diff --git a/changelog/security/2025-04-09-weekly-updates.md b/changelog/security/2025-04-09-weekly-updates.md
new file mode 100644
index 0000000000..f4b9ce3a96
--- /dev/null
+++ b/changelog/security/2025-04-09-weekly-updates.md
@@ -0,0 +1,3 @@
+- curl ([curl-20250205](https://github.com/curl/curl/issues/16197))
+- iperf ([CVE-2024-53580](https://www.cve.org/CVERecord?id=CVE-2024-53580))
+- xz-utils ([CVE-2025-31115](https://www.cve.org/CVERecord?id=CVE-2025-31115))
diff --git a/changelog/updates/2025-04-09-weekly-updates.md b/changelog/updates/2025-04-09-weekly-updates.md
new file mode 100644
index 0000000000..6638a87dcb
--- /dev/null
+++ b/changelog/updates/2025-04-09-weekly-updates.md
@@ -0,0 +1,9 @@
+- base, dev: curl ([8.13.0](https://curl.se/ch/8.13.0.html))
+- base, dev: libarchive ([3.7.9](https://github.com/libarchive/libarchive/releases/tag/v3.7.9))
+- containerd: runc ([1.2.5](https://github.com/opencontainers/runc/releases/tag/v1.2.5))
+- dev: iperf ([3.18](https://github.com/esnet/iperf/releases/tag/3.18))
+- dev: minicom ([2.10](https://salsa.debian.org/minicom-team/minicom/-/releases/2.10))
+- docker: docker-buildx ([0.20.1](https://github.com/docker/buildx/releases/tag/v0.20.1) (includes [0.20.0](https://github.com/docker/buildx/releases/tag/v0.20.0), [0.19.3](https://github.com/docker/buildx/releases/tag/v0.19.3), [0.19.2](https://github.com/docker/buildx/releases/tag/v0.19.2)))
+- sysext-podman: conmon ([2.1.11](https://github.com/containers/conmon/releases/tag/v2.1.11))
+- sysext-python: platformdirs ([4.3.7](https://github.com/tox-dev/platformdirs/releases/tag/4.3.7))
+- sysext-python: setuptools-scm ([8.2.1](https://github.com/pypa/setuptools-scm/blob/v8.2.1/CHANGELOG.md))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/0001-fix-build-with-curl-8-13-0.patch b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/0001-fix-build-with-curl-8-13-0.patch
new file mode 100644
index 0000000000..08bbcf4a3f
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/0001-fix-build-with-curl-8-13-0.patch
@@ -0,0 +1,36 @@
+https://bugs.gentoo.org/953060
+https://gitlab.kitware.com/cmake/cmake/-/issues/26754
+https://gitlab.kitware.com/cmake/cmake/-/merge_requests/10449
+
+From 1b0c92a3a1b782ff3e1c4499b6ab8db614d45bcd Mon Sep 17 00:00:00 2001
+From: Brad King <brad.king@kitware.com>
+Date: Mon, 10 Mar 2025 11:08:42 -0400
+Subject: [PATCH] cmCurl: Avoid using undocumented type for CURLOPT_NETRC
+ values
+
+Since upstream curl commit `2ec00372a1` (curl.h: change some enums to
+defines with L suffix, 2025-02-25), the `CURL_NETRC_*` constants are
+integer literals instead of `enum CURL_NETRC_OPTION`.  It turns out
+that `curl_easy_setopt` has always expected a `long` anyway, and
+that `CURL_NETRC_OPTION` is not documented for public use.
+
+Fixes: #26754
+---
+ Source/cmCurl.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx
+index b9133ed7d47..0cf8a71a72d 100644
+--- a/Source/cmCurl.cxx
++++ b/Source/cmCurl.cxx
+@@ -170,7 +170,7 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
+                                  const std::string& netrc_file)
+ {
+   std::string e;
+-  CURL_NETRC_OPTION curl_netrc_level = CURL_NETRC_LAST;
++  long curl_netrc_level = CURL_NETRC_LAST;
+   ::CURLcode res;
+ 
+   if (!netrc_level.empty()) {
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/README.md b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/README.md
new file mode 100644
index 0000000000..f02ccfbe44
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/README.md
@@ -0,0 +1,3 @@
+The `0001-fix-build-with-curl-8-13-0.patch` was taken from Gentoo -
+the patched cmake is 3.31.6-r1, so if we get updated to that version
+or later, we can drop the patch.
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
index 314e1e3d0e..d4c756449a 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/make.defaults
@@ -85,7 +85,7 @@ CONFIG_PROTECT="
 # Do not install default repos.conf, we always put repository configuration in /etc.
 INSTALL_MASK="
   /usr/lib*/*.la
-  /etc/init.d /etc/conf.d
+  /etc/init.d /etc/conf.d /etc/user/conf.d /etc/user/init.d
   /usr/lib/debug/.build-id
   /etc/acpi
   /usr/share/portage/config/repos.conf
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 75281d0deb..0f78484df8 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -58,6 +58,12 @@
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
+# Needed to address curl-20250205 (https://github.com/curl/curl/issues/16197)
+=net-misc/curl-8.13.0 ~amd64 ~arm64
+
+# Needed to address CVE-2024-53580.
+=net-misc/iperf-3.18 ~amd64 ~arm64
+
 # Needed to address CVE-2024-54661
 =net-misc/socat-1.8.0.3 ~amd64 ~arm64
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
index 694ed8bba7..49accba5c1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/Manifest
@@ -1,2 +1,4 @@
 DIST gzip-1.13.tar.xz 838248 BLAKE2B f0e3b4c28bafcd3b59b65ac2d71218dc58d81b52c6921c1be038757c99e99184178c5d0e9674caa5099713b8b64e8c85cf061f4abfa20b73b478288f121fb05d SHA512 e3d4d4aa4b2e53fdad980620307257c91dfbbc40bcec9baa8d4e85e8327f55e2ece552c9baf209df7b66a07103ab92d4954ac53c86c57fbde5e1dd461143f94c
 DIST gzip-1.13.tar.xz.sig 833 BLAKE2B 42e38fa7b3a6b6d21a18308cf662844ed84e1a142a945f3f3142db0a14212c0e642de514abb1307ec12ee7bb9644472cc3aed40582d9c266ab24808acbca0215 SHA512 f95e016f61f4a67cb4cec6cede2510af6bb5567d72bbd3d70210a6d5cf3ee5fea8f0cbf8f7b612fa52f2ecfd9dba050d9cd4494075ce5ac4abac7b74eaa7ccbc
+DIST gzip-1.13_p20250405.tar.xz 892960 BLAKE2B a3b52fbc4db6594ebc98d0f49d04f18073036bd2b29ac1aedb77ce124f8ac232e502450763d260d9d836066d21106b4770561f67dbe833bf43ed9b6c12987389 SHA512 8c439fbb15924eb38e421b04919fc2013e5a814445c83b665e4538f34f9b4b8c73dfe1910aba8c38ef98ee4bd57f01082798e6056802a12aa95d0c82e4a08412
+DIST gzip-1.13_p20250405.tar.xz.sig 833 BLAKE2B b47479ee151f093e6fa81abfe9587c887994562bb19631da9b3506a020ec8ccbc34eb79df29f61e4e441b46fb3e7b5e603357d75edf5d13973ca52737967f897 SHA512 162488d2085664514f8893128fbe6227860e8c8e152a979196c311f68706781c058fdada3fe659e41059aaaf281f0539b035f358e5e633d59e9c5634edbefadb
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13_p20250405.ebuild
new file mode 100644
index 0000000000..114d6d16b3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13_p20250405.ebuild
@@ -0,0 +1,96 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gzip.asc
+inherit eapi9-ver flag-o-matic verify-sig
+
+DESCRIPTION="Standard GNU compressor"
+HOMEPAGE="https://www.gnu.org/software/gzip/"
+if [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).56-e549"
+	SRC_URI="
+		https://meyering.net/gzip/gzip-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz
+		verify-sig? (
+			https://meyering.net/gzip/gzip-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig
+		)
+	"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/gzip/${P}.tar.xz
+		verify-sig? (
+			mirror://gnu/gzip/${P}.tar.xz.sig
+		)
+	"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if [[ ${PV} != *_p* ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="pic static"
+
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-gzip )"
+RDEPEND="!app-arch/pigz[symlink(-)]"
+PDEPEND="
+	app-alternatives/gzip
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.3.8-install-symlinks.patch"
+)
+
+src_configure() {
+	use static && append-flags -static
+
+	# Avoid text relocation in gzip
+	use pic && export DEFS="NO_ASM"
+
+	# embeds the path to grep detected at build time into installed scripts;
+	# use the canonical USE="split-usr" agnostic path. bug #935721
+	export GREP="${EPREFIX}/bin/grep"
+
+	# bug #663928
+	econf --disable-gcc-warnings
+}
+
+src_install() {
+	default
+
+	docinto txt
+	dodoc algorithm.doc gzip.doc
+
+	# Avoid conflict with app-arch/ncompress
+	rm "${ED}"/usr/bin/uncompress || die
+
+	# keep most things in /usr, just the fun stuff in /
+	# also rename them to avoid conflict with app-alternatives/gzip
+	dodir /bin
+	local x
+	for x in gunzip gzip zcat; do
+		mv "${ED}/usr/bin/${x}" "${ED}/bin/${x}-reference" || die
+	done
+	mv "${ED}"/usr/share/man/man1/gzip{,-reference}.1 || die
+	rm "${ED}"/usr/share/man/man1/{gunzip,zcat}.1 || die
+}
+
+pkg_postinst() {
+	if ver_replacing -lt "1.12-r2"; then
+		ewarn "This package no longer installs 'uncompress'."
+		ewarn "Please use 'gzip -d' to decompress .Z files."
+	fi
+
+	# ensure to preserve the symlinks before app-alternatives/gzip
+	# is installed
+	local x
+	for x in gunzip gzip zcat; do
+		if [[ ! -h ${EROOT}/bin/${x} ]]; then
+			ln -s "${x}-reference" "${EROOT}/bin/${x}" || die
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index 4b9ba75b06..d21eea9b85 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,4 @@
 DIST libarchive-3.7.8.tar.xz 5493312 BLAKE2B ba058b2fa2afbfe53127d6ffd0a7ab00d9e8faf62340ae2eb8871a0ca232c2de482dbff2c4eedf2c45d944eb555123d765c462818158046bb72951f6421d9ea0 SHA512 a2b6c8c337e75bcce73126c30a3b564dc586df973780d9c7d5a9eed693dbe3779bf762b64c49c47203c2768c92a4a7d2dc8c0445b1dc398eafd2d58b0ba5aae6
 DIST libarchive-3.7.8.tar.xz.asc 659 BLAKE2B 2050214592b0add7cbd758b815c4289a8760bfb2e5b5db581afdbe741d348252b73f99919641cacd908b586cf4f8fc30a591d88b869bd607adc837251d8fbd4e SHA512 3f1d70318f5e2369fa59e94f91bf8473630a448ded11e2ff3502657380221b9e11e849dc98ba0806c3110c7267cee251f7d681db27751e2a45a948f6ad558404
+DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
+DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild
new file mode 100644
index 0000000000..af10ff4683
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.9.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
index fecf25df22..8130f5814d 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
@@ -1,8 +1,6 @@
-DIST xz-5.4.7.tar.gz 2798247 BLAKE2B e02f3a62c81882c83254e1c94f002aadcd59479dbd031a4d5ea68ce3303c066c298c2709845f2d4ef436511b21d35ab66a080542ac70aaf6c0a0daf448a47d02 SHA512 82c3e5d39fbaa5dcd61b45d5db99d740d811323456a9af3b1acfccbe66b074d1650bc810ee8272a8ae0a1bcf116fc73fc09297b8acb4c6568cf912708306e8ea
-DIST xz-5.4.7.tar.gz.sig 566 BLAKE2B 525eeeddb219c6e46ef2079af0cd28c8514969ce33b2ab61ccae59ae26289e7ddbd29dd492f88f4e4da9db750dd60ce1831a23a0275cdac39bd5b29c663d1a72 SHA512 00e9004739a168fd8a1ca4bb8b8a9de456bbef2576565722158140f341e94f461dab05c6e457f62a1613229419a978898e878007872571afdc1bb8a9582fa00a
-DIST xz-5.6.3.tar.gz 2279396 BLAKE2B 9f09926f1ec7d72e6564f5816101512717bcb37610b551616117818d4e6a3b6c00b4ac74bf13a06cd299ff199a0561f2c05a3884a6f6b7e94951de2c1c2e6dc3 SHA512 b07b45e18615d1946e9d12157af99b54700d757832a638fccab70549574dcd7f28e69e71cc4c0b9c808959f818e79b668a5ccf108429ea0f40b6125bfd55d274
-DIST xz-5.6.3.tar.gz.sig 566 BLAKE2B b59899d9ddc3325bd0de084dac420440ccdeb5f57f3656300f235fdae997a8943c2dc44edc3b83150b78717a7bf761152f09b41035d245fa536c45b8c06dd00d SHA512 65a0eb674b804309417d736b3ec9edb9c9bf39485593d81f352ee847662f5a95b3d5084fab21451e3510d74e4e2ee8f9cf4e8615d1128b6e16d5c211481481db
 DIST xz-5.6.4.tar.gz 2280985 BLAKE2B 3d27c143f4856589d501bc47ff5c86c1c49b1d0b8c8fd2143bcbfe86b860ca93f6a103f628e06ce5c2839ce1941cecc7552d91b1aac5c11def40fd9182d93eee SHA512 b966950eb9206e31f284c9dc3bb0a79f2fabbaf515e88c89da53d3da41ddfeebd2fc6d3d3f8fcd150c70caaaefa43dec0bce84aa183e08bf339d1aebbe041751
 DIST xz-5.6.4.tar.gz.sig 566 BLAKE2B 475b576431f573b9ce390ae2c43fc4f307f00ef523a741ec6795f182f5ff2c30f2049b1b4d2a3a7e61769bb7dc568de0f5af89661cb09341a58bbcdcdda3c877 SHA512 1ece59b7a540f6d215206ced14759aa971f192433705f8803b6ad8db0857e246145300c853cb571d8750b8152483d13736c478a7c0abb40d7ed25305d80a841c
-DIST xz-5.8.0.tar.gz 2579807 BLAKE2B 4fe1f19e5951640b27e7405da4de40a811caf4349141e5eb571e6dd3fb9e8a9ffcb9d7a7bc72ccda1540e3f2298a88da393a95dffeeb13da5dd70e2d96967eaf SHA512 ea9a0ba73529c12df776cd2b5088726e253b5517653700676db77780d5bd13db54e36b427bbf934eb1e17f6330767d097ea8720e43c3052c6f58f4c7fc53f7b1
-DIST xz-5.8.0.tar.gz.sig 566 BLAKE2B 38f925e96b1f1dd9e9afc0c0b68e7c30921e8ac46f8ca62bfdd9145356b3ef4c359ae77f89c8b1ef76ca8197e34bf743a6617bcc1a76a44491ff9fedac65783c SHA512 88eb39a2078ff235f1ae9222e789d06f55d225845072a96b0e6ef8f218781aad04cc53623537b0b18607d3cd7c51b6cee3c07b36d912b3a8b7c9991ebfe795d3
+DIST xz-5.8.1.tar.gz 2587189 BLAKE2B 430b14bc0f1382e7ba27ae1466ed2bc0c3e74c10b18db38fd899c9a7d315ffbbeb439d02b7b961de88ccba6064ae631c75f6d1cd03e3e58dac2e65a84b635f81 SHA512 151b2a47fdf00274c4fd71ceada8fb6c892bdac44070847ebf3259e602b97c95ee5ee88974e03d7aa821ab4f16d5c38e50dfb2baf660cf39c199878a666e19ad
+DIST xz-5.8.1.tar.gz.sig 566 BLAKE2B 66fdf664995781c111349b700918b030af9dacd0612d97b3426913c2d866b459a66bd25558c7ab8121b3f0b07daa46422ea1c4534cf2da7382a94f1553e911a1 SHA512 4a67ed623841d64a5826cef1d5e21f3567ba275ee8f725a1217f76ce2ba25a41c6e22e62f8c7cca74d0d6e8398e8ee8926eab722cc8c1b10c42e990c32765efd
+DIST xz-cve-2025-31115.patch 11948 BLAKE2B a84c380aa6bdaa607d5bffe6370f7a2fb603945aa89f59f053d56e4be90a280b2c56d8e5fd6700a533fb24bd9ec54f047fed96364019f62eeea50adcf4e38657 SHA512 951622698f92844151f105821e1cf5bbe4fd71de5a2ac89a2310c6de80afe34528642c65d12dd4331085e1c23ba3887607bbd6185644c740cbf135c869881a33
+DIST xz-cve-2025-31115.patch.sig 566 BLAKE2B d6d4bad23ceaec55b6db04a4454885900f961dd6346c112cb97906e2403b718790e3f893d2502ba67ac1a08832478051ea480bdcf339bbf89d0edd13f40a47b4 SHA512 4002472637389c265fbe0f2ad7d80fe29a79bc4d8c1778af76e7cfd29b80d86c3be947ebf620a282494f45071f61534e385c5bed2192e6095ec2fc1338c31ccb
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild
deleted file mode 100644
index 8486e494cd..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.7-r1.ebuild
+++ /dev/null
@@ -1,155 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Remember: we cannot leverage autotools in this ebuild in order
-#           to avoid circular deps with autotools
-
-EAPI=8
-
-inherit flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
-
-if [[ ${PV} == 9999 ]] ; then
-	# Per tukaani.org, git.tukaani.org is a mirror of github and
-	# may be behind.
-	EGIT_REPO_URI="
-		https://github.com/tukaani-project/xz
-		https://git.tukaani.org/xz.git
-	"
-	inherit git-r3 autotools
-
-	# bug #272880 and bug #286068
-	BDEPEND="sys-devel/gettext >=dev-build/libtool-2"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lassecollin.asc
-	inherit verify-sig
-
-	MY_P="${PN/-utils}-${PV/_}"
-	SRC_URI="
-		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
-		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
-		https://tukaani.org/xz/${MY_P}.tar.gz
-		verify-sig? (
-			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
-			https://tukaani.org/xz/${MY_P}.tar.gz.sig
-		)
-	"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	S="${WORKDIR}/${MY_P}"
-fi
-
-DESCRIPTION="Utils for managing LZMA compressed files"
-HOMEPAGE="https://tukaani.org/xz/"
-
-# See top-level COPYING file as it outlines the various pieces and their licenses.
-LICENSE="public-domain LGPL-2.1+ GPL-2+"
-SLOT="0"
-IUSE="doc +extra-filters pgo nls static-libs"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
-fi
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautopoint
-		eautoreconf
-	else
-		# Allow building shared libs on Solaris/x64
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
-	# uses newer libtool with the fix.
-	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
-
-	local myconf=(
-		--enable-threads
-		$(multilib_native_use_enable doc)
-		$(use_enable nls)
-		$(use_enable static-libs static)
-	)
-
-	if ! multilib_is_native_abi ; then
-		myconf+=(
-			--disable-{xz,xzdec,lzmadec,lzmainfo,lzma-links,scripts}
-		)
-	fi
-
-	if ! use extra-filters ; then
-		myconf+=(
-			# LZMA1 + LZMA2 for standard .lzma & .xz files
-			--enable-encoders=lzma1,lzma2
-			--enable-decoders=lzma1,lzma2
-
-			# those are used by default, depending on preset
-			--enable-match-finders=hc3,hc4,bt4
-
-			# CRC64 is used by default, though some (old?) files use CRC32
-			--enable-checks=crc32,crc64
-		)
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
-
-		# Undo Solaris-based defaults pointing to /usr/xpg5/bin
-		myconf+=( --disable-path-for-script )
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
-	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
-
-	if use pgo ; then
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/${ABI}-pgo --output="${T}"/${ABI}-pgo/default.profdata || die
-		fi
-
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
-	fi
-}
-
-multilib_src_install() {
-	default
-
-	# bug #934370 and bug #450436
-	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma.so" ]] ; then
-		eerror "Sanity check for liblzma.so failed."
-		eerror "Shared library wasn't built, possible libtool bug"
-		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma.so not found in build, aborting"
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	if use doc ; then
-		rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/liblzma$(get_libname 0)
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/liblzma$(get_libname 0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild
deleted file mode 100644
index cd83095c3e..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.3.ebuild
+++ /dev/null
@@ -1,203 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Remember: we cannot leverage autotools in this ebuild in order
-#           to avoid circular deps with autotools
-
-EAPI=8
-
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
-
-if [[ ${PV} == 9999 ]] ; then
-	# Per tukaani.org, git.tukaani.org is a mirror of github and
-	# may be behind.
-	EGIT_REPO_URI="
-		https://github.com/tukaani-project/xz
-		https://git.tukaani.org/xz.git
-	"
-	inherit git-r3 autotools
-
-	# bug #272880 and bug #286068
-	BDEPEND="sys-devel/gettext >=dev-build/libtool-2"
-else
-	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/lassecollin.asc
-	inherit verify-sig
-
-	MY_P="${PN/-utils}-${PV/_}"
-	SRC_URI="
-		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
-		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
-		https://tukaani.org/xz/${MY_P}.tar.gz
-		verify-sig? (
-			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
-			https://tukaani.org/xz/${MY_P}.tar.gz.sig
-		)
-	"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	S="${WORKDIR}/${MY_P}"
-fi
-
-DESCRIPTION="Utils for managing LZMA compressed files"
-HOMEPAGE="https://tukaani.org/xz/"
-
-# See top-level COPYING file as it outlines the various pieces and their licenses.
-LICENSE="0BSD LGPL-2.1+ GPL-2+ doc? ( CC-BY-SA-4.0 )"
-SLOT="0"
-IUSE="cpu_flags_arm_crc32 doc +extra-filters pgo nls static-libs"
-
-if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
-fi
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautopoint
-		eautoreconf
-	else
-		# Allow building shared libs on Solaris/x64
-		elibtoolize
-	fi
-}
-
-multilib_src_configure() {
-	# Workaround for bug #934370 (libtool-2.5.0), drop when dist tarball
-	# uses newer libtool with the fix.
-	export ac_cv_prog_ac_ct_FILECMD='file' FILECMD='file'
-
-	local myconf=(
-		--enable-threads
-		$(multilib_native_use_enable doc)
-		$(use_enable nls)
-		$(use_enable static-libs static)
-		$(use_enable cpu_flags_arm_crc32 arm64-crc32)
-	)
-
-	if ! multilib_is_native_abi ; then
-		myconf+=(
-			--disable-{xz,xzdec,lzmadec,lzmainfo,lzma-links,scripts}
-		)
-	fi
-
-	if ! use extra-filters ; then
-		myconf+=(
-			# LZMA1 + LZMA2 for standard .lzma & .xz files
-			--enable-encoders=lzma1,lzma2
-			--enable-decoders=lzma1,lzma2
-
-			# those are used by default, depending on preset
-			--enable-match-finders=hc3,hc4,bt4
-
-			# CRC64 is used by default, though 7-Zip uses CRC32 by default.
-			# Also, XZ Embedded in Linux doesn't support CRC64, so
-			# kernel modules and friends are CRC32.
-			--enable-checks=crc32,crc64
-		)
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		export gl_cv_posix_shell="${EPREFIX}"/bin/sh
-
-		# Undo Solaris-based defaults pointing to /usr/xpg4/bin
-		myconf+=( --disable-path-for-script )
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
-
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
-
-	if use pgo ; then
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
-
-		local tar_pgo_args=()
-
-		if has_version -b "app-alternatives/tar[gnu]" ; then
-			tar_pgo_args+=(
-				--mtime=@2718281828
-				--sort=name
-			)
-		fi
-
-		if multilib_is_native_abi ; then
-			(
-				shopt -s globstar
-
-				tar \
-					"${tar_pgo_args[@]}" \
-					-cf xz-pgo-test-01.tar \
-					{"${S}","${BUILD_DIR}"}/**/*.[cho] \
-					{"${S}","${BUILD_DIR}"}/**/.libs/* \
-					{"${S}","${BUILD_DIR}"}/**/**.txt \
-					{"${S}","${BUILD_DIR}"}/tests/files
-
-				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar || die
-				md5sum xz-pgo-test-01.tar || die
-			)
-
-			local test_variants=(
-				# Borrowed from ALT Linux
-				# https://packages.altlinux.org/en/sisyphus/srpms/xz/specfiles/#line-80
-				'-0 -C none'
-				'-2 -C crc32'
-				"$(usev extra-filters '-6 --arm --lzma2 -C crc64')"
-				"$(usev extra-filters '-6 --x86 --lzma2=lc=4 -C sha256')"
-				'-7e --format=lzma'
-
-				# Our own variants
-				''
-				'-e'
-				"$(usev extra-filters '--x86 --lzma2=preset=6e')"
-			)
-			local test_variant
-			for test_variant in "${test_variants[@]}" ; do
-				einfo "Testing '${test_variant}' variant"
-				"${BUILD_DIR}"/src/xz/xz -c ${test_variant} xz-pgo-test-01.tar | "${BUILD_DIR}"/src/xz/xz -c -d - > /dev/null
-				assert "Testing '${test_variant}' variant failed"
-			done
-		fi
-
-		if tc-is-clang; then
-			llvm-profdata merge "${T}"/${ABI}-pgo --output="${T}"/${ABI}-pgo/default.profdata || die
-		fi
-
-		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
-	fi
-}
-
-multilib_src_install() {
-	default
-
-	# bug #934370 and bug #450436 (and bug #934515)
-	if ! tc-is-static-only && [[ ! -f "${ED}/usr/$(get_libdir)/liblzma$(get_libname)" ]] ; then
-		eerror "Sanity check for liblzma$(get_libname) failed."
-		eerror "Shared library wasn't built, possible libtool bug"
-		[[ -z ${I_KNOW_WHAT_I_AM_DOING} ]] && die "liblzma$(get_libname) not found in build, aborting"
-	fi
-}
-
-multilib_src_install_all() {
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	if use doc ; then
-		rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
-	fi
-}
-
-pkg_preinst() {
-	preserve_old_lib /usr/$(get_libdir)/liblzma$(get_libname 0)
-}
-
-pkg_postinst() {
-	preserve_old_lib_notify /usr/$(get_libdir)/liblzma$(get_libname 0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild
index 825f16284c..05d8d64264 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r1.ebuild
@@ -28,9 +28,11 @@ else
 		https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz
 		https://downloads.sourceforge.net/lzmautils/${MY_P}.tar.gz
 		https://tukaani.org/xz/${MY_P}.tar.gz
+		https://tukaani.org/xz/xz-cve-2025-31115.patch
 		verify-sig? (
 			https://github.com/tukaani-project/xz/releases/download/v${PV/_}/${MY_P}.tar.gz.sig
 			https://tukaani.org/xz/${MY_P}.tar.gz.sig
+			https://tukaani.org/xz/xz-cve-2025-31115.patch.sig
 		)
 	"
 
