev-lang/perl
+		dev-perl/Expect
+		!userland_BSD? (
+			dev-util/strace
+		)
+		${PYTHON_DEPS}
+		$(python_gen_any_dep 'dev-python/pyinotify[${PYTHON_USEDEP}]')
+	)"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!app-misc/realpath
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4"
+
+python_check_deps() {
+	has_version --host-root "dev-python/pyinotify[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_prepare() {
+	if ! use vanilla ; then
+		eapply "${WORKDIR}"/patch/*.patch
+	fi
+
+	eapply_user
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1}
+
+	# Avoid perl dep for compiled in dircolors default #348642
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h
+		touch ${@/%x/1}
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		--enable-largefile
+		$(usex caps '' --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp)
+	)
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		export fu_cv_sys_stat_statfs2_bsize=yes #311569
+		export gl_cv_func_realpath_works=yes #416629
+	fi
+
+	export gl_cv_func_mknod_works=yes #409919
+	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
+	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
+	use userland_BSD && myconf+=( -program-prefix=g --program-transform-name=s/stat/nustat/ )
+	# kill/uptime - procps
+	# groups/su   - shadow
+	# hostname    - net-tools
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Known to fail with FEATURES=usersandbox (bug #439574):
+	#   -  tests/du/long-from-unreadable.sh} (bug #413621)
+	#   -  tests/rm/deep-2.sh (bug #413621)
+	#   -  tests/dd/no-allocate.sh (bug #629660)
+	if has usersandbox $FEATURES ; then
+		ewarn "You are emerging ${P} with 'usersandbox' enabled." \
+			"Expect some test failures or emerge with 'FEATURES=-usersandbox'!"
+	fi
+
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}"
+	chmod a+rx "${WORKDIR}"
+
+	# coreutils tests like to do `mount` and such with temp dirs
+	# so make sure /etc/mtab is writable #265725
+	# make sure /dev/loop* can be mounted #269758
+	mkdir -p "${T}"/mount-wrappers
+	mkwrap() {
+		local w ww
+		for w in "$@" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P $w) "\$@"
+			EOF
+			chmod a+rx "${ww}"
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+	#export RUN_EXPENSIVE_TESTS="yes"
+	#export FETISH_GROUPS="portage wheel"
+	env PATH="${T}/mount-wrappers:${PATH}" \
+	emake -j1 -k check
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if [[ ${USERLAND} == "GNU" ]] ; then
+		cd "${ED%/}"/usr/bin || die
+		dodir /bin
+		# move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "could not move fhs bins"
+		if use hostname; then
+			mv hostname ../../bin/ || die
+		fi
+		if use kill; then
+			mv kill ../../bin/ || die
+		fi
+		if use split-usr ; then
+			# move critical binaries into /bin (common scripts)
+			local com="basename chroot cut dir dirname du env expr head mkfifo
+			           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+			mv ${com} ../../bin/ || die "could not move common bins"
+			# create a symlink for uname in /usr/bin/ since autotools require it
+			local x
+			for x in ${com} uname ; do
+				dosym ../../bin/${x} /usr/bin/${x}
+			done
+		fi
+	else
+		# For now, drop the man pages, collides with the ones of the system.
+		rm -rf "${ED%/}"/usr/share/man
+	fi
+
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+
+	# Help out users using experimental filesystems
+	if grep -qs btrfs "${EROOT%/}"/etc/fstab /proc/mounts ; then
+		case $(uname -r) in
+		2.6.[12][0-9]|2.6.3[0-7]*)
+			ewarn "You are running a system with a buggy btrfs driver."
+			ewarn "Please upgrade your kernel to avoid silent corruption."