@@ -50,9 +52,13 @@ SLOT="0"
 IUSE="cpu_flags_arm_crc32 doc +extra-filters pgo nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20240529 )"
+	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20250313 )"
 fi
 
+PATCHES=(
+	"${DISTDIR}"/xz-cve-2025-31115.patch
+)
+
 src_prepare() {
 	default
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.0.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.0.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.11.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.11.ebuild
index bfc4da4cc9..fe54798309 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/conmon/conmon-2.1.11.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -18,7 +18,7 @@ else
 		https://github.com/Flowdalic/conmon/commit/ff8794c5bc0805cc430229728befde16da47b68c.patch
 			-> ${PN}-2.1.11-make-docs-target-not-depend-on-install.tools.patch
 	"
-	KEYWORDS="~amd64 ~arm64 ~loong ~ppc64 ~riscv"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv"
 fi
 
 LICENSE="Apache-2.0"
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild
index f1b68c1117..385833c044 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/docker-buildx/docker-buildx-0.20.1.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/docker/buildx.git"
 else
 	SRC_URI="https://github.com/docker/buildx/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+	KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 	S="${WORKDIR}/${MY_PN}-${PV}"
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/Manifest b/sdk_container/src/third_party/portage-stable/app-containers/podman/Manifest
index 7db34c0ce8..05620cca44 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/podman/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-containers/podman/Manifest
@@ -1,3 +1,3 @@
 DIST podman-5.3.0.tar.gz 24194165 BLAKE2B fb2da37e4f97d69997b9518425bb1ec74846e4e26855bf9ece0eeefb723f603051d4d4a1b3320cdba5c97595db12e1948f280776429819d10bfe83a57f349c78 SHA512 3f1ab7e792850e2e21823c59ca9e03d348e78267e3ec5344a04c38e51466159717944c318cf5e61ad9a785d9112b468b9fc37f3b60a40e8764d5cac9f58e7d16
 DIST podman-5.3.2.tar.gz 24207488 BLAKE2B 68f618b74be41bf489de97b009d335f3033634c5c065b1089cc9a6132e38e3a7f707b959d29d955ab0bd805721c14cda90c77fa60f6ba09327f38d4a8bc19112 SHA512 b7007278dd3f493bd0d0185ed4328570d5af527d4864c4435e7b330543d60ba87f04f36c94407d4e11e622a4af8b6467f66474e9b66cbeacb8eecb3088b4439e
-DIST podman-5.4.1.tar.gz 25462641 BLAKE2B 33e2afa9a89a76333940d354af800d7f6b9959e6366d15bd573bccc724b02291d44cdee58d7359956955b014b892c034130e4df2df04fdca15d4f7144920f1cb SHA512 7cbe02c4fdfce83e8becd5c167768d25eab621794e736e7741ca8d4d1384e7db550c59b2f45356aaabd49d9d236bae65bad7f60dc2392a0903ceec812fa5d1c2
+DIST podman-5.4.2.tar.gz 25465417 BLAKE2B f4f586bc99af625a5fa9a6915f101738d8c2abb505de96db6a41fde026baf5832047498b8bf1af6d80a84525a113a21680032886eee49458f92bd7321107bf47 SHA512 482fde529766ca1b509a08bab4beb59a5935ebc6b27bc886c33597183258631e8c8db03ebb521baefd7989305aa76fad14c1359e211a0fe75c855c14bbaca960
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.4.1.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.4.2.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.4.1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-containers/podman/podman-5.4.2.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild
index 04a7f0d9ef..4310198535 100644
--- a/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.5.ebuild
@@ -19,7 +19,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="Apache-2.0 BSD-2 BSD MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
 IUSE="apparmor hardened +kmem +seccomp selinux test"
 
 COMMON_DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
index f2c9beb8fa..a16abceacc 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
@@ -1 +1,2 @@
 DIST nano-8.3.tar.xz 1681216 BLAKE2B 39c400483f79f11da0f959fed769462b65007f9235cb76d38e71d0a63919b659dc553d44f5d13dd13db801ec361fd7a3ad68b68bfa456ac6c169c861e80c6067 SHA512 9f57bb16a30240fdfc8fc31f5a55f681b80dd72de66fa143ef36c59ab696cc672d8fa054f5a4a547324db3deb2fe2f777cd7c1c023b571e2bb36c86a783ff1d6
+DIST nano-8.4.tar.xz 1691256 BLAKE2B 2e5dbe6982ef9d284c6e018abad593bf383f27c85047241bafaa098948b73897c0a81b63aa453385ac93afc1c398936464d5a1fb024d00936ad383c5e5e4403f SHA512 1b8258e341a8722114b24af9d4676fbd8a91dc3639786a81bcd192a7b4fbca87581ab8ebe49493dfb3599ae90b59f4df8ae2a4ee0c0c7ccec9a49b563c82f44a
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
new file mode 100644
index 0000000000..0bc01680eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild
@@ -0,0 +1,105 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
+	inherit autotools git-r3
+else
+	MY_P="${PN}-${PV/_}"
+	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="GNU GPL'd Pico clone with more functionality"
+HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Guide"
+
+LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
+SLOT="0"
+IUSE="debug justify magic minimal ncurses nls +spell unicode"
+
+RDEPEND="
+	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
+	magic? ( sys-apps/file )
+	nls? ( virtual/libintl )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	magic? ( !minimal )
+"
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN static_assert )
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconfargs=(
+		--bindir="${EPREFIX}"/bin
+		--htmldir=/trash
+		$(use_enable !minimal color)
+		$(use_enable !minimal multibuffer)
+		$(use_enable !minimal nanorc)
+		$(use_enable magic libmagic)
+		$(use_enable spell speller)
+		$(use_enable justify)
+		$(use_enable debug)
+		$(use_enable nls)
+		$(use_enable unicode utf8)
+		$(use_enable minimal tiny)
+	)
+
+	econf "${myconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	# Don't use "${ED}" here or things break (#654534)
+	rm -r "${D}"/trash || die
+
+	dodoc doc/sample.nanorc
+	docinto html
+	dodoc doc/faq.html
+	insinto /etc
+	newins doc/sample.nanorc nanorc
+
+	if ! use minimal ; then
+		# Enable colorization by default.
+		sed -i \
+			-e '/^# include /s:# *::' \
+			"${ED}"/etc/nanorc || die
+
+		# Since nano-5.0 these are no longer being "enabled" by default
+		# (bug #736848)
+		local rcdir="/usr/share/nano"
+		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
+		rmdir "${ED}"${rcdir}/extra || die
+
+		insinto "${rcdir}"
+		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
+	fi
+}
+
+pkg_postrm() {
+	[[ -n ${REPLACED_BY_VERSION} ]] && return
+
+	local e
+	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
+	if [[ ${e##*/} == nano ]]; then
+		ewarn "The EDITOR variable is still set to ${e}."
+		ewarn "You can update it with \"eselect editor\"."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index de059f878d..62545c6229 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -4,7 +4,9 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.15.tar.xz 124418604 BLAKE2B 629cb5158cdd790947687a06f4c16bf838ae7b0eb5596bc16bb510dfe838bfcc6ed8e7776962bb6d5ab14379cba1a1f6b12683be370eb4e5debce1ecc446b156 SHA512 e8acc9ea6e70bd4dfb0956e01ee212c592c7b99f5dc0676824eb7cba0aeeb863c1d41df9174771fa775f58ca368c745b2fd7356a3c3fa901a11a33dae24d781a
 DIST qemu-7.2.16.tar.xz 124427328 BLAKE2B 25b69d3f47eef164b5bcb990edad7634f4602d08867cf62470b05005c5de496126064ad2eedfdf9b2d78eb724ae7832b93bc4d302140f14e5d77246cd04086eb SHA512 75623733f39396222e549498fd5dbbc1430593033f7480aa3a34c7e1c765eb5f7776d8827ee47b4b9c52cc1061232637742a8e31c5e5a9019945171d0c65ca7e
+DIST qemu-7.2.17.tar.xz 124405828 BLAKE2B 0613eb18a3dfc8af3c907110191eb1e639c8e4ed4ec80842f8a81e373800834ecae6701a8e87f54ea143f1d508b0799d6127ad2174cd5402ec8ad0bdc9e1e21a SHA512 8490fe388db6f72f56cf082eac6aeda6d9eed4749096d2b56dc2f878b058742b586f02fe9a13280eb408b563e8470da53e058505286683cf79a5805aefa2a06e
 DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
+DIST qemu-8.2.10.tar.xz 132685948 BLAKE2B a1e9a89ee8bdf36b597c7f59b18d19ea34a83bcbd0c3e6bc18b10b9bb1cfad50561af7814076c07da67b11ac280a1f4b39b55f80bbf715d49f264e6b67c69d2b SHA512 f847f4cf2e17b562fe974cf52ad623c516440344e708141913986130ef0436f6d31653250a458061eff7bbffacd1ec726f69964dddad08c9b907dfb90c3f48b6
 DIST qemu-8.2.7.tar.xz 132676368 BLAKE2B 92235f1a30e1d44cf9f7e40e71e9df0375c5eb2d8b267c35df51e102e560f399e4d3f70c674d7b9e206728d9c4a1bafee5ae8f1a91cda900b422f9a6a48c15a8 SHA512 9806bae62d2bdf0781b6bd1c4d7e88bb97019ca5e85140714d7818912603aed1d522a5d29f3434888974ab73e0cfae8b4136ea018b05dcc2d6f6c8b6252075cd
 DIST qemu-8.2.9.tar.xz 132695608 BLAKE2B 0c10feba46e917cd3110bd5926223068d635be0eea7d3f76ae96d631b7fd4cace9d9023aa589d26a6d4ea27d052f7f0a1c27f47175853cd558e5744d10d20aa6 SHA512 3981ff1f58cb88c9325b0c89d7a5f38e069b2a1d14e2cbd887b39382310a004bcd75c5c601fa0f60eba3e1c020b9f3d56000af0be9fbe99546237c30e3277e54
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
@@ -12,3 +14,4 @@ DIST qemu-9.1.2.tar.xz 132481332 BLAKE2B 2cbc55e09a8d46fe0c9e3e7e54b6cf4490bef01
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
 DIST qemu-9.2.2.tar.xz 134756816 BLAKE2B fe341d25010b02c47c263e6b1bf1a64f72226e188bd79901ec0072005994e305f5c75b8e5b3f36af1e3b3f776a04cd18b4084dc044952f34b131f3b94134f5b8 SHA512 b010876da9f91da01dbb9e06705a1358d5f062d0fdd4ad5c8cd8ce3fd43adcefcf72a61216eb8d415281f6607b945ce1cfb6b5fc5692ada9163e8f05b7fb5533
+DIST qemu-9.2.3.tar.xz 134755248 BLAKE2B cdc7300288d2efc50262c605707caab64638fbf1d7528576a0bce71efc1403ccd6aa647a984c84a5ab8ebca28ea9ee7cd8682b4098ca2e63a2f76d2de577c181 SHA512 941a4337a115c65de2fca042932efb31886114f4300226fcf55f04c2c5471bd2b5ce220c4b17e01c3679bd55ba08a1aa7ce399de15e3e5f28c17da52030b139e
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
new file mode 100644
index 0000000000..7ed9ddabff
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild
@@ -0,0 +1,980 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=ajak
+QEMU_DOCS_VERSION="7.2.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-build/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
new file mode 100644
index 0000000000..39674977ab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10.ebuild
@@ -0,0 +1,1001 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..12} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="40619cbb3bf32872df8c53cc457039229428a263"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3.ebuild
new file mode 100644
index 0000000000..dbf0d977e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3.ebuild
@@ -0,0 +1,995 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION=$(ver_cut 1-2).0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{11..13} )
+PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit eapi9-ver linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=()
+	inherit git-r3
+	SRC_URI=""
+	declare -A SUBPROJECTS=(
+		[keycodemapdb]="f5772a62ec52591ff6870b7e8ef32482371f22c6"
+		[berkeley-softfloat-3]="b64af41c3276f97f0e181920400ee056b9c88037"
+		[berkeley-testfloat-3]="e7af9751d9f9fd3b47911f51a5cfd08af256a9ab"
+	)
+
+	for proj in "${!SUBPROJECTS[@]}"; do
+		c=${SUBPROJECTS[${proj}]}
+		SRC_URI+=" https://gitlab.com/qemu-project/${proj}/-/archive/${c}/${proj}-${c}.tar.bz2"
+	done
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+	xdp? ( bpf )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-debug/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xdp? ( net-libs/xdp-tools )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.3"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-build/meson-0.63.0
+	app-alternatives/ninja
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		app-alternatives/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/hppa-firmware64.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+			use test && CONFIG_CHECK+=" IP_MULTICAST"
+			ERROR_IP_MULTICAST="Test suite requires IP_MULTICAST"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+		for file in ${A}; do
+			unpack "${file}"
+		done
+		cd "${WORKDIR}" || die
+		for proj in "${!SUBPROJECTS[@]}"; do
+			mv "${proj}-${SUBPROJECTS[${proj}]}" "${S}/subprojects/${proj}" || die
+		done
+		cd "${S}" || die
+		meson subprojects packagefiles --apply || die
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+	fi
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+		--python="${PYTHON}"
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_softmmu xdp af-xdp)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+			--disable-libcbor
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTap
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-bin'; then
+		echo "  $(best_version sys-firmware/edk2-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
index 71a2fecfb2..47b4aec0e9 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest
@@ -24,8 +24,8 @@ DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
 DIST bash-5.3-beta.tar.gz 10667630 BLAKE2B d6d3a1efd5ed69b131e2831e35c4a620968132e7d9da079de155decb4d3c736cd6c9f1180523e85dd41aeecdb9b380e4768bc551afafaee478168c462ce90929 SHA512 f8f02b4a90312c8e7c589efd1a0a43a4db3bcb47d19cb95190961e4ae254b2d6d26472197ce216868d914fe1adf62741f927552239559a1c3b2c64dfcfaa8cb0
 DIST bash-5.3-beta.tar.gz.sig 94 BLAKE2B a4b85d5755e200abddd5669c3d21b1ee6be8036b27934e25473c14b15ffc1bc7cbbd5a94f39a0dc6bf6050908590509f0ba39d28c33947154cc966e11d454c8c SHA512 72184ca2afe3d0c8c2165516499a61da2aecc0c8c83661cab0038c3d849623115729d2ade73c4b5973ea9b5e8169af4bc2aea51f0b70356af26342285adab2f5
-DIST bash-5.3_beta_p20250307-c3997d51f8ba359eeabb45b90b9cdae4fe599b5a.tar.gz 15761772 BLAKE2B c87d4cac04e910bd9f7441b349233c92c53cfa3e74356c3ffc18d236313f8e9d1c7b49ffaa7435aee8b1ef4ce216a74f2ffe5564e30d448d8ce77895df5a2f75 SHA512 b5802f900a081880ae4f3c799bdf98d4bcc70661921d27ab403dcc4acbececc834ffdb3c02d1ea7d24736e122f6a3e9286a1306c3962c8daef94606e8f999c3c
-DIST bash-5.3_beta_p20250324-e009d30dfff92d5389f7bb05ec8627e524d5a0ca.tar.gz 15771260 BLAKE2B 4d347c16d0dd897c289447e64d4e99c0673cf058fef3db630243c76095e335079715fb913198ea7ec6755d4a197e837fe8448feeb2648b1d815199159b2de8b9 SHA512 55558af53b4b880ea744c9711cd823991e97876daf21ef67a72be69ffe762bc7c698425f0fc1e8ab1818736f8d64d6cef15f0cb604ac0dae066c2df976102b87
+DIST bash-5.3_beta_p20250331-a6767763de5e7859107711b166a64a9e4a77a8ae.tar.gz 15771417 BLAKE2B 79257460482c2d6fca55bb8101c0fbfcc9f0810f3e0e54eb8e94e352e87eea2c54873e2822caa963acb752f1c4156780398e4bf44b57986a2b2f600919149094 SHA512 850ae02f4e924165ec75a71fdd5956e13f4ee40916e5a7854ff90cfde6cd73124a46cb4c8a89f750fc78eb912905835a9b303b0f5febbd40666678af81f0f1fa
+DIST bash-5.3_beta_p20250404-2e113467f061587a3475b692d25ca449717834c8.tar.gz 15769616 BLAKE2B f1bd12beaff9d72675ddb58a5454da9414c30ae2e0170c971094142eaae43f8b56f92489fafb373a3df2ab76029cd78eddf103ac08c73de169375de9383b971e SHA512 03ba3aabc4e91bcea5cb99b56dbd6e7110801fc5d640514283058c44b64e6448f678caca350f7887657ede3dfe7541df9a9aaec1e5f66047fff52a154da14694
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250324.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250324.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild
index 77300f48ff..0ba5de29ee 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250324.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250331.ebuild
@@ -45,7 +45,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="e009d30dfff92d5389f7bb05ec8627e524d5a0ca"
+	BASH_COMMIT="a6767763de5e7859107711b166a64a9e4a77a8ae"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250307.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250307.ebuild
rename to sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild
index 1b010d24a0..9a968611af 100644
--- a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250307.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.3_beta_p20250404.ebuild
@@ -45,7 +45,7 @@ elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
 	# the alpha, and the next pre-release is usually quite far away.
 	#
 	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
-	BASH_COMMIT="c3997d51f8ba359eeabb45b90b9cdae4fe599b5a"
+	BASH_COMMIT="2e113467f061587a3475b692d25ca449717834c8"
 	SRC_URI="https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-${BASH_COMMIT}.tar.gz -> ${P}-${BASH_COMMIT}.tar.gz"
 	S=${WORKDIR}/${PN}-${BASH_COMMIT}
 else
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild
index 91497ec73b..f94a7b1a1a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.31.6-r1.ebuild
@@ -95,9 +95,10 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
 	# Cuda
-	"${FILESDIR}/${PN}-3.30.3-cudahostld.patch"
+	"${FILESDIR}"/${PN}-3.30.3-cudahostld.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	"${FILESDIR}"/${PN}-3.31.6-curl-8.13.0.patch
 )
 
 cmake_src_bootstrap() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.6-curl-8.13.0.patch b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.6-curl-8.13.0.patch
new file mode 100644
index 0000000000..08bbcf4a3f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/files/cmake-3.31.6-curl-8.13.0.patch
@@ -0,0 +1,36 @@
+https://bugs.gentoo.org/953060
+https://gitlab.kitware.com/cmake/cmake/-/issues/26754
+https://gitlab.kitware.com/cmake/cmake/-/merge_requests/10449
+
+From 1b0c92a3a1b782ff3e1c4499b6ab8db614d45bcd Mon Sep 17 00:00:00 2001
+From: Brad King <brad.king@kitware.com>
+Date: Mon, 10 Mar 2025 11:08:42 -0400
+Subject: [PATCH] cmCurl: Avoid using undocumented type for CURLOPT_NETRC
+ values
+
+Since upstream curl commit `2ec00372a1` (curl.h: change some enums to
+defines with L suffix, 2025-02-25), the `CURL_NETRC_*` constants are
+integer literals instead of `enum CURL_NETRC_OPTION`.  It turns out
+that `curl_easy_setopt` has always expected a `long` anyway, and
+that `CURL_NETRC_OPTION` is not documented for public use.
+
+Fixes: #26754
+---
+ Source/cmCurl.cxx | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx
+index b9133ed7d47..0cf8a71a72d 100644
+--- a/Source/cmCurl.cxx
++++ b/Source/cmCurl.cxx
+@@ -170,7 +170,7 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
+                                  const std::string& netrc_file)
+ {
+   std::string e;
+-  CURL_NETRC_OPTION curl_netrc_level = CURL_NETRC_LAST;
++  long curl_netrc_level = CURL_NETRC_LAST;
+   ::CURLcode res;
+ 
+   if (!netrc_level.empty()) {
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
index b5e24ed5bf..90f9651fa1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/libtool/Manifest
@@ -1,2 +1 @@
-DIST libtool-2.4.7.tar.xz 1016040 BLAKE2B 5e022586337637dd634bd40578ad944bec6e3b8de41f95d55777b90cc88cbc4badb3d76cbf0e638166ece1ea7de828e83590e1e6bac30c1e4b1c254a11a742f2 SHA512 47f4c6de40927254ff9ba452612c0702aea6f4edc7e797f0966c8c6bf0340d533598976cdba17f0bdc64545572e71cd319bbb587aa5f47cd2e7c1d96f873a3da
 DIST libtool-2.5.4.tar.xz 1056924 BLAKE2B 47de3c49a690d44d7ddd5e3b5e4090c91dc5fbb9c40fc4a3963e150fb7329326ee3e21b8c149974726171c4b0380028e0efc7a369c4f04357eea46f69852e1cc SHA512 eed207094bcc444f4bfbb13710e395e062e3f1d312ca8b186ab0cbd22dc92ddef176a0b3ecd43e02676e37bd9e328791c59a38ef15846d4eae15da4f20315724
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-grep-3.8.patch b/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-grep-3.8.patch
deleted file mode 100644
index 8f1de478ae..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-grep-3.8.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-https://bugs.gentoo.org/892635
-https://lists.gnu.org/archive/html/libtool-patches/2022-12/msg00004.html
-
-From 414deacee0f564afdf2d7750450274c581330a59 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20B=C3=A9rat?= <fberat@redhat.com>
-Date: Wed, 21 Dec 2022 13:14:03 +0100
-Subject: [PATCH] tests: Fix grep warning about stray \ before /
-
-Recent version of grep emit a warning if stray \ is found before /.
-This leads to the link-order test failure.
-
- * tests/link-order.at: Remove unneeded \ before /
---- a/tests/link-order.at
-+++ b/tests/link-order.at
-@@ -99,12 +99,12 @@ aix* | interix*) ;;  # These systems have different path syntax
-   case $hardcode_direct$hardcode_direct_absolute in
-   yesno)
-     AT_CHECK([if $EGREP relinking stderr; then
--         $EGREP " .*\/new\/lib/libb$shared_ext .*\/old\/lib/libcee$shared_ext" stdout
-+         $EGREP " .*/new/lib/libb$shared_ext .*/old/lib/libcee$shared_ext" stdout
-        else :; fi], [0], [ignore], [], [echo "wrong link order"])
-     ;;
-   *)
-     AT_CHECK([if $EGREP relinking stderr; then
--         $EGREP " -L.*\/new\/lib -lb -L.*\/old\/lib -lcee" stdout
-+         $EGREP " -L.*/new/lib -lb -L.*/old/lib -lcee" stdout
-        else :; fi], [0], [ignore], [], [echo "wrong link order"])
-     ;;
-   esac
--- 
-2.38.1
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-werror-lto.patch b/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-werror-lto.patch
deleted file mode 100644
index c0db69f3e2..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/files/libtool-2.4.7-werror-lto.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-https://lists.gnu.org/archive/html/libtool-patches/2022-12/msg00000.html
-
-From d72817b1ee5d7b666bf30b0234e32423252d6ad8 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Sat, 10 Dec 2022 02:00:22 +0000
-Subject: [PATCH] Allow -Werror and -Werror=* through flag filtering
-
-* build-aux/ltmain.in (func_mode_link): allow -Werror and -Werror=* through
-  flat filtering at link time.
-
-  This is needed for detecting likely-runtime problems with LTO using
-  e.g. -Werror=odr or -Werror=lto-type-mismatch.
-
-Bug: https://bugs.gentoo.org/884767
-Signed-off-by: Sam James <sam@gentoo.org>
---- a/build-aux/ltmain.in
-+++ b/build-aux/ltmain.in
-@@ -5408,10 +5408,11 @@ func_mode_link ()
-       # -fsanitize=*         Clang/GCC memory and address sanitizer
-       # -fuse-ld=*           Linker select flags for GCC
-       # -Wa,*                Pass flags directly to the assembler
-+      # -Werror, -Werror=*   Report (specified) warnings as errors
-       -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
-       -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
-       -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
--      -specs=*|-fsanitize=*|-fuse-ld=*|-Wa,*)
-+      -specs=*|-fsanitize=*|-fuse-ld=*|-Wa,*|-Werror|-Werror=*)
-         func_quote_arg pretty "$arg"
- 	arg=$func_quote_arg_result
-         func_append compile_command " $arg"
---- a/build-aux/ltmain.sh
-+++ a/build-aux/ltmain.sh
-@@ -5408,10 +5408,11 @@ func_mode_link ()
-       # -fsanitize=*         Clang/GCC memory and address sanitizer
-       # -fuse-ld=*           Linker select flags for GCC
-       # -Wa,*                Pass flags directly to the assembler
-+      # -Werror, -Werror=*   Report (specified) warnings as errors
-       -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
-       -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*|-tp=*|--sysroot=*| \
-       -O*|-g*|-flto*|-fwhopr*|-fuse-linker-plugin|-fstack-protector*|-stdlib=*| \
--      -specs=*|-fsanitize=*|-fuse-ld=*|-Wa,*)
-+      -specs=*|-fsanitize=*|-fuse-ld=*|-Wa,*|-Werror|-Werror=*)
-         func_quote_arg pretty "$arg"
- 	arg=$func_quote_arg_result
-         func_append compile_command " $arg"
--- 
-2.38.1
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.4.7-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.4.7-r4.ebuild
deleted file mode 100644
index 3b518d508e..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-build/libtool/libtool-2.4.7-r4.ebuild
+++ /dev/null
@@ -1,127 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-# Please bump with dev-libs/libltdl.
-
-# bug #225559
-LIBTOOLIZE="true"
-WANT_LIBTOOL="none"
-inherit autotools prefix multiprocessing
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/libtool.git"
-	inherit git-r3
-else
-	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-
-LICENSE="GPL-2"
-SLOT="2"
-IUSE="vanilla"
-
-# Pull in libltdl directly until we convert packages to the new dep.
-RDEPEND="
-	sys-devel/gnuconfig
-	>=dev-build/autoconf-2.69:*
-	>=dev-build/automake-1.13:*
-"
-DEPEND="${RDEPEND}"
-[[ ${PV} == *9999 ]] && BDEPEND="sys-apps/help2man"
-
-# Note that we have more patches in https://gitweb.gentoo.org/proj/elt-patches.git/
-# for package builds. The patches here are just those which are definitely fine
-# for the system-wide libtool installation as well.
-PATCHES=(
-	# bug #109105
-	"${FILESDIR}"/${PN}-2.4.3-use-linux-version-in-fbsd.patch
-	# bug #581314
-	"${FILESDIR}"/${PN}-2.4.6-ppc64le.patch
-
-	"${FILESDIR}"/${PN}-2.2.6a-darwin-module-bundle.patch
-	"${FILESDIR}"/${PN}-2.4.6-darwin-use-linux-version.patch
-	"${FILESDIR}"/${PN}-2.4.7-werror-lto.patch
-	"${FILESDIR}"/${PN}-2.4.7-grep-3.8.patch
-)
-
-src_prepare() {
-	if [[ ${PV} == *9999 ]] ; then
-		eapply "${FILESDIR}"/${PN}-2.4.6-pthread.patch # bug #650876
-		./bootstrap || die
-	else
-		PATCHES+=(
-			"${FILESDIR}"/${PN}-2.4.6-pthread_bootstrapped.patch # bug #650876
-		)
-	fi
-
-	# WARNING: File build-aux/ltmain.sh is read-only; trying to patch anyway
-	chmod +w build-aux/ltmain.sh || die
-
-	if use vanilla ; then
-		eapply_user
-		return 0
-	else
-		default
-	fi
-
-	if use prefix ; then
-		# seems that libtool has to know about EPREFIX a little bit
-		# better, since it fails to find prefix paths to search libs
-		# from, resulting in some packages building static only, since
-		# libtool is fooled into thinking that libraries are unavailable
-		# (argh...). This could also be fixed by making the gcc wrapper
-		# return the correct result for -print-search-dirs (doesn't
-		# include prefix dirs ...).
-		eapply "${FILESDIR}"/${PN}-2.2.10-eprefix.patch
-		eprefixify m4/libtool.m4
-	fi
-
-	pushd libltdl >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-	popd >/dev/null || die
-	AT_NOELIBTOOLIZE=yes eautoreconf
-
-	# Make sure timestamps don't trigger a rebuild of man pages. #556512
-	if [[ ${PV} != *9999 ]] ; then
-		touch doc/*.1 || die
-		export HELP2MAN=true
-	fi
-}
-
-src_configure() {
-	# the libtool script uses bash code in it and at configure time, tries
-	# to find a bash shell.  if /bin/sh is bash, it uses that.  this can
-	# cause problems for people who switch /bin/sh on the fly to other
-	# shells, so just force libtool to use /bin/bash all the time.
-	# Do not bother hardcoding the full path to sed.
-	# Just rely on $PATH. bug #574550
-	export CONFIG_SHELL="${EPREFIX}"/bin/bash
-	export ac_cv_path_SED="sed"
-	export ac_cv_path_EGREP="grep -E"
-	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
-	export ac_cv_path_FGREP="grep -F"
-	export ac_cv_path_GREP="grep"
-	export ac_cv_path_lt_DD="dd"
-
-	[[ ${CHOST} == *-darwin* ]] && local myconf="--program-prefix=g"
-
-	ECONF_SOURCE="${S}" econf ${myconf} --disable-ltdl-install
-}
-
-src_test() {
-	emake check TESTSUITEFLAGS="--jobs=$(get_makeopts_jobs)"
-}
-
-src_install() {
-	default
-
-	local x
-	while read -d $'\0' -r x ; do
-		ln -sf "${EPREFIX}"/usr/share/gnuconfig/${x##*/} "${x}" || die
-	done < <(find "${ED}" '(' -name config.guess -o -name config.sub ')' -print0)
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
index ab8839b0a6..065bff9572 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/Manifest
@@ -12,7 +12,13 @@ DIST meson-1.6.1.tar.gz 2276144 BLAKE2B 7ccdb3bf3f701fc787fabf91413db8301a8658b8
 DIST meson-1.6.1.tar.gz.asc 833 BLAKE2B 6666eca8e5506b8692fc29ba66dc3ee9d725a7d720a7b43db720098f7e00671e71993586606c187d8314e3919474f5733d64a8d052be6552cbcf013a872905ab SHA512 543cf396de0a58998c3587aa05580fa9a56734db40b74fc5fbb22cd56124531804a5360d6b9acb9baa71753ac04c343364da4d78a0d366d8e8bc760030ebf8d3
 DIST meson-1.7.0.tar.gz 2293975 BLAKE2B 64465b33c2358fddc3594807ee5d251dc6bcc1030ed3559d2d5dc33b7092a512b8a3d3b75cc7152812dbc62631d3b9fba596cd105654ae3ff38f01be8ada5232 SHA512 a5d1f00b193ca37ae64f85c9dfc29a2661c167d82d9953b9acd1393b222b05fa5fc03ffdf00fd1ae7a2014da3a7366c35f70bf02e3204e929b74f7b00c17c840
 DIST meson-1.7.0.tar.gz.asc 833 BLAKE2B 34783968262e5ce54cca7f4878b09e7611670ede620b8588ac915bb55fed7f4051e151d789b10e9bd650241149dc9930c14b356c3ce436682d496eeabc805672 SHA512 85ec14f080d0d1492922c971909dc734ab1cd4914a567afbfeff5dc00d19a9a72e6e0668280fc045f270c49389ea03059b9eeb831788b2154fb39116b38f6e5e
+DIST meson-1.7.1.tar.gz 2295198 BLAKE2B a1eda88cc349f74ab00e367daf5f27452875f483d95d7dcad2255b5df040efd39019dd6b1b61a58709662193c3dce28c6f378e80f7c15a4b9be694ed4173f59d SHA512 bad913c59f540b701a0d234a868bd88615ccfcdc09931f8dea7b4da48bcc3a3c3c7e9cdeeff5abfcd48c6b2b25e5c60590811125b7156da36b714e00b35813c6
+DIST meson-1.7.1.tar.gz.asc 833 BLAKE2B 1e854c5f026471d1fa1f9f9ca26a8be06518564694b92ba8a751f2c05fa430359c5f6c9b636c0df9a2db338f61a9750e4080d60171a0e3bef49163c416166ef6 SHA512 266de0d34828688491ad3167bb3b88f489b579af1bbbb20a28e3ccfc342fa04659970d4db5e10a0470a5c52d37f4b04f718d7af4c3c3e9e1e67c69c10f3c4662
+DIST meson-1.7.2.tar.gz 5009274 BLAKE2B f5a19d7c0dfa35efda5bdef972fa6362a64fee2c74be0c09dee6d52c30a8b0169dbe7fab3199add306c778f6a57196251b44ec27ff6b5e038e12c11b27513a54 SHA512 c3c71ae0e0c31d8d72e200bb5fd5e6584ce41aabe1e85575d50371f82ed02c6e346da3b0b4a2786199b9410daaa1622807a88bfc8ac991cf134bad4a53b3c863
+DIST meson-1.7.2.tar.gz.asc 996 BLAKE2B 9a34bb86f15eb92d4eb972835e8e18e175c869a6ba9d88310ca6058654200b227c7a4a945eee220784f584737a3b74ffcd06e2b60a3e502e49af5da69eb1e5bf SHA512 a1e0461a28dfc8ba74ffd919511584148094c2bc809c3d380749856cbdaa33473c1a0c1ec92928020f50e116803fc03deb37b3ee2aca7e56287b155a5ccc36ac
 DIST meson-reference-1.4.2.3 339324 BLAKE2B 1a4fbd8c27a8cfba773777eabd2ebaa0f76ec0c61dcfe1c7b4483737b348ff9528d68f26e68d7d40b2e1875611eed5b9a31c1cf55fed8eabb42fc1e31d9ef14b SHA512 8b8ec43e812599203ec44c08805eb6818485805c45b9c69802261eaa35efc97846a96f6472c6b1ef5f6c703e7153fd957df7b805f173ca3400a2030dfbe002ca
 DIST meson-reference-1.5.2.3 341110 BLAKE2B 0d588b796f7f2da2dcb0e7822acde6a9a461930da4bfead3cf9148fa0fac18cd0ccbc6e891f555c973836f1c16b4eae299908a838a0b6843293de8815d30fc23 SHA512 64715ce2113e362e7d67179fe13566bc8f84ce7f4e6d795b836f42455a871173fee06e3e969e2996022d7e6c9b4b5379587a4c0c3d97b4bca527fb8902d3547f
 DIST meson-reference-1.6.1.3 343730 BLAKE2B 55df822192781a70e4bc44cfe14fb363e3f820406260ca9705d7fdb5fad1bf0117e3f1325d37e58e23477bc075ab6bd84056409355ec694f72eeaa5bf982ecc7 SHA512 553cdcd86a7a600cda05ac970cc285c4c50017d1e7d2925645d7f19a62b34c2f079673cafecf4111aa102afbe9d8e4d56f166d1d9940b740eeec0bb99d6cbc0d
 DIST meson-reference-1.7.0.3 344764 BLAKE2B 615c70325b6ca3b964bf2827f20f07845150943b6cd95a0599b0392299e2a9338921b52bbe3613fc03fa931c28fb2121801bdb74880f2bd4fecb051b7f1fcb4b SHA512 9d9a3862602251ca780acdf18cee4ab9cd14404481e216b557eafc88b23561ecf481836898b78cbc4ee3539869b5578c649a5c71f32b3074d8125b867ea4751d
+DIST meson-reference-1.7.1.3 344764 BLAKE2B f4b6a5eb80f143310e9aae3fe512b5146b39df4e74e589c571d3f58ddfcb3298d1accff417c055e46a4ad61fc0557723eb4d89607a4793d1bcc134f1e83ab3eb SHA512 f36e4adcf7eab70738c71c48c87328bc436168dc605c0931b746d4b48915269dc9245215a4aa968046e4cb0f5167f595da1cf2acd96d87ed47aea9b34b63a652
+DIST meson-reference-1.7.2.3 344764 BLAKE2B 82de9a7a01c2f1b45a2b3432deb4713af3cfd3b2dc9af8802488b7d1b86dde9b6ac81f90b144006a79e90b313e1d4d23f9cc90e17255ce9573e5487d3e20c286 SHA512 d482a3b3bed671705d6316e106984ad2c2169fe890349437e512455705ee8dddb31a29d31f44402a4c7c5bd2f78595b75bfc5ad34d8c0337b66f40837b08ee56
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild
new file mode 100644
index 0000000000..05aa3dd4f8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.1.ebuild
@@ -0,0 +1,227 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
new file mode 100644
index 0000000000..1748aeb50e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.7.2.ebuild
@@ -0,0 +1,230 @@
+# Copyright 2016-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit bash-completion-r1 edo distutils-r1 flag-o-matic toolchain-funcs
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit ninja-utils git-r3
+
+	BDEPEND="
+		${NINJA_DEPEND}
+		$(python_gen_any_dep 'dev-python/pyyaml[${PYTHON_USEDEP}]')
+	"
+
+else
+	inherit verify-sig
+
+	MY_PV=${PV/_/}
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	SRC_URI="
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz
+		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
+		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
+	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-eschwartz )"
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/eschwartz.gpg
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test test-full"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test-full? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		app-alternatives/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+		dev-build/cmake
+	)
+	test-full? (
+		|| ( dev-lang/rust dev-lang/rust-bin )
+		dev-lang/nasm
+		>=dev-lang/pypy-3
+		dev-lang/vala
+		dev-python/cython
+		virtual/fortran
+		virtual/jdk
+
+		app-text/doxygen
+		dev-cpp/gtest
+		dev-libs/protobuf
+		dev-util/bindgen
+		dev-util/gtk-doc
+		dev-util/itstool
+		llvm-core/llvm
+		media-libs/libsdl2
+		media-libs/libwmf
+		net-libs/libpcap
+		sci-libs/hdf5[fortran]
+		sci-libs/netcdf
+		sys-cluster/openmpi[fortran]
+		sys-devel/bison
+		sys-devel/flex
+
+		dev-qt/linguist-tools:5
+		dev-qt/qtwidgets:5
+		dev-qt/qtbase:6[gui,widgets]
+		dev-qt/qttools:6
+		dev-util/gdbus-codegen
+		x11-libs/gtk+:3
+
+		dev-libs/wayland
+		dev-util/wayland-scanner
+	)
+"
+RDEPEND="
+	!<dev-build/muon-0.2.0-r2[man(-)]
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.1-python-path.patch
+)
+
+src_unpack() {
+	if [[ ${PV} = *9999* ]]; then
+		git-r3_src_unpack
+	else
+		default
+		use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+}
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# clippy-driver fails, but only when run via portage.
+		#
+		#   error[E0463]: can't find crate for `std`
+		#   error: requires `sized` lang_item
+		-e 's/test_rust_clippy/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+	# nvcc breaks on essentially any LDFLAGS
+	# https://bugs.gentoo.org/936757
+	# https://github.com/mesonbuild/meson/issues/11234
+	rm -r "test cases/cuda"/* || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_check_deps() {
+	if [[ ${PV} = *9999* ]]; then
+		python_has_version "dev-python/pyyaml[${PYTHON_USEDEP}]"
+	fi
+}
+
+python_configure_all() {
+	if [[ ${PV} = *9999* ]]; then
+		# We use the unsafe_yaml loader because strictyaml is not packaged. In
+		# theory they produce the same results, but pyyaml is faster and
+		# without safety checks.
+		edo ./meson.py setup \
+			--prefix "${EPREFIX}/usr" \
+			-Dhtml=false \
+			-Dunsafe_yaml=true \
+			docs/ docs/builddir
+	fi
+}
+
+python_compile_all() {
+	if [[ ${PV} = *9999* ]]; then
+		eninja -C docs/builddir
+	fi
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# meson has its own tests for LTO support. We don't need to verify that
+		# all tests work when they happen to use it. And in particular, this
+		# breaks rust.
+		filter-lto
+
+		# remove unwanted python_wrapper_setup contents
+		# We actually do want to non-error if python2 is installed and tested.
+		remove="${T}/${EPYTHON}/bin:"
+		PATH=${PATH/${remove}/}
+
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		${EPYTHON} -u run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+
+	if [[ ${PV} = *9999* ]]; then
+		DESTDIR="${ED}" eninja -C docs/builddir install
+	else
+		newman "${DISTDIR}"/meson-reference-${MY_PV}.3 meson-reference.3
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
index 05aa3dd4f8..20a9cf91dd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-9999.ebuild
@@ -29,6 +29,9 @@ else
 		verify-sig? ( https://github.com/mesonbuild/meson/releases/download/${MY_PV}/${MY_P}.tar.gz.asc )
 		https://github.com/mesonbuild/meson/releases/download/${MY_PV}/meson-reference.3 -> meson-reference-${MY_PV}.3
 	"
+	# Releases may be signed by those listed in Releasing.md. Jussi
+	# remains the default release manager.
+	# https://github.com/mesonbuild/meson/commit/c2d795735fa1c46c54d6aed4d4a30f36a1f853cb
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-jpakkane )"
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r2.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r2.ebuild
index 4187a128ec..0e994fdd33 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.14.0-r2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -28,7 +28,7 @@ DESCRIPTION="Google C++ Testing Framework"
 HOMEPAGE="https://github.com/google/googletest"
 