+			ewarn "See: https://bugs.gentoo.org/353907"
+			;;
+		esac
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.31-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.31-r1.ebuild
new file mode 100644
index 0000000000..57d93329c4
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.31-r1.ebuild
@@ -0,0 +1,190 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+PYTHON_COMPAT=( python3_{6,7} )
+
+inherit eutils flag-o-matic python-any-r1 toolchain-funcs
+
+PATCH="${PN}-8.30-patches-01"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
+	mirror://gentoo/${PATCH}.tar.xz
+	https://dev.gentoo.org/~polynomial-c/dist/${PATCH}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x86-linux"
+IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )"
+DEPEND="${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+	app-arch/xz-utils
+	test? (
+		dev-lang/perl
+		dev-perl/Expect
+		dev-util/strace
+		${PYTHON_DEPS}
+	)"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!app-misc/realpath
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4"
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_prepare() {
+	if ! use vanilla ; then
+		eapply "${WORKDIR}"/patch/*.patch
+		eapply "${FILESDIR}"/${PN}-8.31-sandbox-env-test.patch
+	fi
+
+	eapply_user
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1}
+
+	# Avoid perl dep for compiled in dircolors default #348642
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h
+		touch ${@/%x/1}
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		--enable-largefile
+		$(usex caps '' --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp)
+	)
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		export fu_cv_sys_stat_statfs2_bsize=yes #311569
+		export gl_cv_func_realpath_works=yes #416629
+	fi
+
+	export gl_cv_func_mknod_works=yes #409919
+	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
+	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
+	# kill/uptime - procps
+	# groups/su   - shadow
+	# hostname    - net-tools
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Known to fail with FEATURES=usersandbox (bug #439574):
+	#   -  tests/du/long-from-unreadable.sh} (bug #413621)
+	#   -  tests/rm/deep-2.sh (bug #413621)
+	#   -  tests/dd/no-allocate.sh (bug #629660)
+	if has usersandbox ${FEATURES} ; then
+		ewarn "You are emerging ${P} with 'usersandbox' enabled." \
+			"Expect some test failures or emerge with 'FEATURES=-usersandbox'!"
+	fi
+
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}"
+	chmod a+rx "${WORKDIR}"
+
+	# coreutils tests like to do `mount` and such with temp dirs
+	# so make sure /etc/mtab is writable #265725
+	# make sure /dev/loop* can be mounted #269758
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}"
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+	#export RUN_EXPENSIVE_TESTS="yes"
+	#export FETISH_GROUPS="portage wheel"
+	env PATH="${T}/mount-wrappers:${PATH}" \
+	emake -j1 -k check
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED%/}"/usr/bin || die
+		dodir /bin
+		# move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "could not move fhs bins"
+		if use hostname; then
+			mv hostname ../../bin/ || die
+		fi
+		if use kill; then
+			mv kill ../../bin/ || die
+		fi
+		# move critical binaries into /bin (common scripts)
+		# Why are these required for booting?
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "could not move common bins"
+		# create a symlink for uname in /usr/bin/ since autotools require it
+		# Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place.
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.32-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.32-r1.ebuild
new file mode 100644
index 0000000000..63b8e1f694
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-8.32-r1.ebuild
@@ -0,0 +1,201 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{6,7,8} )
+
+inherit eutils flag-o-matic python-any-r1 toolchain-funcs
+
+PATCH="${PN}-8.30-patches-01"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
+	!vanilla? (
+		mirror://gentoo/${PATCH}.tar.xz
+		https://dev.gentoo.org/~polynomial-c/dist/${PATCH}.tar.xz
+	)
+"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~x86-linux"
+IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	test? (
+		dev-lang/perl
+		dev-perl/Expect
+		dev-util/strace
+		${PYTHON_DEPS}
+	)
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!app-misc/realpath
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4"
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_prepare() {
+	local PATCHES=(
+		"${FILESDIR}"/coreutils-8.32-ls-restore-8.31-behavior.patch
+	)
+
+	if ! use vanilla ; then
+		PATCHES+=( "${WORKDIR}"/patch )
+		PATCHES+=( "${FILESDIR}"/${PN}-8.32-sandbox-env-test.patch )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1}
+
+	# Avoid perl dep for compiled in dircolors default #348642
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h
+		touch ${@/%x/1}
+	fi
+}
+
+src_configure() {
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		--enable-largefile
+		$(usex caps '' --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp)
+	)
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		export fu_cv_sys_stat_statfs2_bsize=yes #311569
+		export gl_cv_func_realpath_works=yes #416629
+	fi
+
+	export gl_cv_func_mknod_works=yes #409919
+	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
+	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
+	# kill/uptime - procps
+	# groups/su   - shadow
+	# hostname    - net-tools
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Known to fail with FEATURES=usersandbox (bug #439574):
+	#   -  tests/du/long-from-unreadable.sh} (bug #413621)
+	#   -  tests/rm/deep-2.sh (bug #413621)
+	#   -  tests/dd/no-allocate.sh (bug #629660)
+	if has usersandbox ${FEATURES} ; then
+		ewarn "You are emerging ${P} with 'usersandbox' enabled." \
+			"Expect some test failures or emerge with 'FEATURES=-usersandbox'!"