 LICENSE="BSD"
-SLOT="0"
+SLOT="0/${PV}"
 IUSE="doc examples test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2-r1.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2-r1.ebuild
index f791647945..9772c8c966 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-1.15.2-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -28,7 +28,7 @@ DESCRIPTION="Google C++ Testing Framework"
 HOMEPAGE="https://github.com/google/googletest"
 
 LICENSE="BSD"
-SLOT="0"
+SLOT="0/${PV}"
 IUSE="abseil doc examples test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-9999.ebuild
index f791647945..9772c8c966 100644
--- a/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-cpp/gtest/gtest-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -28,7 +28,7 @@ DESCRIPTION="Google C++ Testing Framework"
 HOMEPAGE="https://github.com/google/googletest"
 
 LICENSE="BSD"
-SLOT="0"
+SLOT="0/${PV}"
 IUSE="abseil doc examples test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
index 25ab0c8a1d..1218150a38 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.49.1.ebuild
@@ -325,6 +325,9 @@ multilib_src_configure() {
 	if [[ ${CHOST} != *-darwin* ]] ; then
 		# set SONAME for the library
 		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
 	fi
 
 	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
index 2d4ae2f992..a8597d1058 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-9999.ebuild
@@ -321,6 +321,9 @@ multilib_src_configure() {
 	if [[ ${CHOST} != *-darwin* ]] ; then
 		# set SONAME for the library
 		options+=( --soname=legacy )
+	else
+		# to allow install_name_tool id change
+		append-ldflags -headerpad_max_install_names
 	fi
 
 	# https://sqlite.org/forum/forumpost/4f4d06a9f6683bb9
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
index 13c89b56a3..c236d38e10 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/Manifest
@@ -1,6 +1,4 @@
-DIST strace-6.12.tar.xz 2628804 BLAKE2B 8077a9ae0b05065cf2de7a2bd630a6275735bd77765a5654cb34f17c93b3fda69d77743c5eb8e75efcc1f6ec8707698642d30bd62cc3aa4355bec0d5a00eec89 SHA512 ae28f0b6b6fdc980898f11d1903aacb5a31760a07d63bd7cbc8f9b5f337d9db6b40464d6b61a9b03ba6442b476edb78afc91348f539f7780cdd98b174c6a9a1d
-DIST strace-6.12.tar.xz.asc 801 BLAKE2B 0c3d81747128039c2304c2c6509f14d868c49b1d7036128ab58a2df7690ea40ab643a54f274c0fecbae4bbc4e90ee5d05037630525db828aa4995199ab415cba SHA512 7b8d6148f3160e39033016d17a54f0b0e0a67fb20ab688486db401521d45ba5197d4a8106f6b173f08a787e59d88147a71ee88435afe0a545fc8f75f621bee79
 DIST strace-6.13.tar.xz 2642452 BLAKE2B cdac801dc5b0fe9c165d9d99a41e51aacf13e8bd05baccca26fff360f2a7052a3f1b7016dee85a37d074c4e0f3b9255a29a146e13b6099a2ef8f9d493e3b1079 SHA512 e702238f32882f92a2b2834fb853b5fa3d81decb441b69f0e74ba0205f6a586bfe698e34bfbac6d4f766ebd25d0b99d4679d9eb27845e5129cfd4e34ced6a8d2
 DIST strace-6.13.tar.xz.asc 801 BLAKE2B 508286a008213e2bd3e0cba6c339a61abae1460f0f71b885c7bef480431bdf5e190a2cb3e44d236019ed54d3bf3a257ebb94e2161971abe0648f685e7849e3bd SHA512 a59e4aeff491ad62603b0591653e7da5e8a4ef0fedcf2faad3f485993b37b738c0809cefa5753ab7d1b85f3b6c87b423b6416dea36def65e220548ee0b4afb46
-DIST strace-6.9.tar.xz 2466252 BLAKE2B 2da51f253ea18f27b5fabafaebdc54805aeca5b750bec6169c269dbcadb98cf76a47bf92dd619458ca86d46ec7a03710e16e0ac4973d89a86edc2d0b853714c8 SHA512 aa80b9b6ec41082f1710f2327f7a22003cdce6d95ab0e5083ada9c5b7b40b8f7cbc7dc6c017878dc0e42c52e405e98ed1488c51d17bc3538989ff4be2c2411e1
-DIST strace-6.9.tar.xz.asc 801 BLAKE2B ccb3d026a272bc02d351fd15f8b18a50a8653cda247ea9baa938820fb3c870e1803562d7e17eac3d4f1842911a4e904bc88ba267cb74aeac869185e30cd89d48 SHA512 577a3f5d0bdd51b995755a76b58e6bdf6a0a173966bb1d95ebba0a59df8a8e828eb5eca4cda55c9faf7e31053652911541134107199c073ec24fa877cec393bd
+DIST strace-6.14.tar.xz 2650972 BLAKE2B 940bb7d54c29e8f22dcf67e617e8a664a7147bb96538b3a8a680698fa33f528d6082fb9c9d7eda9540e7730fa0f7d88aafbead4cccd8844ca687e2e4a1c8a7d2 SHA512 2a18dbfddb054dc7845fa6645d194297c6fe7d67607f812198e712b8b1f75d6e99e9e19587e9ad799e9566d7a558e2d64fe216a61456d5c3f23dfa2e42e3b412
+DIST strace-6.14.tar.xz.asc 801 BLAKE2B d25bc4e4164861c258da9037579603f5cfbfc45ee75c172fa90783d3ef9bfb743690b50bb6a6350f24937aa4cb4d87ea63e05f48d081c07ac45f0796486bb733 SHA512 8c107df8bedd2a9574e390e4bb576062681a5137bb48efbdb9ed2f9229871ffc847936b5e2341e335702601feba3a0935b9cc22a316607b5e32858b5cbcb0fd8
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.12.ebuild
deleted file mode 100644
index c96750b5e4..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.12.ebuild
+++ /dev/null
@@ -1,120 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools edo flag-o-matic toolchain-funcs verify-sig
-
-DESCRIPTION="Useful diagnostic, instructional, and debugging tool"
-HOMEPAGE="https://strace.io/"
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://github.com/strace/strace.git"
-	inherit git-r3
-else
-	SRC_URI="
-		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
-		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
-	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
-
-LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
-SLOT="0"
-IUSE="aio perl selinux static test unwind elfutils"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="?? ( unwind elfutils )"
-
-BDEPEND="
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-strace-20151021 )
-"
-LIB_DEPEND="
-	unwind? ( sys-libs/libunwind[static-libs(+)] )
-	elfutils? ( dev-libs/elfutils[static-libs(+)] )
-	selinux? ( sys-libs/libselinux[static-libs(+)] )
-"
-# strace only uses the header from libaio to decode structs
-DEPEND="
-	static? ( ${LIB_DEPEND} )
-	aio? ( >=dev-libs/libaio-0.3.106 )
-"
-RDEPEND="
-	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
-	perl? ( dev-lang/perl )
-"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-6.5-static.patch"
-)
-
-src_prepare() {
-	default
-
-	if [[ ! -e configure ]] ; then
-		# git generation
-		sed /autoreconf/d -i bootstrap || die
-		edo ./bootstrap
-		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
-	fi
-
-	eautoreconf
-
-	# Stub out the -k test since it's known to be flaky. bug #545812
-	sed -i '1iexit 77' tests*/strace-k.test || die
-}
-
-src_configure() {
-	# Set up the default build settings, and then use the names strace expects.
-	tc-export_build_env BUILD_{CC,CPP}
-	local v bv
-	for v in CC CPP {C,CPP,LD}FLAGS ; do
-		bv="BUILD_${v}"
-		export "${v}_FOR_BUILD=${!bv}"
-	done
-
-	filter-lfs-flags # configure handles this sanely
-
-	export ac_cv_header_libaio_h=$(usex aio)
-	use elibc_musl && export ac_cv_header_stdc=no
-
-	local myeconfargs=(
-		--disable-gcc-Werror
-
-		# Don't require mpers support on non-multilib systems (bug #649560)
-		--enable-mpers=check
-
-		# We don't want to pin to exact linux-headers versions (bug #950309)
-		--enable-bundled=yes
-
-		$(use_enable static)
-		$(use_with unwind libunwind)
-		$(use_with elfutils libdw)
-		$(use_with selinux libselinux)
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_test() {
-	if has usersandbox ${FEATURES} ; then
-		# bug #643044
-		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
-		return 0
-	fi
-
-	default
-}
-
-src_install() {
-	default
-
-	if use perl ; then
-		exeinto /usr/bin
-		doexe src/strace-graph
-	fi
-
-	dodoc CREDITS
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
index 571c162459..196f558d28 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.14.ebuild
@@ -16,7 +16,7 @@ else
 		https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz
 		verify-sig? ( https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 fi
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/strace.asc
diff --git a/sdk_container/src/third_party/portage-stable/dev-embedded/u-boot-tools/u-boot-tools-2025.01.ebuild b/sdk_container/src/third_party/portage-stable/dev-embedded/u-boot-tools/u-boot-tools-2025.01.ebuild
index 8e38578e83..004feee18e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-embedded/u-boot-tools/u-boot-tools-2025.01.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-embedded/u-boot-tools/u-boot-tools-2025.01.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 ppc ppc64 ~riscv x86"
 IUSE="envtools"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
index e36fd25295..2bf0730f64 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/Manifest
@@ -1,3 +1,2 @@
-DIST go1.23.6.src.tar.gz 28179132 BLAKE2B 25c988547604c35de65aedfdee5af9f35f7a1c43f634c0147373d9c86baf2bb10068463f70013ef60acd3088149eb16502958b1ca63d7cee310e32eaddf1578a SHA512 c504476d42cdbcd1b6afe53c0974e82c19eb0efac974bc06d41c1641440676891cfe6416455a0cfc81fe82902a9b82ea0a1d95089c676667d05487e45f5e04e3
 DIST go1.23.7.src.tar.gz 28181215 BLAKE2B d3c9bff18438f90f6730e1ad9580a3f97d266f90533552cd73b63b512c694de76466435f274dc2b190c672cdbd83ffaf735e4e74c12e426cac920b81dbfd88af SHA512 79192b760ab6fcc9512fd879a9484a3566fdeec5eace36c54b728cd9cb033e7ac68065a42fc657b351a106d684b79fdbefbf682cf63209c0191e7e7c8c0a0147
 DIST go1.24.1.src.tar.gz 30777528 BLAKE2B 76217ec25a721183591a434b012bd9cfb6d6206410aafffce4490bff8053440f2aa590bac0cfb839f10c19a3368fe60515a61123a21d187f5289ba0ae1399c1c SHA512 a924d6bdc7e7101917e6d063bc7b471390525394e79224c152997564657c4362b5600e0c8bf6ee857d345129ccf7368bdf4ed2251ab740446ea2abda144e6353
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild
deleted file mode 100644
index 8e165768f1..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.6.ebuild
+++ /dev/null
@@ -1,162 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-export CBUILD=${CBUILD:-${CHOST}}
-export CTARGET=${CTARGET:-${CHOST}}
-
-# See "Bootstrap" in release notes
-GO_BOOTSTRAP_MIN=1.20.14
-MY_PV=${PV/_/}
-
-inherit go-env toolchain-funcs
-
-case ${PV}  in
-*9999*)
-	EGIT_REPO_URI="https://github.com/golang/go.git"
-	inherit git-r3
-	;;
-*)
-	SRC_URI="https://storage.googleapis.com/golang/go${MY_PV}.src.tar.gz "
-	S="${WORKDIR}"/go
-	case ${PV} in
-	*_beta*|*_rc*) ;;
-	*)
-		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-		;;
-	esac
-esac
-
-DESCRIPTION="A concurrent garbage collected and typesafe programming language"
-HOMEPAGE="https://go.dev"
-
-LICENSE="BSD"
-SLOT="0/${PV}"
-IUSE="cpu_flags_x86_sse2"
-
-RDEPEND="
-arm? ( sys-devel/binutils[gold(-)] )
-arm64? ( sys-devel/binutils[gold(-)] )"
-BDEPEND="|| (
-		>=dev-lang/go-${GO_BOOTSTRAP_MIN}
-		>=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN} )"
-
-# the *.syso files have writable/executable stacks
-QA_EXECSTACK='*.syso'
-
-# Do not complain about CFLAGS, etc, since Go doesn't use them.
-QA_FLAGS_IGNORED='.*'
-
-# The tools in /usr/lib/go should not cause the multilib-strict check to fail.
-QA_MULTILIB_PATHS="usr/lib/go/pkg/tool/.*/.*"
-
-# This package triggers "unrecognized elf file(s)" notices on riscv.
-# https://bugs.gentoo.org/794046
-QA_PREBUILT='.*'
-
-# Do not strip this package. Stripping is unsupported upstream and may
-# fail.
-RESTRICT=" strip"
-
-DOCS=(
-	CONTRIBUTING.md
-	PATENTS
-	README.md
-	SECURITY.md
-)
-
-go_tuple() {
-	echo "$(go-env_goos $@)_$(go-env_goarch $@)"
-}
-
-go_cross_compile() {
-	[[ $(go_tuple ${CBUILD}) != $(go_tuple) ]]
-}
-
-PATCHES=(
-	"${FILESDIR}"/go-never-download-newer-toolchains.patch
-)
-
-src_compile() {
-	if has_version -b ">=dev-lang/go-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go"
-	elif has_version -b ">=dev-lang/go-bootstrap-${GO_BOOTSTRAP_MIN}"; then
-		export GOROOT_BOOTSTRAP="${BROOT}/usr/lib/go-bootstrap"
-	else
-		eerror "Go cannot be built without go or go-bootstrap installed"
-		die "Should not be here, please report a bug"
-	fi
-
-	# Go's build script does not use BUILD/HOST/TARGET consistently. :(
-	export GOHOSTARCH=$(go-env_goarch ${CBUILD})
-	export GOHOSTOS=$(go-env_goos ${CBUILD})
-	export CC=$(tc-getBUILD_CC)
-
-	export GOARCH=$(go-env_goarch)
-	export GOOS=$(go-env_goos)
-	export CC_FOR_TARGET=$(tc-getCC)
-	export CXX_FOR_TARGET=$(tc-getCXX)
-	use arm && export GOARM=$(go-env_goarm)
-	use x86 && export GO386=$(go-env_go386)
-
-	cd src
-	bash -x ./make.bash || die "build failed"
-}
-
-src_test() {
-	go_cross_compile && return 0
-
-	cd src
-
-	# https://github.com/golang/go/issues/42005
-	rm cmd/link/internal/ld/fallocate_test.go || die
-
-	PATH="${GOBIN}:${PATH}" \
-	./run.bash -no-rebuild -k || die "tests failed"
-	cd ..
-	rm -fr pkg/*_race || die
-	rm -fr pkg/obj/go-build || die
-}
-
-src_install() {
-	dodir /usr/lib/go
-	# The use of cp is deliberate in order to retain permissions
-	cp -R api bin doc lib pkg misc src test "${ED}"/usr/lib/go
-	einstalldocs
-
-	insinto /usr/lib/go
-	doins go.env VERSION*
-
-	# testdata directories are not needed on the installed system
-	rm -fr $(find "${ED}"/usr/lib/go -iname testdata -type d -print)
-
-	local bin_path
-	if go_cross_compile; then
-		bin_path="bin/$(go_tuple)"
-	else
-		bin_path=bin
-	fi
-	local f x
-	for x in ${bin_path}/*; do
-		f=${x##*/}
-		dosym ../lib/go/${bin_path}/${f} /usr/bin/${f}
-	done
-
-	# install the @golang-rebuild set for Portage
-	insinto /usr/share/portage/config/sets
-	newins "${FILESDIR}"/go-sets.conf go.conf
-}
-
-pkg_postinst() {
-	[[ -z ${REPLACING_VERSIONS} ]] && return
-	elog "After ${CATEGORY}/${PN} is updated it is recommended to rebuild"
-	elog "all packages compiled with previous versions of ${CATEGORY}/${PN}"
-	elog "due to the static linking nature of go."
-	elog "If this is not done, the packages compiled with the older"
-	elog "version of the compiler will not be updated until they are"
-	elog "updated individually, which could mean they will have"
-	elog "vulnerabilities."
-	elog "Run 'emerge @golang-rebuild' to rebuild all 'go' packages"
-	elog "See https://bugs.gentoo.org/752153 for more info"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.7.ebuild
index 626e7c65d7..e51a36bbc3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go/go-1.23.7.ebuild
@@ -23,7 +23,7 @@ case ${PV}  in
 	case ${PV} in
 	*_beta*|*_rc*) ;;
 	*)
-		KEYWORDS="-* amd64 arm ~arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+		KEYWORDS="-* amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
 		;;
 	esac
 esac
@@ -75,6 +75,7 @@ go_cross_compile() {
 }
 
 PATCHES=(
+	"${FILESDIR}"/go-1.24-skip-gdb-tests.patch
 	"${FILESDIR}"/go-never-download-newer-toolchains.patch
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
index 2e29370cd6..3c001f4bca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/Manifest
@@ -516,62 +516,43 @@ DIST rust-1.85.1-x86_64-unknown-linux-gnu.tar.xz 182566732 BLAKE2B 8c776fcb1a2f9
 DIST rust-1.85.1-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 68d7bf6ddcfe5dcc25c857be305e650222507bd6015b24611fe983d85be48e38b4e3529db72a41ff13d1e3331a7138e86ff4b56a8344a1e459421e9555ed14c1 SHA512 792520a1de8c9b6ac6bc12e74a1182dd30edd8668d0c6fa5f3709bfa6ed3981eb378f079794459caf4e9fd982b71ba0296a7e515f56e5ac45cf7925e7cc296c7
 DIST rust-1.85.1-x86_64-unknown-linux-musl.tar.xz 262611472 BLAKE2B 9f6efc6ae4bbe97469bbb80e3d6fbb74a4ad63142af150d0c1f8867cd81f9a2b41f96787408681b79ba7b37b1b9f0d67089796eedfee5f0e228a30bed441a84a SHA512 8f3e60a6d83ed0ce0d31967707ba51eb7b9a8b2fb981b37aeb03ef4142965c3086a21768b08b4f26b81edceb7eecd10f83bd76e5c7bd12030774d916ac5a45c4
 DIST rust-1.85.1-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B ac25b4ccc84cb0c06708c7164b0a7b926478b3794683e2ca5e1de26a17b5098892c8633c9b8b8cde18040d2c6f195941b9093162594e39c04dd3b0e4a45f1204 SHA512 0df04cb4bd584efa1f6a63649ddc44bf4a30d018a2b60ec83b6defe4c25bfd8b61c8acb6c93783e9d110abc114be859542116d45b3087090f88743761149ad6b
-DIST rust-1.86.0_beta20250218-aarch64-unknown-linux-gnu.tar.xz 241961984 BLAKE2B 9553edf94165922470e138a62f2baead6e04aaa81384d22f5b6628462a1c5bbc2387fff5ff05a9efbb81aec5f28301f94d3c9b53899e80afc7997323dd44e089 SHA512 c846832d71d7203759749d8e3aca6c718b91b7e075e02a0a0eac71302d5ed2e23a23c611efc93c3dedec26e9e8931e819eb1d9fe757e9c7b51a6abc1cd6f0598
-DIST rust-1.86.0_beta20250218-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0323dc2fc992e29d8619978d560c888f1873df3b403a7e2a25ab06ae5979d2eb6c42481612f9fcf0b5e435ede3735603d8c1eda733e0f3523b3bddb055d6662b SHA512 f17268a0c2b6568da4c621c23a2b43f2645a3cf2355d4eb7af22be6c6b11df23053eed35fb891f7bcaaff0400910bb7d0e7749d87b0541c401b8ece37d994c90
-DIST rust-1.86.0_beta20250218-aarch64-unknown-linux-musl.tar.xz 218887600 BLAKE2B a2be264a1d7c9b78209484d175c959278a9b9596a1a917c1033d04061ffa42d3e1aac491ea02fef1d5d2c3642be72ca04c912f581a5fdcf216a9bd86b3567d3c SHA512 d391a7cb96dc34cd95b862c888d7c5fa199de6924726c3e5b82de96296e890913716083b11f9e7ecb153531b07bc98fec753be4d94cbc57f27c7bff4f31db203
-DIST rust-1.86.0_beta20250218-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B c7267af92640e3b302b4d640e1239ded358b9595d601947371663da6aa26c3c7a2ef67aaa02563d583441888f771c118fdb718cdb002fbdd95d864c3914bdd90 SHA512 2b538a1601b1cc97c95b6b582bb5edd92a4b13222469bd35d04161d4c17c9ff5e9b26d0bfd59e893bd59a07f4a81c7bc25e8d6cd66a22b9d73c5108a8fa23592
-DIST rust-1.86.0_beta20250218-arm-unknown-linux-gnueabi.tar.xz 203409584 BLAKE2B d696b495d48a31cb684722648ace6f4366c8b6f60a06bb7bcd5eae8ae43d700e2d52134e0c79ce8f06cfbd63edf9a732fa5e882c7d8018aa0433404816d2f241 SHA512 37496d82befcb09b4dbc08c1f8786f96d6bcddfc56cf4abf27a17942d43bd3a4ffa3290c274e8ef7f3bce973e575ebe0cb167dd8955babb1dc9d918cdf5370be
-DIST rust-1.86.0_beta20250218-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B 671a4c2f524b2d92d6a6bc680921890a283adb6885e8e71974255ac637a9409579a9c6306b39967fb4637ca5e10f2409b8079dc5489c079a718a7994ea7eb09f SHA512 f6af86317c175f32e4a754e295f67787ac9d8e53e1b5338c17481f3ce2e95a3213fe2090ab268c0d62a31d9b41e9321e975cab28c61f7e3e6baa2dfdb40322a8
-DIST rust-1.86.0_beta20250218-arm-unknown-linux-gnueabihf.tar.xz 203645720 BLAKE2B 8dc6adc0de500d3ec04734c6517d0db29cb0a318ea6fd09a32dd01dde29f32730d851ddd37543798d649eb5384b529a6956419c32a4089ac5b41e57dbb205fdf SHA512 5d2e069bb09bc4a3039eb3d0b2a8748d7ab615feb312f612d24329dde791b88b63f577f7abe1522262145044225ccca7e7f42b6821f922972703ea6f0a06bbe2
-DIST rust-1.86.0_beta20250218-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 7eb7dad663c6d93267387d1c23eeaed237443fadc990e0c03846441b3e42ff837d79772067abac23eb5945af05b030049486236b1895e2824779c2c6857fd9e1 SHA512 9bf603601a935b8ee099d590bf75ed7d3ff97b02491f2b003455ed700f020e915b00fb0a86324900871037a042a1fe48c063a15e419349de68bb50b054d2de64
-DIST rust-1.86.0_beta20250218-armv7-unknown-linux-gnueabihf.tar.xz 209642508 BLAKE2B 0c10989b96bbaabf9d3d3f3a7fc827a94f10bd64c52dd4315ea1dcb7c375a6429f5dd2270504bae87a89a7f283579cc85848c16736e520b710d00ca0e3a69dd1 SHA512 17578a5739c9725ac435a9cecac094ea33478145089b307977a2473d8192c1a82faa856c6acc456285d68a5fd36aaea7e87d8599986091633cd4ad2052b55b99
-DIST rust-1.86.0_beta20250218-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 849ea0c53e4760159dd020a89c06841cb94e8bced3bf9559d3caa8fecd4cb176363f06197bbe89af9f2dcaf9d390e398d4d621dfeb3bebad60f891a8dd25ff6e SHA512 1d11e90ba660af35f3e6c151a108c46b7a2e4dfb00b89f09747b3ae04e5de57cbddc2603bac428deb2a4e259d19eab91ef1a11c5dfac06f7582253aff8e24aa9
-DIST rust-1.86.0_beta20250218-i686-unknown-linux-gnu.tar.xz 236420288 BLAKE2B e850782dc7712b0f33bc2c1aa4a4f9948c897d26fc21d3a3f5c82288dda6aec1ce641cc80ec05e80706616f8ba4c63d55138a0cdde3c69f5783ec459d298b0c5 SHA512 830ca4e65229c0e3aac37ec9686aded2d9e687f99f0575b2e82baaa1210a426f20c1ca0780c08e80b00f8669cc3ec34579150c6169e71620b9a6359624b91f16
-DIST rust-1.86.0_beta20250218-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 4bb60878bb7c2d01a9abf974b3153237bb5f193b826b048fa94efdf77f9c2d300c58d2faa8b154347d2483edf6a6a8a207b9b58a7aefaaf6e7ce0486fac8b039 SHA512 7b73d0974d0d1ef0f03a77e1eb18fd3dc49b1a46dfcfc787b97e6e85e467610f1cf248d552e6e2a2a2e018e451cb7b68b29492d4955e53258b4a0d83f06d536b
-DIST rust-1.86.0_beta20250218-loongarch64-unknown-linux-gnu.tar.xz 234064868 BLAKE2B 7f79933f9bfc1423a0380264569717ae24de9a61a00d32e98eecf208a19dc972c45a75622d8e7beca4378f844d70e290a8367a4b7d6ac20a93852281cf88e359 SHA512 b3cde10427f8b86997a9a59c1a20629c2e26c7e02315a30c23ecc67dbc12a08bf65ea2c5f900ed2a5ff11cdc1c7f5c4a6a09396bf747662ddbdc635c9c7fa5b6
-DIST rust-1.86.0_beta20250218-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 05475853833084fef51946dd71bb53210b67880aa5231d85457578e78458827769e4e96ddd63360ab77dd2100b5025c33db297528b6a9f281076bfff690cbd79 SHA512 f7c3d430d55c1125256a111afa9986a71c5e003d7872b3fb2d5814ab6c9d01db27a325df484095f43926a00acbf8fc269e0b3db0300bb496b0bae176d77b16fe
-DIST rust-1.86.0_beta20250218-powerpc-unknown-linux-gnu.tar.xz 226058044 BLAKE2B 8d9dc5a74f571266c80450b514a7ec31ff885b40c66a5f49ccac98ff211da57bdc069a38425603527b3ef16917e9f1ff58969444149ff3d2e748bbc7379ac622 SHA512 bd8babeb25a256a56b3fda300963834326fd97f2bfb14e3f93ff41737242bcb6b354a5e2b1260e25eb25a22d8304d9782a7cbf0e3219adde534dc6b2332f9c6c
-DIST rust-1.86.0_beta20250218-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 5387f2d7ef2f6a0228ed8512ab431f05ffe885a1223fbd2e81be37536a0b55bfe1331654284bb70f9f1061173a31e9b09fde15f65af74c93f9fede5f0d435a4e SHA512 0611673cca4faebc7863f28e5c0fb60a9364ed980b1d025352cba9b1a64ce3778f4ccd149c1dd1d98fceeee144db5438f360ce0ce33682231203e9eb1ec5f812
-DIST rust-1.86.0_beta20250218-powerpc64-unknown-linux-gnu.tar.xz 222607376 BLAKE2B 474d684c6d04101200acf157389f11a8bb4759f90b27997e698a79bb117b47fca5441e42688198f87c9c05bd186c5e1a116ad095287c928c312d979df56f1f20 SHA512 b28c976ebdedbcda8113432b4cc03be379f58511bdda97831019fa2f8a9881baae9b5a1bf587e1de7a59f2aac00cec95f168d739769518ad31f27ae3a8ce2255
-DIST rust-1.86.0_beta20250218-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 8612b4387f98ac3e0e1cef6201b5afe4e76f58372f6bfbbaab3070e35fdc0fa6972ae6a85c8f8a9e9db07537fec0891adf6ca6eb64dc70d818c236bed4037f26 SHA512 e3c4a3f7b3c9304726502a398610ed9c8149b05a8bf33a5feb97be8600c0fec79456bf2556ddab4200ab3f410544b147703a69cc97db26bcbf33866e108f5bbb
-DIST rust-1.86.0_beta20250218-powerpc64le-unknown-linux-gnu.tar.xz 235353360 BLAKE2B d0dfa8d88db47ebc5e73b9550cefb684832a6238376eadffcac2ee0bee25dbc836bc76439d59d84ddc4d63d8f92251791a47462ac0fb0294460c5e3170cd2b1f SHA512 97380f0f812c89e71056c09d55e7f4bf016a1dc82995d37bec1e4dd942cdbcdaa09347080bac08a0917b27e83dafc3c7ef2c18547b593b97ca9c1aeb796c7f58
-DIST rust-1.86.0_beta20250218-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 10b90d187f86edefea27d695b20d1b89d4c5fd71e3acf60c518c30254b428f96bb4abe78111949c3f921e30c2e652e61ad86e56e037d4f20b10eeb64470ee3bf SHA512 28c69aea648cc08b5c78f96a8359b8c15bb51401c8cf267b5dae1f4b6460e779981a82e60f1ff1d8636e5167eaa5c0e193645ca23aa6e20b445afabb9fe21c92
-DIST rust-1.86.0_beta20250218-riscv64gc-unknown-linux-gnu.tar.xz 221919388 BLAKE2B db2ebd1c76b198ec6fcc481918da3954663163be90eb81c5d3c7a92a124bdf7112d9d8fc67f20ed5d621a3075fb610bba45de41d3c44c9fcecc0681ffc7462f7 SHA512 418e16c07215463bed4093cd44cfcfad91948e24f20109de8c54e8e2a941b5ab3434a6e9e1fe829c57c4f6312e258b5470ceb0c1c7a86af53ed81221d8d52436
-DIST rust-1.86.0_beta20250218-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 1e06c31dcaaf1ce82b0c9cc913d7e3e23aef3ad7a58f2a6713896edd25e2fdff48a5ea9515382f149b59347afbeec5bac3525ad41b46523efb311105b15e3e8b SHA512 2c54c1fa5cb4b868222a7273b531ec8808a89ccb3686fd9cdc70c61b4a572493bf09659ef8c90b3e430cb153693191f505c62102cfcfd42b81a4bfc4b0adcb65
-DIST rust-1.86.0_beta20250218-s390x-unknown-linux-gnu.tar.xz 224063628 BLAKE2B a699b0e1f65270600139c20b5c730a6bd4d163a51fa1d25a14f79b617d491022b95afc6e4a5545367be3f3c15a531b09ebbb747697fe9507eaf72ca9dcce35ec SHA512 11e6d3f56f4f1f449f382be1fede741f6137371ff87cf31166af2d58949225988a9c1a6bebb1b72e399d2a07ccd67bff860b7b2f258e38fe779363089a91df75
-DIST rust-1.86.0_beta20250218-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 745a4734949b577804360bdbce5814ba2daafacc29148fd0278d8443dfc54412e58b34745e287d39ea03a61e9bacc44aeb8ae47111e63b4aa572427e68cfa8d9 SHA512 88e444dd8d78f7c9075f61e1f223cbb63683579aed03a6f68c80c0b6e68ec4fda561020af4d2a5360c01cc04415cecafad2b54809e3060280201caf017068079
-DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-gnu.tar.xz 182371436 BLAKE2B 1859fdb803b9da3433460fbf73c52b37dadc95f1b1760f90ad23f93342a230cd7a95ab1bd3e3809e2979126e155deef7cec38888a4c2fce410371f8033a67a2e SHA512 0f4756631ababb4e9961b7ae380cd39e2c3c1a7415bdf07519d2553e95f6d710573eb3cb6a84eca9bcb03af6e557a81cd35771bdf839d3e4ade39238a5744c63
-DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 56f1e00d3e7ca2092ab7a5cc3e8465af4037ba99100e0773c4a65867428fc8adbeb0a571cae36ac1dd182c24eb5e5b89e306f476ae357ab387f6d5ff4d6a6bcf SHA512 bf17821fe53a0de5bb58ab03e87a9cd326bc4c97941a306909375285014bcd1126e5e32d62dac4a522f7a72b892c8371dfa3111f25d661a5d4e1a2ea802d3cee
-DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-musl.tar.xz 262699948 BLAKE2B 2197f33e5ccbc2e31925457c3af92ffe90dc258e66e9788a7520ab7a9ff3571214f099b14f4db80dff38e519a6f57784e85f335765816c7f44ae2edd96ea04a7 SHA512 a074b931d940bbc0cefb2d56fb9437afa1d002cc599a1779422d0f215eb9382b5b0322e31e0c92408d958ee561dcc9eabe237a6f8c7158986cd10ae550f4d9f6
-DIST rust-1.86.0_beta20250218-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 2b0c359da43e5b3645632f88bf6f776763571ef7d08d043ee806dc4991fc84b9d0c0b87b10cf12cf354c3a026d0665e17baf1316d00b10f3fdb1f47d834dbf6a SHA512 30013c2d6ebb6d63a49f0a54be584e7dbfe24ae4065313e70cae138c8533bc0afc2c46f05862828f1a97d3c398be91e140380b1d3d83c0a54976dfe3b5314efb
-DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-gnu.tar.xz 162271496 BLAKE2B 22059cb1174fd4fd4b603e10049e76fd2054c45352275abdf4a4183a38d4cefc7092d04d8f14329f60e9e4df0cd61cd1cd3cb46e148220a93e0484c55e7bffcd SHA512 aaa94fb98888c59da5dc59cab31d028248e15ce458b6589383a3ff54833783906580f40d2fe62e119cd7a22e1cd443724d61b4be4e81d30cb233a76afcadebbe
-DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0697cf3f3bf9e1d56ac12dd223d47ca9311569a6f2579892628217567994ea29f5e3bb13479a0cf0ca6ef52864bbeb8f59349d0de08bc56e4afe1171e87011c5 SHA512 1c179f33aaa106d4a3f28c552ca298ebe2e9015faa63d40e97f0ceea45bde9408bb3a6c5a599c5a43ab71e6fa2fea1c4f066d0b951ed08377bc8c4121c9392c9
-DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-musl.tar.xz 235432052 BLAKE2B 72bd9899a4c2cc68557e4513c164dde533fe74e1f34ab4579ad3cc595b8df5a6d93fe42d36b50e2ffc20b6bb5dcb92c6512cca63899c64b9f7664495adc4d68d SHA512 d1024147ce447b039b3a9bf09b258ee0cc4e4bc9a3e033c118e00859377766d832c2f5642116eb8a5e7f18814f7e1d459de7c30d13f284ab5e6919644a1cb248
-DIST rust-1.86.0_beta20250225-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B b281059472df1c4d8667303a30a1dbc5ca3664606c44ff257015c29685f321cb0085cd89778458f510775f18cda00408ee113eec8117ee111f3f92218ebd620a SHA512 c7b5de9c70562da1e5a4c306983b7e4ce89942c46cfeae68ee622b098b389d41a0196566e16d218f5f4a3c1019c96ce04ab574a56e0ff750ee5b69b9c4ffc26f
-DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabi.tar.xz 219585140 BLAKE2B c61538b9a86311691cee13e4113416e62801b9d1e845df73e5769e14b5c400607c797e0f37bf211811d21f31af297a69800af409180ae5eb908dfc2814033ce0 SHA512 54c569ced50acc9895029eccfda0767f980e0a23066142d4b3675408b023105ccd6f706b3726bd35bb49cec4c9510adb7cd7c353e7be1cf6d1f69db4548499a5
-DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B d969bc52bc28db30754e180e3427cbb39c376c6ac1eebbaa7cc00d2016726f0adac2d39ba348f5b1ff79e2a1c728cad3eb9c4cc1c972b399ecbf15fde0486a0c SHA512 586fb0eceaf36ec9017da40365ba8fc87eaa21a5533dc30d92c62d63bb02a2b80a8e712d0b449e06ee374ff797a1c9b0902491bebc94c179d938c6cd9351eda8
-DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabihf.tar.xz 220847580 BLAKE2B 227afc76a06443fa9fe0d6295c6758760fc541f586b76378a23c88ec3bcd8bf65aed2ec4c17d448202635fc75473f907888c657392eff470b76db745f9bc5f39 SHA512 7d2a15c3dbc741240302dd08219df6171d0f7d1132e68695ab1c6a080790cff413c8824c5bddf8ffb82173f0516f47f6d0c805cbcc8565379cae7e8bbced1874
-DIST rust-1.86.0_beta20250225-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 3c63b838061849ba629dd0a59b96105f2745f47066d8e61f1b201841022c3da628f325776a3f56c6cfc0bff90e7a49b008eef4d8299f05e0b2cdb4b3c1e5434b SHA512 e28d8fcd075cb3b681262cd68797b0d25d241a81b6f2617ddba4b56bfc97a1122f20874c20f3e20ac5102db8cc561d0cec6790e4ebce206b919bff96118a8911
-DIST rust-1.86.0_beta20250225-armv7-unknown-linux-gnueabihf.tar.xz 225818148 BLAKE2B 0f256ffe120a1c1b658a32b1fb00698786e36efa831cb31d8229eb48aa942ec68188e0a5065d8d6f8480081d09848d81aea1699fea4804edcf4fb14ae02bfed7 SHA512 ee275b10a1dc24d27e1215a21b633e8c8df21dbf441bae2bb8ae0e03a86e03403ddf0cf53d721e0f3af9faab4bf68d0f126fb08e1409d8e287b41231dce84efa
-DIST rust-1.86.0_beta20250225-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B dbec13daecf280cc954f8b696c258da43f8ac17ab5c2a5e33b58e38206bcc547ec07ef3ba751cde3d7e55fb78bd3894707d144749578888e42b2ab5435f94640 SHA512 458c6428dcccd6de45745c1350a9f6cb3ce13e974a5d2b8473be863cd0fed1eb504dc771b243ee19fac056b4113ea81c030a032281f5cee8372aa0c82cd5488f
-DIST rust-1.86.0_beta20250225-i686-unknown-linux-gnu.tar.xz 255115448 BLAKE2B 112a9fc6c4c6dbc022536e561b35dc89051f26eb458cf38633c7f7d2911d448d8a55a135efa0b3cead6267a9018bdc6218abffc967624f95193fe5d6dbac10ca SHA512 a60c5e3f55d30967314ec9b312a439b1302d5cd18d0dd8ca3666f3344cd9512b7cf7bccce8002af1d7eb4db082ec7ce3b3b59b9abee23a803175e6780659e89b
-DIST rust-1.86.0_beta20250225-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3b68d39f4780ac9fa2fbbf6b0c73e8d6ec91bd37951fa33564bd654ebb51c26d0726108f9ffdb39c570b73d736eeb922b17a76bfca0cd8386dde87d902d8e111 SHA512 ccf36b6f2fbdd5ad48de463164b6b5f9e53c70a7b9146295d482dc1e89c4eef79bc26306c49a73ad22c42840023cb72f520bb5a8e1c496f5025646b1530d5a59
-DIST rust-1.86.0_beta20250225-loongarch64-unknown-linux-gnu.tar.xz 251914240 BLAKE2B 99744c8f40dc90e17471995aa1d4087b40603d20f9114972cd860b00ec546c6828c364d5b7a86ace8d7f87cdc829e0711f758e495a7e188b0e264a0ef705cc44 SHA512 25cbe1f3167b560d31b7b41635343f4819b90bd83ae76dfcafe61169b7d0a37e5f68784ea3a7a659a05aa649b040f9b62864cff6139190a3e009be1f589b0d55
-DIST rust-1.86.0_beta20250225-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B c49018b1dab4948842839424b62f6339253d6dd89ca3aca52bb83a337327329341824bfa7b0aed5f8450c694cf90a2ae39381ed6bda3a2ba98a0ea5021da10b1 SHA512 c2bdc1386c905ab7c0bc5cfa0eaf9aa5f45500b8889a872131ed44182839cfb447719fc6fc2f5ed6fb9aff2ba732dd640448f848e282dd532b52568641e1add8
-DIST rust-1.86.0_beta20250225-powerpc-unknown-linux-gnu.tar.xz 243643276 BLAKE2B 31291d0ee4fd5aad13d6fa05226ad5cf189627aa0abea3e1a2f540bf77ce5fc6167ffbec96a64e515baad7288559bd40e7f464fed2ced361d201df0d11880ded SHA512 110b2d9138024cdc5cc0a6e6f34961e4b3eb16409816d72d0bda63b5cc4044e7f6a4fab10c69737ad362900bac36d4721a9579e176989a9f9442eafca02219c9
-DIST rust-1.86.0_beta20250225-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B eaf72f9496626ce42a3006d31856e5da84da35573b825531c9969aeb05f6c4bddec6d771252056376c7c511ffdd0b56b95f4e5c87b29dbdfc338cf89d1976fc5 SHA512 f669a60884700029bd38602163c310854091b6658681afecb73c4b209ff91c11b79836e01758c384cd52dccf8919b37874865e7292d1f0b029c455073ae0319f
-DIST rust-1.86.0_beta20250225-powerpc64-unknown-linux-gnu.tar.xz 239855984 BLAKE2B 758f1e7b7c34cdcdd5d901616200eacedaccbfdc86de066b4b14d4e8106c4850e732ef29c530018bd6da27d1e6f3105abdd1d887a4231a35e77bc4c240c52b43 SHA512 43a77d18a640dfb6ec0bc04b67eb85b7ca40fbc27c4b165db1ff53b1caf9a024bb4a4441be3944ab1b2b4eee56c2001d076ae4c48a5aac3ee01d5df87a0ea95a
-DIST rust-1.86.0_beta20250225-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 24a8e9c459fdffe21f85af6106b691beb60a8536e33422eb3f9cba9c428cd8045f82c58766ee59860e3044e1240f1f576da5456da3df01c29fdc318b3eb2c7dd SHA512 d6b8b731057529396fb6e00891a77e27ccebf70454e3557fb56051a62feceff6d7c42564eb82772b30f5159ba736ef03173a7723bfe31222164ccc48fbc40110
-DIST rust-1.86.0_beta20250225-powerpc64le-unknown-linux-gnu.tar.xz 254298220 BLAKE2B 07d6e7fde5a6ed8191003bd52e1968fce10bc05c18a2d17d771358f329523b4edaff6773ec8c0d1182bea6f4e5644caf72305765ae2aef8a9adf0ee5ba689885 SHA512 040a81b3fb1a8f5ef9cea89a43395dd616a9671eadf1ceb7a47fdb0733bf7e26f10afae6a4000f9f2271dd8a683d508ef7c82440758dea91ac4672ccc5344012
-DIST rust-1.86.0_beta20250225-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 6e1b092134967544131c707cf5d7c58a456ab5da3ac67834ec6b5cb96a9229d83c34e0fff5557c7790357e47d3d85d230362f5af786dd6c0e6e5c44e16c29799 SHA512 58e303ff074c58365b208e75107c4d5b42a4c9c9ba3546db1f792cee361b05428e5dfaac39c3a74d65b09822269e596ff97684cb43dccbee1ea47ae21c460370
-DIST rust-1.86.0_beta20250225-riscv64gc-unknown-linux-gnu.tar.xz 239076740 BLAKE2B cb669a3fdeffb8e7258beed158ecf651dde434b8efb58cbc2b3f495674e579ac9be906bc609d3274dcf8652a9277f599884ef4c06271f41a7f781bdb1faecf1b SHA512 0cb72f0ad90624e841b12553fca2244714bdfc10c3c936a85cf89660b14f9ba37fe6b067f1c9189ace57215a7e2e6fe438b8e35bc255ab9374bdf05f748997a6
-DIST rust-1.86.0_beta20250225-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B eb2cf05cbf16ff7c80fdbdef9a8f29100bccd672583e862bba97f004480664831d6f0edebf409c22fa4dba56dc9d62f3f4c2a15f1351b0b28866bf88ec702f9e SHA512 a680ad3394d3b9bccbf4024c527dee201b7c915062e891c414317575da78edb46be9c392efb94edab8a305103c806140e9dce0cc25ab9a6a3a4c8336f026d12f
-DIST rust-1.86.0_beta20250225-s390x-unknown-linux-gnu.tar.xz 241511808 BLAKE2B aae89cf0a53b5763632eca6f4b033e6254f19d0a2ca88351dea14347b52d7ebb406a899fa788cd0d402172e8af754d0a2b67ca077f93495e2f6030118f36a0f6 SHA512 92661da8e796e6a29809fd000a2353de29a4442ace6a4c42f338149066dad85e30759f7c13438a7dbbc4104639d4114a6b135143ed54f12d4a0ef2fb07357603
-DIST rust-1.86.0_beta20250225-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B a0dbaee450c0e8b9fbe4348cad60ca9bf5955f2f9c22b2580f9b43af5dcde3317647e4396266ec7e7dc8ceda4c05e0fa1cbc786e4673038ac664cc9909d5e66e SHA512 4ade36c52247a40973766b8428714f2d8d6ad2314f45f550dfdd90ce24d7445ced977723f55aec2d4d5fb162d4ad5371c25012dae64d835b6637df851d831dbb
-DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-gnu.tar.xz 192552128 BLAKE2B da3d4634b7a57a5b438b6ed8e1e37f155b7c9c141ead0e6861b173938c9e1fda3e1e6da0fc966e089645dd93d32354ae29b8b1f1f5b04a05548004692c4fc379 SHA512 0580762b898ef905739e7fcf097408737e3bd3afebc6b3bcf2db54d98eae0b0cc38121c2f22bb28524ed0b29e4c2446eafdd895283f7ff479df14a1760e979b3
-DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 615efe0198fd03883301d6e205577a05fda902d47ffbf9ef90fbb96c8275548b490c5ec2c530bd6dfdf18e1596b6c427f00724a3adc3860e107df03c864ea7ee SHA512 d10f522df9bfdb515f725acd018298fecb90a70171956f5c48e62522f596d34496d76ace0e05606cf9077c6e797e17ea4d086f6d4c055f53fa8d12aac1e93ced
-DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-musl.tar.xz 283004932 BLAKE2B e0639e06159347d160d0d90f9ecc0739cfa7da07895250d8b9debbfcfbc689e5ddbd0d8a4c1d08d61f8b5ab05b9b2f50613798ce78d57b4fa274b4a3c28d60a5 SHA512 03515dddb9820b3c159d358388a78def71879aa4e02735fc69aed6a6eddeec457f4b231b9d6ae3daac7310e6370bdb368b65749f869182640319ac983c7b7dc4
-DIST rust-1.86.0_beta20250225-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 89ce6eb6a52f7bcdcf5d5001c823c2d596e1e186d7a91c834b893b7be0af1ef442dd588398b05f60eb9f94777395b59bd72e0943a2e2c3c4a1d27147a62f18fb SHA512 f58230280ed4743a8b298fe45d36fbc44742f1e0e7867b95d47d3fcfcf723de5302a489a150a011864b5cbc7707ae0d340e45d9f013a0224e8c2fcfc57f4d5bb
+DIST rust-1.86.0-aarch64-unknown-linux-gnu.tar.xz 161478048 BLAKE2B 98e9a6b849ed8d241316b3fe60b998e4f6e3fe03e2173a4216d18ccaa6852e6b2ada3bfb5c0db68b28346d1c4c3b40627e166ce8ab4b217f2d6c42c12c22510d SHA512 51303f3e810c279fe1f81aee44f4d20885adc7f130d068f772f202c95fcf1c5b2648b1c5732a5d1a8cf075c57c10bf9a8581d57a7f001b672b46a3a273d49d73
+DIST rust-1.86.0-aarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 5e0f99da951d98a36d31034faf1041522b547c13717ba00c72da9ca89d76d87fac73844679a856a338fdfbad4606e6d8f6517ef2f7d98f4e6b01d47bb510ad2e SHA512 6208d934ea7a063db574d34f2a3dc314bc37f5ce6c8968005eaedc3456a1f027f3b609ddd21c60889f41a955283bd64ad8dcfd895f0bc38a7956fcff48212ed6
+DIST rust-1.86.0-aarch64-unknown-linux-musl.tar.xz 234453372 BLAKE2B c875354b9cb91756b8e42183d0e0e5eabc1b4a8b3844306718ada7f8bd730b9983357188733e031893c9e0b793ceec4cba96da93ba1baf9adf7941c140202b9c SHA512 095bded0dcbceaece2f887273627a03a227c7e2cc321b4ddea3cee8f2b9faf9e4ca6a5dad9d067dbf64c2c0a60761dba296147e71d7c8b4e4076ef28df2abf82
+DIST rust-1.86.0-aarch64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B a6b3a70caad2fabe4f9d83ab7725220d5c8a891577b9d58a59fa5f4eae5bce3331bd1dab379697029c1b38c3c09023d3c8f98e01850552f7f7d2281e51c70faa SHA512 71b390282f526723da1ad46d48f80a3ac7aadaa03b3e35eb3c5452c35166ef0b5754295a753d8329b9a3e0797c5e4845b75d252651dcd0cecc73eda81aad201b
+DIST rust-1.86.0-arm-unknown-linux-gnueabi.tar.xz 219680908 BLAKE2B 6a7ea7a8cef31880ee4120c5dd712fe8ee7cfec1d0e910b7d8b6d6814fe4b53a574d4a28af0d6466f1a41c6ba3e136f77c5f632862209ddc5200c2de29fd7d54 SHA512 9d192b00cfc048e092fca14231b2794bdb7d15c0a83a8efc3211bce1047bec2e8ed7ae4cc9ea6e5455b439177ede1eb2dcf2fe0f524a694574150cd7c3900b2b
+DIST rust-1.86.0-arm-unknown-linux-gnueabi.tar.xz.asc 801 BLAKE2B 6ce8c6365c06b78875c029aa0fc135882a052b8873ccd303180d095433f19e4036b11f702f2f96af3fb8e405407841cda62485fbfbd280059927873b1d411cc3 SHA512 a23e46e99640e43aa5b69bb2b6404affb951fc0167ca286379fba9a7427e177762816a1447ea35c63f983800442d4ff6ec75442eb13df8ca30ae87cfe40d899e
+DIST rust-1.86.0-arm-unknown-linux-gnueabihf.tar.xz 220298448 BLAKE2B 3a7708f2a27737c9094a3ba0264a16c6883c20709aef21c09249ceaf1376e8f2b5351e81cb4ef6bed108fff942b8f027aa7d4c3e6b877d62cf17e0207c8ca88f SHA512 581b306aaacd7db3db61ffcb1b35fd41c890cf2b980c089fed402304bc6386bb83502dfa105ed2c036856658422ec68056473a5d45381bc77ced366b07731ba8
+DIST rust-1.86.0-arm-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B a5b21296ab2226ad6a892a77ab8b6460309966fa2a3497a139c8443890668f0c15aa097214c053a2647d419785c876559f362e263f94eedb61ef61b53dd957e4 SHA512 cb6e17db9ff6ca078b14495c6fb9c250e121486cda855793397f13969046266adc798df13374cd3b56bae46dbca3467a30395e2b2dce603606c3c38b041ff5fc
+DIST rust-1.86.0-armv7-unknown-linux-gnueabihf.tar.xz 225507396 BLAKE2B 27567fc17e0095b769175c6d7511e1080242c77157eade2106f75ce335e4f592ae42a8b488864ce85efa3e856c2bdf85b419ec86c1882614237df60297482127 SHA512 a3be060bf1dc7483d44fa242f967166ab8d1db78d62dbf6e20b67a6b750854ff286675afaac86775e93f8f43922a6b56cc155533bf5718918656088fde5f7cc1
+DIST rust-1.86.0-armv7-unknown-linux-gnueabihf.tar.xz.asc 801 BLAKE2B 1613dc793e5c92e07fb86118f5079cdc8d67773a02d3c0db3043ecf7c3e4aeda1cbb94ca38ba79e980cc365f437026d2c8f991a60540ba79174869721eab3d16 SHA512 c652290f22578dbe1f304dad9adf47a81ebdc42e1a10ca06ef334e2d73637f6211d1d0b7fe50d9c0018c59a3ca9102b80a92445b3c46f9999d34ae92bfb9b49e
+DIST rust-1.86.0-i686-unknown-linux-gnu.tar.xz 254644588 BLAKE2B 49e9ce30dd8bdd68d69e79b0ee256ea0644d2e15f6b506ba682a4ea2271550494d8a1df972429c895db468900c36de291fb3d13b56479bd93aef424e8a639ba1 SHA512 8bf40765545757735b1617536b95960c7372e4885be4de5ec8042068023248fd6433e6728417a19ac4fd36aff7082c63296dda34381f966ad2c16f5404e0697a
+DIST rust-1.86.0-i686-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 45f5e0d7d6909025181a94c468a7c1cb71979c147ba4ffeb7841efe8286b250ee427c50e54654a0036273b6988496b4b3031b00de6bbb0f6e9101e46f4f3b714 SHA512 e06903566f5cd14bfed5f7ecd52df5d3c024426015b1ea1d948de64716b774ca00e9efae2ab539057bba64e4a6b079fb0fa5d3179c372a3b340b6750790fd0a4
+DIST rust-1.86.0-loongarch64-unknown-linux-gnu.tar.xz 251731380 BLAKE2B 15a165c56abcd1724d2ce5a13b45a26dd31a60ea7aa10d71c8217d533b4ce40e3839a63214275f13815227a7bee277be0769d08ee5d5e3fc6feefe8f9f7b07be SHA512 c9cd5a33bf999057a6c1a744b3695938e97da571cac0b8c012c0c48f01d50184a2425fd745f48a5d74f6d218d6327113a1bd20b8fb96e914df27668083716a51
+DIST rust-1.86.0-loongarch64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 749307f8246c33bd29fdbde2d081350ae35ea5cc3899c90a3572478b8e582e63cfc32bd7481cc1e8fb4b945b458803c0f38fc0c9affc5350641c85ca7a9f5b83 SHA512 db1eb279737a4f383782c9c1d9fbc9655879e77f3c3adcc2be31eedddb1a4799f8d1577da3af16ea87dbac4ac10346c461f9aa0ba5ace6f50e99be270e8b8ac4
+DIST rust-1.86.0-mips-unknown-linux-gnu.tar.xz 76638024 BLAKE2B 0cac1cfbae59b005b51750e6b26fed1b1135d2a7654821074ec62bbbbde51a9e87c978d158dd46dcdef2ab6a93bfee99eb05b1fd46716a12f372de75cd084004 SHA512 079329b1e9e52d945e819ba7e2e7ca82a897c1fb04839a50c418b25a980e5d797a40dcb772a00ef4840b9b227071355f8ca4be9e8717196bdf8b681c86025751
+DIST rust-1.86.0-mips64-unknown-linux-gnuabi64.tar.xz 76640272 BLAKE2B 0ca85c95f5b26360b61b7974a84e1323212c578f51566b2968c182a5bd1b3f87f961e66b6bf869cdb75190063196394bf0e83376ba03f88824cc619c5825941e SHA512 e6487939027f2e1e7302ad0a5845796a76a78e97beea72944a0b8524934d5c54edfd05a240a46bff33930b39c258df947e07488418b220316157f1f25994f0d7
+DIST rust-1.86.0-mips64el-unknown-linux-gnuabi64.tar.xz 78118508 BLAKE2B 48960d58a984a2a12d85a9313138bebdfd2d08aad151f826d74ca8ded1767cf8b3ad7f21f46abb310fed877fbe0d8f158961849cd7380496a87ca6b0e5b21a21 SHA512 28472c331d6fed1677eb5a61df693070fffbdbe23765a92ea1557b138aff5b4092ea9f81da4efe1f2981b64fa04d6f49d88df284a76b34b73a4859a8b9cfe59e
+DIST rust-1.86.0-mipsel-unknown-linux-gnu.tar.xz 78278500 BLAKE2B f29094c80c437d9e76705b3657a81c25a9ed072910f5c47b7e19a47b54e613a2502cbe27aa348cd9cdb0c34fd3c4978fd8177560c061070733b4f53bbd922c66 SHA512 ce9066338315ef9ed85677b85241cc28639bb063afae8bd56e515856429596c64376b550d48b8ca06f0d411f96cd21b2808b2575b2f20615548965ea1bb70317
+DIST rust-1.86.0-powerpc-unknown-linux-gnu.tar.xz 245387424 BLAKE2B f25942be19a52a13f4dc8f5227b1ca8331afb3530b94ba2c31bf3b5ff5c421f4319bdf1df2605b5322d4f5e34a2a9084e11dbbf19187f7dcc492e320f406cd03 SHA512 d013fff6a739f80771e7b10f543b6ca77bfc858342fe8e09ebbf1ba61ef013887cba96a311ea10762e5fa42fdf0923870ab98deac33b70e99c891d846128942e
+DIST rust-1.86.0-powerpc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B af8701515fca2d775a4301132ab11637a438367801401a2d8fe4ca33e36bdab36a09c3579956e1bab8c286e4e4a978c5f42ff27605ba02a08b3914f0c92e0725 SHA512 b80015270af1e2f90e0cc8bf88cec3b4b7f09b20bc1d32d6fb617a618c114cf0f5473a046482e8d32ade724c08b74ec29e05900510cd9a7077a2aeeacf0e3bc0
+DIST rust-1.86.0-powerpc64-unknown-linux-gnu.tar.xz 240884248 BLAKE2B 4e0bc0e83ff7f946bb0071f867eaf074a972f563178410378954c964f7a999e4f543fab746ee66ec8112b5016537e36fde4b5507d9b1930b64150a11123bc559 SHA512 19b7bab462762b6892462ad24a8f3eae98b2285be95f19a32e0b3a43299ad17be7e124263cbe6622fd298369dcbb7b6bce9b7b99699f06b179637e706e85008d
+DIST rust-1.86.0-powerpc64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 74f0c1cf346164b62651a13b696694eceb71da4e270a8211d8141d94d46b34949a670573615d8ffe2d495e86eff07fc2fd79fa47d81ec6bab5b6749b2ee6506c SHA512 a8adf096fe891d4777a258ef72205524c5239e6cc463aff29cf6ec20de1bb5b88bea6827e5af333adf7b7e4b4a512dd70a3711290f765c087208cc4ab4062573
+DIST rust-1.86.0-powerpc64-unknown-linux-musl.tar.xz 79323628 BLAKE2B 3af5a4ea9fe3d5e000de7ceb35f075cc8855860720cc89c90f81b1d6407fad8746fb6c2c6989941d799e98f738aa20763d8db19371189ca7b5e6dda0f13ce6d7 SHA512 5ed49096fcd763bcc98c81cfc44e54a99f2eb9425d9e60b5c559d80e2e492ce49d1b778e83b0cb48ff6dfb0ae471fa2d6f3c72ba025794c95443d946368b1b73
+DIST rust-1.86.0-powerpc64le-unknown-linux-gnu.tar.xz 253859192 BLAKE2B 3a9655587420f1a776fbce48da4b50ab34ff35d4f4ec63463d21b6cb25de1a9fe3fd2014e8643156d777a821b584575c8ef86e6ac87a4bcede967c88167e6e88 SHA512 2214361bd011c71d3344a9dc0dd2241056241c4a009fd764f3a5d97f5ce84decf92cf81ebfd14a0cc800f8f349e3e2143c50008b463d49889400717b7d8fa6ff
+DIST rust-1.86.0-powerpc64le-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 0d10953e01d5b992dda8e973f67be6a752381108ee85c516af1dc46479ae15fcdfd42c444eb5e7e2dc1fc6b1524ad4d561c1528cbf5a0c8aa2527e8b18c37d7c SHA512 8aa87a8f116bc1dc160e1041fc403bfc78062853ca02077783d0e6fbdf43b715d9999f2e7458bb3654bb0bcea3900f46dfcc698b2ee6cb3b0f3d716df340858b
+DIST rust-1.86.0-powerpc64le-unknown-linux-musl.tar.xz 259294828 BLAKE2B 97091558aed389d03cf2de84b2dbb38b6512c6b3e3793daefdc5bd04b083750cc772267a891f39e22b840da354ba9bac3c73a710aa147de165f6b597caf30381 SHA512 2951d3a8e8856a3977a62bd796e12a9c6432a1bc29924fcf93e5d65d4abf103523efb42bf0ef416e108d3348aa6ef5fcbb74864f1bbed57e682efe14ae825ee7
+DIST rust-1.86.0-powerpc64le-unknown-linux-musl.tar.xz.asc 801 BLAKE2B e6373b1e5494b4da6a19ae8394d34ac6963af4dd6e92541ea436421fbc1c0a7e74bf303acf6b8e03deaa1165c1c594948cc7e435fb100730602a4cb3c6432daf SHA512 75c01c27eb4be619aca0aaca0e451e32bfd1355254156f41052d8b065c3c68ff8da94d9b2ac3ca725d4616caba263f61ed7d8f87e14ea9a4a81feb02778458c6
+DIST rust-1.86.0-riscv64gc-unknown-linux-gnu.tar.xz 238802100 BLAKE2B 622e38f3c7168c3804fb1468e8f60ff96a76f36a47d2abd269c8303a0506555538d44c63f661f7f1536878575ea9327d961e25491dc043439c9c2dc51e7717f2 SHA512 ebded5a975c445d1c100edb1795e32b348f8fd0c5273272b6219c1e09cf23c4c5627ba764433aa5a46707881c428cee6e7a271bceea4801f9c4a787ea2322fa9
+DIST rust-1.86.0-riscv64gc-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B cb17b9c5d67dedee4c4292dffcadaf8da783bdbb832227ee916f0ce89feb92ce2ff6125d7b0fc476114a6b171348a917d9b3b1cada9234276e452b15c4fdfa1d SHA512 d5f8bacd56647d3c1dc64aa7f9c5ca6e3619cd21a1b9404034b39981c1088ec95b076a280eb089dbced35e0166ba90869abcdae3ce65ca6f79a7a1b3abf2e922
+DIST rust-1.86.0-riscv64gc-unknown-linux-musl.tar.xz 83519532 BLAKE2B 7725887b7547c4f075af0fc9c6050c09e5bab4fde61a4a4445c3587bc15eb8d5751eb4cc39fb1c43dc8144b0db2afb5b18163e1f9a7efff8ae7086890400c68a SHA512 fffc44d7b20dce83c76d63cb586f21a18e30bebe59fe0b69159a4113c0d5d14b2f2a8d3dccbc558a62c00060e96f30faed87f91ddb1b18a3d4a983f28e0e6366
+DIST rust-1.86.0-s390x-unknown-linux-gnu.tar.xz 241333864 BLAKE2B 46a6840296e06fe079c9af1a8977abf8f0a97b70b830f7c63a4f6942d4d17e926f9e2a49cb13eb1d34af9094640480c306633d99f717b174ccb5ceee433e13e6 SHA512 10c3e188d8d44038d4fb894688f32bcb02f32429eb1a4d31aa4b5414ce804898c1616ffdf1c19265966031fe627b3efcc3a23073db5f4f9623a64da4ed47b66a
+DIST rust-1.86.0-s390x-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B 3f42d8da69db298198ad7d8a5f48d42d4fd052f703313efac10534b6d3d7a44c1c02d1a239ad62060a38708847a0fa840a255029e5539f5eb956e1ef6b9dbc81 SHA512 9fe2fa34fe28ad608e70070854781f532ab9fdb3e8ca418e7b991a7d4a09c0fa7d7beb0a7598ca37941a621c7b922d22a093f98cfaaf1ccc867bef1c8254da27
+DIST rust-1.86.0-sparc64-unknown-linux-gnu.tar.xz 74819624 BLAKE2B 2eeb61e3b5065e0c9fa04e144204426ffa0a92ecdf99fc5a8ac8cc7a3f58736795c92825e831f99946833a5df8d27cf0e3cd14fb418409a20ce835d7a386adb4 SHA512 ee39b91d45b1a1a4a9667233f5c59ca581307d90a42d8449d279f59b1bb26e180526df57670a6cf2707437e24b16b0eb2bcad5a85ec8b4abac56d7fceeb51e94
+DIST rust-1.86.0-x86_64-unknown-linux-gnu.tar.xz 192462932 BLAKE2B 75bb01181aad696f42d3e6cf287a94ab09832763932d343d0175d8759b1b277fa86022409445d64e96aa31ee9ad9aadf36b566eb6c582b843582ad73324b28af SHA512 9b151d334cdd29325e16d16585623f6100e9e3464f3e60de9dc4aec094300d684569bc611235dccf37abe2232dae9967e48447b835dd5827472785ab61d43c80
+DIST rust-1.86.0-x86_64-unknown-linux-gnu.tar.xz.asc 801 BLAKE2B b7365bb0f74a12de2e80b4579323b3ae3b3e65460a216cad7c8f61d4fb4bb86bb55cc25721a6cbd8be5b2b5a92aec7601950d2f1b04f94644a890c91966bc20f SHA512 d57cd3221f0d1dbfe69dbe4c5417b0e2d292a09fa892ed46ea90df95b6502c5d0e54eb4916f1289041758dbcc30cd6910f2bd4edc99f2711abb6a9e246361c6b
+DIST rust-1.86.0-x86_64-unknown-linux-musl.tar.xz 283110076 BLAKE2B 9881d9dc7ac8e1f6cdf632131b31eae7404d17f76d38873509e4b8e549e00c37dfef3bdb0663a20b6fb13dc8198a6d25f74931d6f7e4d017400420a6032ab374 SHA512 abb2d6ccc009840b32e48755b2af2a7f2b04eafe285e5c2f35593bf3219e12cfb8ce9e15429cf2315bc5a0ee5103d3b64c7eea121cb77cb8ff2e699bd685bf88
+DIST rust-1.86.0-x86_64-unknown-linux-musl.tar.xz.asc 801 BLAKE2B 9dbec80a7661d103e0b0a2187bd524eb5a4f255e6a15ac4bf59f82eb0b5710ef09dec0f35dd0e3015d374c701c2945ddc510a05c5bad2287ce855c30c0460935 SHA512 9664e026d85ed42227680c385bfc42a2cdfdb3a37858ced5cfcf2f7baec4840e01fc0e3e581fba1297a55245864f3d1483f430fc58295b98b84814df07f73c0c
 DIST rust-src-1.71.1.tar.xz 2460244 BLAKE2B e3a5b5bfb808310f96e760aab55310c7a790fa551d248c9c5dbb407e0a80653563d8df73a9e0973aa63d3286aad6c755b78098dd8db2dc1a2ed3cadb926b40e1 SHA512 659cc46e1ece2ddbcf5ab748bae48843bd36353cc633b59e4ac062d843af66919e8d5c39ccb72ebdbf94a0e26a8056ade6bd1c8fe9a936469bd405122a8ae35d
 DIST rust-src-1.74.1.tar.xz 2544036 BLAKE2B d95431b69f102782f51878ff73ce8802cac6dab7909497c3231d1c479b95dc2a618cc6efd8bac9c6bd59a2b10dc6be05199f1e1bd74e45cc640ee52352c29268 SHA512 11467d0936193c5a5be8c2eba1aefe2b7028af48494698863de2c4057d68ce33dcee1fc66dc2d68b1d32f0202ce49e9b906727849de8f8d904dd07930e76d5a4
 DIST rust-src-1.75.0.tar.xz 2570256 BLAKE2B 9db7ccff07ffe6991233e9f530321fd6ba48c561dcf1226537afa70c7d045421d8e83c5300b0866ec6fccfaae96dd67b9f204e9e0e12108c0c766d467cd78909 SHA512 e7565cea2f1658a05237a698e38880df2544319b41b6d8b0805db5f1f94fd3bb4f986967d0440fcdfe3a135e33246f3c747665b964f57ff5942f56133af78cdd
@@ -587,5 +568,4 @@ DIST rust-src-1.84.0.tar.xz 3016148 BLAKE2B e948d4edb88f81ecfb49f56a3ca6331c4e9d
 DIST rust-src-1.84.1.tar.xz 3016012 BLAKE2B c9edeaf0797a22e384c54b3fe3e7c833464c09f8828474e05400a561a369d836626387caa495689e4b14fad691a85d6859098c84347211a6f79e2ef2c8d9d6f2 SHA512 564c440a05b67fd3a5dcb4dea21800d32ae65ca12230b804b5efa4bd468fe1b185bd7ed89041782018f70f60afd7554d7755edbe20e9cdc930a9fad390deb317
 DIST rust-src-1.85.0.tar.xz 3036988 BLAKE2B b7281b23eef60cf052e1641a29915c02c590166a73e5ae75890072ce80f95a2ab71cead3e3da7adf757ec0352d1dcc87ba4c3070282a27657b34420fe24a0c16 SHA512 613cfa603dc457cee34b154acef9573d766ce5757c9e8342b13d362f2e62b4cee47071a59df9fd5fa42ecade1a9efdada5784402aaf7254d5996558533bff8db
 DIST rust-src-1.85.1.tar.xz 3036412 BLAKE2B f137ffcebd2d231d8b3dc5c9072f6afe39a071bc9608ac468bca364fafaa9c277b91e40da870a083c802cc13b9b876a548d7fa8ae67ad9552321a7412b7d8cd8 SHA512 d230cbb1daae3e2f5168abef94c5b99fb118c34a980f018d5df3e43f6ead4e0a17d6ea29bcfbcd0fb745e215f7a4d0282a99a714dba77b98a16254bb27c2d2ad
-DIST rust-src-1.86.0_beta20250218.tar.xz 3035860 BLAKE2B 506df30188382d43798c6661a8b730c10a74a230bf5ceb7c04f2892f14a45630182ee174f79b564dc5a6dd8e3bc84963b8391fc9641efc57d0ed90e69b89d545 SHA512 4c7cc4d1860f7d97f615ff5dc030754a7fb72d1eb47b27a2e25dbb5a9b0326b8a1b82b6b60a784da910c4730d3b728bb27e1d27f30dabdb7e455143550f0c424
-DIST rust-src-1.86.0_beta20250225.tar.xz 3053616 BLAKE2B 19abffb74a9926c73fd112589be340b2955e3117d4344f4185de08899be5a5ac9835395e601224f21e63fa0f91053fb39ca02e98a6442570dd54c6b0a39f85a9 SHA512 57b8eb0fa06e5ee37d89ee486375b7022d2085fcd88061a20c3e8406c312fa912bc0b52c9259bb3682bbba1e2ea4b044eab9f9ae66262a67c19657033fe918e1
+DIST rust-src-1.86.0.tar.xz 3053544 BLAKE2B 2d1d8a4be4f9dc9355ce9a2d1599e0a57c5d1cb32f7b2eb413f6009dbce7d63db2533dc038cf50f5277a2d7bf4434f2076632c12a6fd33335ccf3a9f2ab685d1 SHA512 2818d94412bb0766ce53383932cd8ce96275a8e923f916c4bf7116fbcb7c2053cfb9714667add1a9d50b18366c973ba3ab4fe55d49c8abc8cc57656635c59f63
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild
index 4a8c1bec78..0e1bf418b7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.71.1-r102.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 16 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -74,12 +74,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.74.1-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.74.1-r102.ebuild
index e7490ef7bb..c81cc6ffbd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.74.1-r102.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.74.1-r102.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 17 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -70,12 +70,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.75.0-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.75.0-r102.ebuild
index bb60f0c714..be6823b603 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.75.0-r102.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.75.0-r102.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 17 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -70,12 +70,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.76.0-r101.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.76.0-r101.ebuild
index a1a14f6304..6139f1a663 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.76.0-r101.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.76.0-r101.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 17 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -57,12 +57,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.77.1-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.77.1-r102.ebuild
index 701e6ea246..d2f7a34c76 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.77.1-r102.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.77.1-r102.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 17 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -70,12 +70,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.78.0-r102.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.78.0-r102.ebuild
index 1b42457944..21708bd51e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.78.0-r102.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.78.0-r102.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 18 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}-r101"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.79.0-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.79.0-r103.ebuild
index 1b42457944..21708bd51e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.79.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.79.0-r103.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 18 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}-r101"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.80.1-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.80.1-r103.ebuild
index 9f33d6b279..106d346771 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.80.1-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.80.1-r103.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 18 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal
 