+	fi
+
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}"
+	chmod a+rx "${WORKDIR}"
+
+	# coreutils tests like to do `mount` and such with temp dirs
+	# so make sure /etc/mtab is writable #265725
+	# make sure /dev/loop* can be mounted #269758
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}"
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+	#export RUN_EXPENSIVE_TESTS="yes"
+	#export FETISH_GROUPS="portage wheel"
+	env PATH="${T}/mount-wrappers:${PATH}" \
+	emake -j1 -k check
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+		# move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "could not move fhs bins"
+		if use hostname; then
+			mv hostname ../../bin/ || die
+		fi
+		if use kill; then
+			mv kill ../../bin/ || die
+		fi
+		# move critical binaries into /bin (common scripts)
+		# Why are these required for booting?
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "could not move common bins"
+		# create a symlink for uname in /usr/bin/ since autotools require it
+		# Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place.
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.31-sandbox-env-test.patch b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.31-sandbox-env-test.patch
new file mode 100644
index 0000000000..f81ea13776
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.31-sandbox-env-test.patch
@@ -0,0 +1,52 @@
+Skip tests known to fail when running under Gentoo sandbox.
+
+--- a/tests/du/long-from-unreadable.sh
++++ b/tests/du/long-from-unreadable.sh
+@@ -29,6 +29,9 @@
+ # unnecessarily to using FTS_NOCHDIR mode in this corner case.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ du
+ 
+ require_perl_
+--- a/tests/ls/stat-free-symlinks.sh
++++ b/tests/ls/stat-free-symlinks.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ ls
+ require_strace_ stat
+ 
+--- a/tests/misc/env-S.pl
++++ b/tests/misc/env-S.pl
+@@ -30,6 +30,11 @@ $env = $1;
+ # Turn off localization of executable's output.
+ @ENV{qw(LANGUAGE LANG LC_ALL)} = ('C') x 3;
+ 
++# Skip if sandbox is enabled
++if ($ENV{SANDBOX_ACTIVE}) {
++     CuSkip::skip "Gentoo: Test known bad under sandbox (#675802)\n";
++}
++
+ my @Tests =
+     (
+      # Test combination of -S and regular arguments
+--- a/tests/rm/deep-2.sh
++++ b/tests/rm/deep-2.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ rm
+ require_perl_
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch
new file mode 100644
index 0000000000..62a35cd85a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch
@@ -0,0 +1,94 @@
+From 10fcb97bd728f09d4a027eddf8ad2900f0819b0a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 5 Mar 2020 17:25:29 -0800
+Subject: ls: restore 8.31 behavior on removed directories
+
+* src/ls.c: Do not include <sys/sycall.h>
+(print_dir): Don't worry about whether the directory is removed.
+* tests/ls/removed-directory.sh: Adjust to match new (i.e., old)
+behavior.
+ 
+diff --git a/src/ls.c b/src/ls.c
+index 24b983287..4acf5f44d 100644
+--- a/src/ls.c
++++ b/src/ls.c
+@@ -49,10 +49,6 @@
+ # include <sys/ptem.h>
+ #endif
+ 
+-#ifdef __linux__
+-# include <sys/syscall.h>
+-#endif
+-
+ #include <stdio.h>
+ #include <assert.h>
+ #include <setjmp.h>
+@@ -2896,7 +2892,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+   struct dirent *next;
+   uintmax_t total_blocks = 0;
+   static bool first = true;
+-  bool found_any_entries = false;
+ 
+   errno = 0;
+   dirp = opendir (name);
+@@ -2972,7 +2967,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+       next = readdir (dirp);
+       if (next)
+         {
+-          found_any_entries = true;
+           if (! file_ignored (next->d_name))
+             {
+               enum filetype type = unknown;
+@@ -3018,22 +3012,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+           if (errno != EOVERFLOW)
+             break;
+         }
+-#ifdef __linux__
+-      else if (! found_any_entries)
+-        {
+-          /* If readdir finds no directory entries at all, not even "." or
+-             "..", then double check that the directory exists.  */
+-          if (syscall (SYS_getdents, dirfd (dirp), NULL, 0) == -1
+-              && errno != EINVAL)
+-            {
+-              /* We exclude EINVAL as that pertains to buffer handling,
+-                 and we've passed NULL as the buffer for simplicity.