 MY_P="rust-${PV}-r101"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.81.0-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.81.0-r103.ebuild
index 1f1b15fc82..9a5f6a563c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.81.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.81.0-r103.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 18 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 MY_P="rust-${PV}-r101"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.82.0-r103.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.82.0-r103.ebuild
index 9ac8de92f2..de51bd867a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.82.0-r103.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.82.0-r103.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 MY_P="rust-${PV}-r102"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.83.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.83.0-r2.ebuild
index 6f9f25068b..8d5e252019 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.83.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.83.0-r2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 MY_P="rust-${PV}-r2"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild
index 99ff19978b..8db5ba3471 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.0-r2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 MY_P="rust-${PV}-r1"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
index c55c998662..6a6e4ce8b3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.84.1-r2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 MY_P="rust-${PV}-r1"
 # curl -L static.rust-lang.org/dist/channel-rust-${PV}.toml 2>/dev/null | grep "xz_url.*rust-src"
@@ -77,12 +77,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	# sadly rust-src tarball does not have corresponding .asc file
 	# so do partial verification
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild
index f76a83693d..eefb281545 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.0-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 if [[ ${PV} == *9999* ]]; then
 	# We need to fetch a tarball in src_unpack
@@ -98,12 +98,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	if [[ ${PV} == *9999* ]]; then
 		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.1.ebuild
index 614b762194..a16975a344 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.85.1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 if [[ ${PV} == *9999* ]]; then
 	# We need to fetch a tarball in src_unpack
@@ -98,12 +98,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	if [[ ${PV} == *9999* ]]; then
 		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild
index ab225d2c12..9f30d1dcc2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 19 )
 LLVM_OPTIONAL="yes"
 
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 if [[ ${PV} == *9999* ]]; then
 	# We need to fetch a tarball in src_unpack
@@ -21,41 +21,43 @@ elif [[ ${PV} == *beta* ]]; then
 	"
 else
 	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
-	SRC_URI="$(rust_all_arch_uris "${PV}")
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
+	SRC_URI="$(rust_all_arch_uris "rust-${PV}")
+		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-04-03/rust-src-${PV}.tar.xz )
+		ppc64? ( elibc_musl? ( !big-endian? (
+			$(rust_arch_uri powerpc64le-unknown-linux-musl rust-${PV})
+		) ) )
 	"
 	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
-
 DESCRIPTION="Systems programming language from Mozilla"
 HOMEPAGE="https://www.rust-lang.org/"
 
 if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
+	GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PV}" # omit trailing slash
+	MY_P=rust-${PV}
 	# Keep this separate to allow easy commenting out if not yet built
-	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
+	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/${MY_P}-sparc64-unknown-linux-gnu.tar.xz ) "
 	SRC_URI+=" mips? (
 		abi_mips_o32? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips-unknown-linux-gnu.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mipsel-unknown-linux-gnu.tar.xz )
 		)
 		abi_mips_n64? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
+			big-endian?  ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64-unknown-linux-gnuabi64.tar.xz )
+			!big-endian? ( ${GENTOO_BIN_BASEURI}/${MY_P}-mips64el-unknown-linux-gnuabi64.tar.xz )
 		)
 	)"
 	SRC_URI+=" riscv? (
-		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-riscv64gc-unknown-linux-musl.tar.xz )
 	)"
-	SRC_URI+=" ppc64? ( elibc_musl? (
-		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
+	SRC_URI+=" ppc64? ( big-endian? (
+		elibc_musl? ( ${GENTOO_BIN_BASEURI}/${MY_P}-powerpc64-unknown-linux-musl.tar.xz )
 	) )"
 fi
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+SLOT="$(ver_cut 1-2)"
 IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
 
 RDEPEND="
@@ -96,12 +98,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	if [[ ${PV} == *9999* ]]; then
 		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
@@ -171,13 +167,15 @@ patchelf_for_bin() {
 
 rust_native_abi_install() {
 	pushd "${S}" >/dev/null || die
-	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
 	local std="$(grep 'std' ./components || die "std not found in components")"
 	local components=( "rustc" "cargo" "${std}" )
 	use doc && components+=( "rust-docs" )
 	use clippy && components+=( "clippy-preview" )
 	use rustfmt && components+=( "rustfmt-preview" )
-	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
+	if use rust-analyzer; then
+		local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
+		components+=( "rust-analyzer-preview" "${analysis}" )
+	fi
 	# Rust component 'rust-src' is extracted from separate archive
 	if use rust-src; then
 		einfo "Combining rust and rust-src installers"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218.ebuild
deleted file mode 100644
index 97bd2bca57..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250218.ebuild
+++ /dev/null
@@ -1,317 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL="yes"
-
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
-
-if [[ ${PV} == *9999* ]]; then
-	# We need to fetch a tarball in src_unpack
-	PROPERTIES+=" live"
-elif [[ ${PV} == *beta* ]]; then
-	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
-	betaver=${PV//*beta}
-	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
-	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
-	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
-	"
-else
-	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
-	SRC_URI="$(rust_all_arch_uris "${PV}")
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
-	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
-
-DESCRIPTION="Systems programming language from Mozilla"
-HOMEPAGE="https://www.rust-lang.org/"
-
-if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
-	# Keep this separate to allow easy commenting out if not yet built
-	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
-	SRC_URI+=" mips? (
-		abi_mips_o32? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
-		)
-		abi_mips_n64? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
-		)
-	)"
-	SRC_URI+=" riscv? (
-		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
-	)"
-	SRC_URI+=" ppc64? ( elibc_musl? (
-		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
-	) )"
-fi
-
-LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
-IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
-
-RDEPEND="
-	>=app-eselect/eselect-rust-20190311
-	dev-libs/openssl
-	sys-apps/lsb-release
-	sys-devel/gcc:*
-	!dev-lang/rust:stable
-	!dev-lang/rust-bin:stable
-"
-BDEPEND="
-	prefix? ( dev-util/patchelf )
-	verify-sig? ( sec-keys/openpgp-keys-rust )
-"
-[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
-
-REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
-
-# stripping rust may break it (at least on x86_64)
-# https://github.com/rust-lang/rust/issues/112286
-RESTRICT="strip"
-
-QA_PREBUILT="
-	opt/rust-bin-${SLOT}/bin/.*
-	opt/rust-bin-${SLOT}/lib/.*.so*
-	opt/rust-bin-${SLOT}/libexec/.*
-	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
-	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
-"
-
-# An rmeta file is custom binary format that contains the metadata for the crate.
-# rmeta files do not support linking, since they do not contain compiled object files.
-# so we can safely silence the warning for this QA check.
-QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
-
-VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
-
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
-src_unpack() {
-	if [[ ${PV} == *9999* ]]; then
-		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
-		local rust_bin_url rustc_src_url
-		# Cut down on webrequests by fetching the nightly toml once
-		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
-			die "Failed to fetch nightly revision info"
-		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
-		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
-		einfo "Using nightly Rust from: ${rust_bin_url}"
-
-		if use rust-src; then
-			einfo "Using nightly Rust-src from: ${rustc_src_url}"
-			# We need to fetch the rust-src tarball
-			einfo "Fetching nightly rust-src tarball ..."
-			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
-				die "Failed to fetch nightly rust-src tarball."
-			# no verify-sig here, just unpack it
-			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
-		fi
-
-		einfo "Fetching nightly Rust tarball ..."
-		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
-		if use verify-sig; then
-			einfo "Fetching nightly signature ..."
-			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
-			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
-				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
-		fi
-		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
-	else
-		# sadly rust-src tarball does not have corresponding .asc file
-		# so do partial verification
-		if use verify-sig; then
-			for f in ${A}; do
-				if [[ -f ${DISTDIR}/${f}.asc ]]; then
-					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
-				fi
-			done
-		fi
-
-		default_src_unpack
-
-	fi
-	case ${PV} in
-		*9999*)
-			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
-			;;
-		*beta*)
-			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
-			;;
-		*)
-			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
-			;;
-	esac
-}
-
-patchelf_for_bin() {
-	local filetype=$(file -b ${1})
-	if [[ ${filetype} == *ELF*interpreter* ]]; then
-		einfo "${1}'s interpreter changed"
-		patchelf ${1} --set-interpreter ${2} || die
-	elif [[ ${filetype} == *script* ]]; then
-		hprefixify ${1}
-	fi
-}
-
-rust_native_abi_install() {
-	pushd "${S}" >/dev/null || die
-	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
-	local std="$(grep 'std' ./components || die "std not found in components")"
-	local components=( "rustc" "cargo" "${std}" )
-	use doc && components+=( "rust-docs" )
-	use clippy && components+=( "clippy-preview" )
-	use rustfmt && components+=( "rustfmt-preview" )
-	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
-	# Rust component 'rust-src' is extracted from separate archive
-	if use rust-src; then
-		einfo "Combining rust and rust-src installers"
-		case ${PV} in
-			*9999*)
-				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
-				;;
-			*beta*)
-				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
-				;;
-			*)
-				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
-				;;
-		esac
-		echo rust-src >> ./components || die
-		components+=( "rust-src" )
-	fi
-	edo ./install.sh \
-		--components="$(IFS=,; echo "${components[*]}")" \
-		--disable-verify \
-		--prefix="${ED}/opt/rust-bin-${SLOT}" \
-		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
-		--disable-ldconfig
-
-	docompress /opt/${P}/man/
-
-	if use prefix; then
-		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
-		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
-		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
-			while IFS=  read -r -d '' filename; do
-				patchelf_for_bin ${filename} ${interpreter} \; || die
-			done
-		eend $?
-	fi
-
-	local symlinks=(
-		cargo
-		rustc
-		rustdoc
-		rust-gdb
-		rust-gdbgui
-		rust-lldb
-	)
-
-	use clippy && symlinks+=( clippy-driver cargo-clippy )
-	use rustfmt && symlinks+=( rustfmt cargo-fmt )
-	use rust-analyzer && symlinks+=( rust-analyzer )
-
-	einfo "installing eselect-rust symlinks and paths"
-	local i
-	for i in "${symlinks[@]}"; do
-		# we need realpath on /usr/bin/* symlink return version-appended binary path.
-		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
-		local ver_i="${i}-bin-${SLOT}"
-		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
-		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
-	done
-
-	# symlinks to switch components to active rust in eselect
-	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
-
-	# make all capital underscored variable
-	local CARGO_TRIPLET="$(rust_abi)"
-	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
-	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
-	cat <<-_EOF_ > "${T}/50${P}"
-		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
-	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
-	_EOF_
-	doenvd "${T}/50${P}"
-
-	# note: eselect-rust adds EROOT to all paths below
-	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
-	/usr/bin/cargo
-	/usr/bin/rustdoc
-	/usr/bin/rust-gdb
-	/usr/bin/rust-gdbgui
-	/usr/bin/rust-lldb
-	/usr/lib/rustlib
-	/usr/lib/rust/lib
-	/usr/lib/rust/man
-	/usr/share/doc/rust
-	_EOF_
-
-	if use clippy; then
-		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
-		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
-	fi
-	if use rustfmt; then
-		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
-		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
-	fi
-	if use rust-analyzer; then
-		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
-	fi
-
-	insinto /etc/env.d/rust
-	doins "${T}/provider-${PN}-${SLOT}"
-	popd >/dev/null || die
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		rust_native_abi_install
-	else
-		local rust_target
-		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
-		dodir "/opt/${P}/lib/rustlib"
-		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
-			"${ED}/opt/${P}/lib/rustlib" || die
-	fi
-
-	# BUG: installs x86_64 binary on other arches
-	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
-}
-
-pkg_postinst() {
-	eselect rust update
-
-	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
-		elog "Rust installs helper scripts for calling GDB and LLDB,"
-		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
-	fi
-
-	if has_version app-editors/emacs; then
-		optfeature "emacs support for rust" app-emacs/rust-mode
-	fi
-
-	if has_version app-editors/gvim || has_version app-editors/vim; then
-		optfeature "vim support for rust" app-vim/rust-vim
-	fi
-}
-
-pkg_postrm() {
-	eselect rust cleanup
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild
deleted file mode 100644
index 97bd2bca57..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-1.86.0_beta20250225.ebuild
+++ /dev/null
@@ -1,317 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( 19 )
-LLVM_OPTIONAL="yes"
-
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
-
-if [[ ${PV} == *9999* ]]; then
-	# We need to fetch a tarball in src_unpack
-	PROPERTIES+=" live"
-elif [[ ${PV} == *beta* ]]; then
-	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep "xz_url.*rust-src"
-	betaver=${PV//*beta}
-	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
-	RUST_TOOLCHAIN_BASEURL=https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/
-	SRC_URI="$(rust_all_arch_uris rust-beta rust-${PV})
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/rust-src-beta.tar.xz -> rust-src-${PV}.tar.xz )
-	"
-else
-	# curl -Ls static.rust-lang.org/dist/channel-rust-${PV}.toml | grep "xz_url.*rust-src"
-	SRC_URI="$(rust_all_arch_uris "${PV}")
-		rust-src? ( ${RUST_TOOLCHAIN_BASEURL%/}/2025-01-30/rust-src-${PV}.tar.xz )
-	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-GENTOO_BIN_BASEURI="https://github.com/projg2/rust-bootstrap/releases/download/${PVR}" # omit trailing slash
-
-DESCRIPTION="Systems programming language from Mozilla"
-HOMEPAGE="https://www.rust-lang.org/"
-
-if [[ ${PV} != *9999* && ${PV} != *beta* ]] ; then
-	# Keep this separate to allow easy commenting out if not yet built
-	SRC_URI+=" sparc? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-sparc64-unknown-linux-gnu.tar.xz ) "
-	SRC_URI+=" mips? (
-		abi_mips_o32? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips-unknown-linux-gnu.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mipsel-unknown-linux-gnu.tar.xz )
-		)
-		abi_mips_n64? (
-			big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64-unknown-linux-gnuabi64.tar.xz )
-			!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-mips64el-unknown-linux-gnuabi64.tar.xz )
-		)
-	)"
-	SRC_URI+=" riscv? (
-		elibc_musl? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-riscv64gc-unknown-linux-musl.tar.xz )
-	)"
-	SRC_URI+=" ppc64? ( elibc_musl? (
-		big-endian?  ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64-unknown-linux-musl.tar.xz )
-		!big-endian? ( ${GENTOO_BIN_BASEURI}/rust-${PVR}-powerpc64le-unknown-linux-musl.tar.xz )
-	) )"
-fi
-
-LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
-IUSE="big-endian clippy cpu_flags_x86_sse2 doc prefix rust-analyzer rust-src rustfmt"
-
-RDEPEND="
-	>=app-eselect/eselect-rust-20190311
-	dev-libs/openssl
-	sys-apps/lsb-release
-	sys-devel/gcc:*
-	!dev-lang/rust:stable
-	!dev-lang/rust-bin:stable
-"
-BDEPEND="
-	prefix? ( dev-util/patchelf )
-	verify-sig? ( sec-keys/openpgp-keys-rust )
-"
-[[ ${PV} == *9999* ]] && BDEPEND+=" net-misc/curl"
-
-REQUIRED_USE="x86? ( cpu_flags_x86_sse2 )"
-
-# stripping rust may break it (at least on x86_64)
-# https://github.com/rust-lang/rust/issues/112286
-RESTRICT="strip"
-
-QA_PREBUILT="
-	opt/rust-bin-${SLOT}/bin/.*
-	opt/rust-bin-${SLOT}/lib/.*.so*
-	opt/rust-bin-${SLOT}/libexec/.*
-	opt/rust-bin-${SLOT}/lib/rustlib/.*/bin/.*
-	opt/rust-bin-${SLOT}/lib/rustlib/.*/lib/.*
-"
-
-# An rmeta file is custom binary format that contains the metadata for the crate.
-# rmeta files do not support linking, since they do not contain compiled object files.
-# so we can safely silence the warning for this QA check.
-QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
-
-VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
-
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
-src_unpack() {
-	if [[ ${PV} == *9999* ]]; then
-		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
-		local rust_bin_url rustc_src_url
-		# Cut down on webrequests by fetching the nightly toml once
-		curl -Ls static.rust-lang.org/dist/channel-rust-nightly.toml > "${WORKDIR}/channel-rust-nightly.toml" ||
-			die "Failed to fetch nightly revision info"
-		rustc_src_url=$(grep 'xz_url.*rust-src' "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
-		rust_bin_url=$(grep "xz_url.*rust-nightly-$(rust_abi)" "${WORKDIR}/channel-rust-nightly.toml" | cut -d '"' -f 2)
-		einfo "Using nightly Rust from: ${rust_bin_url}"
-
-		if use rust-src; then
-			einfo "Using nightly Rust-src from: ${rustc_src_url}"
-			# We need to fetch the rust-src tarball
-			einfo "Fetching nightly rust-src tarball ..."
-			curl --progress-bar -L "${rustc_src_url}" -o "${WORKDIR}/rust-src-${PV}.tar.xz" ||
-				die "Failed to fetch nightly rust-src tarball."
-			# no verify-sig here, just unpack it
-			tar -xf "${WORKDIR}/rust-src-${PV}.tar.xz" || die "Failed to unpack nightly rust-src tarball"
-		fi
-
-		einfo "Fetching nightly Rust tarball ..."
-		curl --progress-bar -L "${rust_bin_url}" -O || die "Failed to fetch nightly tarball"
-		if use verify-sig; then
-			einfo "Fetching nightly signature ..."
-			curl --progress-bar -L "${rust_bin_url}.asc" -O || die "Failed to fetch nightly signature"
-			verify-sig_verify_detached "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" \
-				"${WORKDIR}/rust-nightly-$(rust_abi).tar.xz.asc"
-		fi
-		tar -xf "${WORKDIR}/rust-nightly-$(rust_abi).tar.xz" || die "Failed to unpack nightly tarball"
-	else
-		# sadly rust-src tarball does not have corresponding .asc file
-		# so do partial verification
-		if use verify-sig; then
-			for f in ${A}; do
-				if [[ -f ${DISTDIR}/${f}.asc ]]; then
-					verify-sig_verify_detached "${DISTDIR}/${f}" "${DISTDIR}/${f}.asc"
-				fi
-			done
-		fi
-
-		default_src_unpack
-
-	fi
-	case ${PV} in
-		*9999*)
-			mv "${WORKDIR}/rust-nightly-$(rust_abi)" "${S}" || die
-			;;
-		*beta*)
-			mv "${WORKDIR}/rust-beta-$(rust_abi)" "${S}" || die
-			;;
-		*)
-			mv "${WORKDIR}/rust-${PV}-$(rust_abi)" "${S}" || die
-			;;
-	esac
-}
-
-patchelf_for_bin() {
-	local filetype=$(file -b ${1})
-	if [[ ${filetype} == *ELF*interpreter* ]]; then
-		einfo "${1}'s interpreter changed"
-		patchelf ${1} --set-interpreter ${2} || die
-	elif [[ ${filetype} == *script* ]]; then
-		hprefixify ${1}
-	fi
-}
-
-rust_native_abi_install() {
-	pushd "${S}" >/dev/null || die
-	local analysis="$(grep 'analysis' ./components || die "analysis not found in components")"
-	local std="$(grep 'std' ./components || die "std not found in components")"
-	local components=( "rustc" "cargo" "${std}" )
-	use doc && components+=( "rust-docs" )
-	use clippy && components+=( "clippy-preview" )
-	use rustfmt && components+=( "rustfmt-preview" )
-	use rust-analyzer && components+=( "rust-analyzer-preview" "${analysis}" )
-	# Rust component 'rust-src' is extracted from separate archive
-	if use rust-src; then
-		einfo "Combining rust and rust-src installers"
-		case ${PV} in
-			*9999*)
-				mv -v "${WORKDIR}/rust-src-nightly/rust-src" "${S}" || die
-				;;
-			*beta*)
-				mv -v "${WORKDIR}/rust-src-beta/rust-src" "${S}" || die
-				;;
-			*)
-				mv -v "${WORKDIR}/rust-src-${PV}/rust-src" "${S}" || die
-				;;
-		esac
-		echo rust-src >> ./components || die
-		components+=( "rust-src" )
-	fi
-	edo ./install.sh \
-		--components="$(IFS=,; echo "${components[*]}")" \
-		--disable-verify \
-		--prefix="${ED}/opt/rust-bin-${SLOT}" \
-		--mandir="${ED}/opt/rust-bin-${SLOT}/man" \
-		--disable-ldconfig
-
-	docompress /opt/${P}/man/
-
-	if use prefix; then
-		local interpreter=$(patchelf --print-interpreter "${EPREFIX}"/bin/bash)
-		ebegin "Changing interpreter to ${interpreter} for Gentoo prefix at ${ED}/opt/${SLOT}/bin"
-		find "${ED}/opt/${SLOT}/bin" -type f -print0 | \
-			while IFS=  read -r -d '' filename; do
-				patchelf_for_bin ${filename} ${interpreter} \; || die
-			done
-		eend $?
-	fi
-
-	local symlinks=(
-		cargo
-		rustc
-		rustdoc
-		rust-gdb
-		rust-gdbgui
-		rust-lldb
-	)
-
-	use clippy && symlinks+=( clippy-driver cargo-clippy )
-	use rustfmt && symlinks+=( rustfmt cargo-fmt )
-	use rust-analyzer && symlinks+=( rust-analyzer )
-
-	einfo "installing eselect-rust symlinks and paths"
-	local i
-	for i in "${symlinks[@]}"; do
-		# we need realpath on /usr/bin/* symlink return version-appended binary path.
-		# so /usr/bin/rustc should point to /opt/rust-bin-<ver>/bin/rustc-<ver>
-		local ver_i="${i}-bin-${SLOT}"
-		ln -v "${ED}/opt/rust-bin-${SLOT}/bin/${i}" "${ED}/opt/rust-bin-${SLOT}/bin/${ver_i}" || die
-		dosym -r "/opt/rust-bin-${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
-	done
-
-	# symlinks to switch components to active rust in eselect
-	dosym -r "/opt/rust-bin-${SLOT}/lib" "/usr/lib/rust/lib-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/man" "/usr/lib/rust/man-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/lib/rustlib" "/usr/lib/rustlib-bin-${SLOT}"
-	dosym -r "/opt/rust-bin-${SLOT}/share/doc/rust" "/usr/share/doc/rust-bin-${SLOT}"
-
-	# make all capital underscored variable
-	local CARGO_TRIPLET="$(rust_abi)"
-	CARGO_TRIPLET="${CARGO_TRIPLET//-/_}"
-	CARGO_TRIPLET="${CARGO_TRIPLET^^}"
-	cat <<-_EOF_ > "${T}/50${P}"
-		MANPATH="${EPREFIX}/usr/lib/rust/man-bin-${SLOT}"
-	$(usev elibc_musl "CARGO_TARGET_${CARGO_TRIPLET}_RUSTFLAGS=\"-C target-feature=-crt-static\"")
-	_EOF_
-	doenvd "${T}/50${P}"
-
-	# note: eselect-rust adds EROOT to all paths below
-	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
-	/usr/bin/cargo
-	/usr/bin/rustdoc
-	/usr/bin/rust-gdb
-	/usr/bin/rust-gdbgui
-	/usr/bin/rust-lldb
-	/usr/lib/rustlib
-	/usr/lib/rust/lib
-	/usr/lib/rust/man
-	/usr/share/doc/rust
-	_EOF_
-
-	if use clippy; then
-		echo /usr/bin/clippy-driver >> "${T}/provider-${PN}-${SLOT}"
-		echo /usr/bin/cargo-clippy >> "${T}/provider-${PN}-${SLOT}"
-	fi
-	if use rustfmt; then
-		echo /usr/bin/rustfmt >> "${T}/provider-${PN}-${SLOT}"
-		echo /usr/bin/cargo-fmt >> "${T}/provider-${PN}-${SLOT}"
-	fi
-	if use rust-analyzer; then
-		echo /usr/bin/rust-analyzer >> "${T}/provider-${PN}-${SLOT}"
-	fi
-
-	insinto /etc/env.d/rust
-	doins "${T}/provider-${PN}-${SLOT}"
-	popd >/dev/null || die
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		rust_native_abi_install
-	else
-		local rust_target
-		rust_target="$(rust_abi $(get_abi_CHOST ${v##*.}))"
-		dodir "/opt/${P}/lib/rustlib"
-		cp -vr "${WORKDIR}/rust-${PV}-${rust_target}/rust-std-${rust_target}/lib/rustlib/${rust_target}"\
-			"${ED}/opt/${P}/lib/rustlib" || die
-	fi
-
-	# BUG: installs x86_64 binary on other arches
-	rm -f "${ED}/opt/${P}/lib/rustlib/"*/bin/rust-llvm-dwp || die
-}
-
-pkg_postinst() {
-	eselect rust update
-
-	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
-		elog "Rust installs helper scripts for calling GDB and LLDB,"
-		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
-	fi
-
-	if has_version app-editors/emacs; then
-		optfeature "emacs support for rust" app-emacs/rust-mode
-	fi
-
-	if has_version app-editors/gvim || has_version app-editors/vim; then
-		optfeature "vim support for rust" app-vim/rust-vim
-	fi
-}
-
-pkg_postrm() {
-	eselect rust cleanup
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
index 6338d2da24..e00494d54b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-bin/rust-bin-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 LLVM_COMPAT=( 20 )
 LLVM_OPTIONAL="yes"
 