+-                 ENOENT is returned if appropriate before buffer handling.  */
+-              file_failure (command_line_arg, _("reading directory %s"), name);
+-            }
+-          break;
+-        }
+-#endif
+       else
+         break;
+ 
+diff --git a/tests/ls/removed-directory.sh b/tests/ls/removed-directory.sh
+index e8c835dab..fe8f929a1 100755
+--- a/tests/ls/removed-directory.sh
++++ b/tests/ls/removed-directory.sh
+@@ -26,20 +26,14 @@ case $host_triplet in
+   *) skip_ 'non linux kernel' ;;
+ esac
+ 
+-LS_FAILURE=2
+-
+-cat <<\EOF >exp-err || framework_failure_
+-ls: reading directory '.': No such file or directory
+-EOF
+-
+ cwd=$(pwd)
+ mkdir d || framework_failure_
+ cd d || framework_failure_
+ rmdir ../d || framework_failure_
+ 
+-returns_ $LS_FAILURE ls >../out 2>../err || fail=1
++ls >../out 2>../err || fail=1
+ cd "$cwd" || framework_failure_
+ compare /dev/null out || fail=1
+-compare exp-err err || fail=1
++compare /dev/null err || fail=1
+ 
+ Exit $fail
+-- 
+cgit v1.2.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch
new file mode 100644
index 0000000000..40b1554d94
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch
@@ -0,0 +1,64 @@
+Skip tests known to fail when running under Gentoo sandbox.
+
+--- a/tests/du/long-from-unreadable.sh
++++ b/tests/du/long-from-unreadable.sh
+@@ -29,6 +29,9 @@
+ # unnecessarily to using FTS_NOCHDIR mode in this corner case.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ du
+ 
+ require_perl_
+--- a/tests/ls/removed-directory.sh
++++ b/tests/ls/removed-directory.sh
+@@ -19,6 +19,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ ls
+ 
+ case $host_triplet in
+--- a/tests/ls/stat-free-symlinks.sh
++++ b/tests/ls/stat-free-symlinks.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ ls
+ require_strace_ stat
+ 
+--- a/tests/misc/env-S.pl
++++ b/tests/misc/env-S.pl
+@@ -30,6 +30,11 @@ $env = $1;
+ # Turn off localization of executable's output.
+ @ENV{qw(LANGUAGE LANG LC_ALL)} = ('C') x 3;
+ 
++# Skip if sandbox is enabled
++if ($ENV{SANDBOX_ACTIVE}) {
++     CuSkip::skip "Gentoo: Test known bad under sandbox (#675802)\n";
++}
++
+ my @Tests =
+     (
+      # Test combination of -S and regular arguments
+--- a/tests/rm/deep-2.sh
++++ b/tests/rm/deep-2.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ rm
+ require_perl_
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/metadata.xml
new file mode 100644
index 0000000000..4e46af051b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>base-system@gentoo.org</email>
+	<name>Gentoo Base System</name>
+</maintainer>
+<longdescription>Standard GNU file utilities (chmod, cp, dd, dir, ls, ...), text utilities (sort, tr, head, wc, ...), and shell utilities (whoami, who, ...)
+</longdescription>
+<use>
+	<flag name="caps">Add Linux capabilities support in output of file utilities (ls, dir, ...) via <pkg>sys-libs/libcap</pkg></flag>
+	<flag name="hostname">Build the hostname program</flag>
+	<flag name="kill">Build the kill program</flag>
+	<flag name="multicall">Build all tools into a single `coreutils` program akin to busybox to save space</flag>
+	<flag name="split-usr">Enable this if /bin and /usr/bin are separate directories</flag>
+</use>
+<upstream>
+	<remote-id type="cpe">cpe:/a:gnu:coreutils</remote-id>
+</upstream>
+</pkgmetadata>