-inherit edo llvm-r1 multilib prefix rust-toolchain toolchain-funcs verify-sig multilib-minimal optfeature
+inherit edo llvm-r1 multilib prefix rust-toolchain verify-sig multilib-minimal optfeature
 
 if [[ ${PV} == *9999* ]]; then
 	# We need to fetch a tarball in src_unpack
@@ -96,12 +96,6 @@ QA_EXECSTACK="opt/${P}/lib/rustlib/*/lib*.rlib:lib.rmeta"
 
 VERIFY_SIG_OPENPGP_KEY_PATH="/usr/share/openpgp-keys/rust.asc"
 
-pkg_pretend() {
-	if [[ "$(tc-is-softfloat)" != "no" ]] && [[ ${CHOST} == armv7* ]]; then
-		die "${CHOST} is not supported by upstream Rust. You must use a hard float version."
-	fi
-}
-
 src_unpack() {
 	if [[ ${PV} == *9999* ]]; then
 		# We need to fetch the latest nightly listing and get the apprapriate src_uri for our arch
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
index cd740e8abf..8ec85e483c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/Manifest
@@ -8,5 +8,5 @@ DIST rustc-1.84.1-src.tar.xz 355078168 BLAKE2B 849e8c909493bf76ce9749b9dcb196718
 DIST rustc-1.84.1-src.tar.xz.asc 801 BLAKE2B f3decd3470fd1eff33adbb376490a30eb8db28dd4176bde0fefe4f60acf79c3dd0e1a330d519b5319360136ea7d0a124f6720dea08617202d9e9298da992ccf6 SHA512 a241fe3efba293f3e872b74f09dd0d184e0239afd1416326d57bf1134d92721c65b187f5c99962b51671877a539f18e82d2d797c76af42615c11a8bb3905f796
 DIST rustc-1.85.1-src.tar.xz 274028992 BLAKE2B 1dddbbc0d14fe9551fd2eb59a47521ac7eaf783b8ebf5e89d3e82b38f3f1539c14626a86b6530a47e5a967d47a04db7a3daef568eb5164f42d98b6826346cffe SHA512 d61afb4f00d0c63eef132e10ca5369202064ecad8ab5bcf4fbd62e9a20b2bd71840b2a769dadcf43452fc0448865975c9de1c129752caa9928d2757027bacf7c
 DIST rustc-1.85.1-src.tar.xz.asc 801 BLAKE2B 07409ef6c044b72394a28dfd5b5decb237ca540714010a4f81e4213a3bf7ffb2e14029789f930cea0dab115a6e986859f6cdefd3798be780c2ff21c3e5fa6593 SHA512 7f19653fd05c89390a4073f5184ca162863b7116cc4d8867a5aa4304568880707ebb9f9dda166d7d04f30b2df6ed223eedd98df1744f809773054edfcd2385ff
-DIST rustc-1.86.0_beta20250218-src.tar.xz 280540916 BLAKE2B ed3fe1b1ce392ffd264dd78c00e43b478d14c6bf9bc7120aa484c46a72ff904abf3ed1d1d539828a22071997860d186ecf9d5d4abed25f14cbbe0068dee06a5e SHA512 bd8982d6adee08e0b39a58786741594e0c651cd107818178aca0ded3c3272239be3c4f0f6b617679bc8b1cea67e4b5924d6bb1ae8a9d5903fb77245dd8ac528b
-DIST rustc-1.86.0_beta20250218-src.tar.xz.asc 801 BLAKE2B 8a7c489f9087342074262c64089922b97e886aa6d3f89c2a0ed1185e084c8bed07d57c363608f26536ca884d764aa43e3ade214ab4fe4e67e9c6d7e1338e93aa SHA512 d34b536200fdb4c7e85af005b1753ce88f32a1faa418a01de21de992679d744ec396fd0f9aaaf851569de1f4f06f14a6481b68b1378659b3475d30818421ea3a
+DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef2ddf2ad52acb5d9ee78496a7b5dbc10da5a51c72cf2a6f66d543a531d3138a49767c98501ae4e885e03988d2ccfbb59 SHA512 9ce195e24a03765f7163de16271e3d19d731d4b80fcc2bfd919106c9d42543eade018f712f6947ea3c6e57c6cb2e6841596aa668d608b8da15101a7da14f3097
+DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0_beta20250218.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0_beta20250218.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0.ebuild
index 223c50f26f..26c4792d0f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0_beta20250218.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust-common/rust-common-1.86.0.ebuild
@@ -54,7 +54,8 @@ src_unpack() {
 		fi
 
 		# Avoid unpacking the whole tarball which would need check-reqs
-		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz "rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
+		tar -xf "${DISTDIR}"/rustc-${PV}-src.tar.xz \
+			"rustc-${MY_PV}-src/src/tools/cargo/src/etc/"{_cargo,cargo.bashcomp.sh} || die
 	fi
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
index da725a7043..ce14b91a2c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/Manifest
@@ -1,5 +1,3 @@
-DIST rust-1.86.0_beta20250218-vendor-in-install-phase.patch 22553 BLAKE2B a99d31c5ceeec4c74453849d87c35969ad3924cff48861a1c3009c78ac59440c8a1bd3088f0dace262558cff27197a932f3c81872d4ede4f3c5a03c27e6dc316 SHA512 228c551b7dfd4b43e3b34a97c7d55121cfc15f4c999c15e8ee2a30b41757099ae493148aaedf86f5e4e4143e26ae02464ab725162f1dcad68a0315cfadf3ab8a
-DIST rust-1.86.0_beta20250225-vendor-in-install-phase.patch 22527 BLAKE2B 79c800e3ea5eef31e5603a6f3ec99606065f1c383751a989c9835490c2717620a71dc5bdc3613fbcc30ef45862090a8bc5049ba9ae6af861b20159a9cee96682 SHA512 cbfdcc55759c60b575808f2c6ec245d2ea271558295ea4ff4013933bf26252e00017422c286023a6f7089f2edcfe90c49cb06a07c4c41f2bf40e20c8dc85a604
 DIST rustc-1.71.1-src.tar.xz 151983068 BLAKE2B 3dfdbc246feb84a79ae94c2de978c5585ee06cf6b683d2245869b62e28f7c79f89cc589f5431537713bf088236a0b824acefc1b68e418e9eb72e1eea98054e3f SHA512 fd0e5a16bdbeb539184513583089e55f681cb772810df357b6b1464853f7022ac02edab3dd155b2262ed0047e2a25dea3808dd078dcdfce9d399384465009db4
 DIST rustc-1.71.1-src.tar.xz.asc 801 BLAKE2B a88c073a70552d73e2d7695eceabdaa478f34501b7271fabf7f4a09f3efa545181f34353e45776b05918e6aeba88adb02f9731454f7085a7abf1602fc6589983 SHA512 9dd0406cf22f1daa7fcfd015fc1c6f8d36586aa99bf14c1491ee464c1f892ab759feb83e8b55b64713170fb777fdbe038fb5fd01a59c911b6599223baaba0677
 DIST rustc-1.74.1-src.tar.xz 155968724 BLAKE2B e05f2379ac94b286f85791a138e1928e5b5b5a7749f0981d82c40c2a12860f55bf96bb2f0e924e35a0f8b2447b13052d38adea909aaa3199105787bb5a4861b3 SHA512 14c7e7ed2f38ab60299d8c7d41d78f042b6b57ef822d577b5138e60bdde31cf141eccd4332a25bc5da3d58eb5313d63c1448b5dfe9e11b8055bb8ea133a9038d
@@ -30,7 +28,5 @@ DIST rustc-1.85.0-src.tar.xz 274011696 BLAKE2B 9cb1c5b9fa9b0ee8a3150d634b58f4d14
 DIST rustc-1.85.0-src.tar.xz.asc 801 BLAKE2B 8168c984f69356898f7a51199f3250a51c58a6512463cd5011acdff8c63754ba196bb050dba95b73d37c7e6d4bbcd3d1cb471d067a6615cd81b8969394e3539a SHA512 b96fffde7eb3d98cca6abe44e671fd4752416357ab3180d2a09a60fc022ac03d10e64ae285ef6276b8d881d6154fd7398f46666f5a2ea6f3023ea38fd543f59e
 DIST rustc-1.85.1-src.tar.xz 274028992 BLAKE2B 1dddbbc0d14fe9551fd2eb59a47521ac7eaf783b8ebf5e89d3e82b38f3f1539c14626a86b6530a47e5a967d47a04db7a3daef568eb5164f42d98b6826346cffe SHA512 d61afb4f00d0c63eef132e10ca5369202064ecad8ab5bcf4fbd62e9a20b2bd71840b2a769dadcf43452fc0448865975c9de1c129752caa9928d2757027bacf7c
 DIST rustc-1.85.1-src.tar.xz.asc 801 BLAKE2B 07409ef6c044b72394a28dfd5b5decb237ca540714010a4f81e4213a3bf7ffb2e14029789f930cea0dab115a6e986859f6cdefd3798be780c2ff21c3e5fa6593 SHA512 7f19653fd05c89390a4073f5184ca162863b7116cc4d8867a5aa4304568880707ebb9f9dda166d7d04f30b2df6ed223eedd98df1744f809773054edfcd2385ff
-DIST rustc-1.86.0_beta20250218-src.tar.xz 280540916 BLAKE2B ed3fe1b1ce392ffd264dd78c00e43b478d14c6bf9bc7120aa484c46a72ff904abf3ed1d1d539828a22071997860d186ecf9d5d4abed25f14cbbe0068dee06a5e SHA512 bd8982d6adee08e0b39a58786741594e0c651cd107818178aca0ded3c3272239be3c4f0f6b617679bc8b1cea67e4b5924d6bb1ae8a9d5903fb77245dd8ac528b
-DIST rustc-1.86.0_beta20250218-src.tar.xz.asc 801 BLAKE2B 8a7c489f9087342074262c64089922b97e886aa6d3f89c2a0ed1185e084c8bed07d57c363608f26536ca884d764aa43e3ade214ab4fe4e67e9c6d7e1338e93aa SHA512 d34b536200fdb4c7e85af005b1753ce88f32a1faa418a01de21de992679d744ec396fd0f9aaaf851569de1f4f06f14a6481b68b1378659b3475d30818421ea3a
-DIST rustc-1.86.0_beta20250225-src.tar.xz 280546668 BLAKE2B ea1956a83175a2cda21b6ad1ead38d8d0f6c95559d2e329bf0e4ca13d0ff6562d017d5bffbb57f9d6d232b1f87f3d190718bc0b90c6938b06763526fac083ada SHA512 782fafa305b8766db3d23796014a5897470988c9447baf4bee35d98b90382b5a727d0aecc3dabbdab0f82b6d862def8be23d8a6cf3d98cc96f18cf4a2bc38f66
-DIST rustc-1.86.0_beta20250225-src.tar.xz.asc 801 BLAKE2B 517f8d88edc1ef4ebd25d66a1be4f37718bfa361f8ae1001aca85ba626dacfef6ae27a327f33dd1ae9db7e57a91eab2d8bbfe910b5789df0998dd18026c75726 SHA512 50e3c85b7c6a7f42e094e63f4ee554d2d944a8e153ab5dbd1c2a09a1f44c6ee53cb1c4985080a373c5cb09681bc5b987e8a8e2f56a0a0053ccea99f22dc92986
+DIST rustc-1.86.0-src.tar.xz 275696736 BLAKE2B 9f33a710a3e567d92f56091920643f5ef2ddf2ad52acb5d9ee78496a7b5dbc10da5a51c72cf2a6f66d543a531d3138a49767c98501ae4e885e03988d2ccfbb59 SHA512 9ce195e24a03765f7163de16271e3d19d731d4b80fcc2bfd919106c9d42543eade018f712f6947ea3c6e57c6cb2e6841596aa668d608b8da15101a7da14f3097
+DIST rustc-1.86.0-src.tar.xz.asc 801 BLAKE2B 3e10a3894c7eee68d37bc5707d797548119f830667e27e652a199d13633199713bd01bd0f41a5f2af3c682561903e36abe27b36ef78d9a1d65bdf485527d2c15 SHA512 0b74dab9ee56d0a08e26e9cd40f722e4d99de63ac678f969f0c54d50737074fb28e170db5a36ce2627ec332e5ce3bb8a92167aefbccff7c70e4cb057bc0a94ac
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild
index 7590d615f0..41f407880e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250225.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0.ebuild
@@ -8,13 +8,13 @@ PYTHON_COMPAT=( python3_{10..13} )
 
 RUST_MAX_VER=${PV%%_*}
 if [[ ${PV} == *9999* ]]; then
-	RUST_MIN_VER="1.86.0" # Update this as new `beta` releases come out.
+	RUST_MIN_VER="1.85.0" # Update this as new `beta` releases come out.
 elif [[ ${PV} == *beta* ]]; then
 	# Enforce that `beta` is built from `stable`.
 	# While uncommon it is possible for feature changes within `beta` to result
 	# in an older snapshot being unable to build a newer one without modifying the sources.
 	# 'stable' releases should always be able to build a beta snapshot so just use those.
-	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
+	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).1"
 	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
 else
 	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
@@ -39,7 +39,6 @@ elif [[ ${PV} == *beta* ]]; then
 	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
 		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
 			-> rustc-${PV}-src.tar.xz.asc )
-		https://github.com/rust-lang/rust/pull/137020.patch -> ${P}-vendor-in-install-phase.patch
 	"
 	S="${WORKDIR}/${MY_P}-src"
 else
@@ -69,7 +68,7 @@ for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
 done
 
 LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
+SLOT="$(ver_cut 1-2)"
 
 IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src +system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
 
@@ -167,7 +166,6 @@ RESTRICT="test"
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
 
 PATCHES=(
-	"${DISTDIR}"/${P}-vendor-in-install-phase.patch
 	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
 	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
 	"${FILESDIR}"/1.67.0-doc-wasm.patch
@@ -219,12 +217,7 @@ src_unpack() {
 			directory = "vendor"
 		_EOF_
 	else
-		# Until upstream merge this patch we can't use the default verify-sig_src_unpack
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/rustc-${PV}-src.tar.xz" \
-				"${DISTDIR}/rustc-${PV}-src.tar.xz.asc"
-		fi
-		default_src_unpack
+		verify-sig_src_unpack
 	fi
 }
 
@@ -726,7 +719,7 @@ src_install() {
 		# we need realpath on /usr/bin/* symlink return version-appended binary path.
 		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
 		# need to fix eselect-rust to remove this hack.
-		local ver_i="${i}-${PV%%_*}"
+		local ver_i="${i}-${SLOT}"
 		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
 			einfo "Installing ${i} symlink"
 			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
@@ -735,6 +728,7 @@ src_install() {
 			ewarn "please report this"
 		fi
 		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
+		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${i}-${PV%%_*}"
 	done
 
 	# symlinks to switch components to active rust in eselect
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild
deleted file mode 100644
index c22abb3204..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/rust/rust-1.86.0_beta20250218-r1.ebuild
+++ /dev/null
@@ -1,815 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LLVM_COMPAT=( 19 )
-PYTHON_COMPAT=( python3_{10..13} )
-
-RUST_MAX_VER=${PV%%_*}
-if [[ ${PV} == *9999* ]]; then
-	RUST_MIN_VER="1.86.0" # Update this as new `beta` releases come out.
-elif [[ ${PV} == *beta* ]]; then
-	# Enforce that `beta` is built from `stable`.
-	# While uncommon it is possible for feature changes within `beta` to result
-	# in an older snapshot being unable to build a newer one without modifying the sources.
-	# 'stable' releases should always be able to build a beta snapshot so just use those.
-	RUST_MAX_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
-	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
-else
-	RUST_MIN_VER="$(ver_cut 1).$(($(ver_cut 2) - 1)).0"
-fi
-
-inherit check-reqs estack flag-o-matic llvm-r1 multiprocessing optfeature \
-	multilib multilib-build python-any-r1 rust rust-toolchain toolchain-funcs verify-sig
-
-if [[ ${PV} = *9999* ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/rust-lang/rust.git"
-	EGIT_SUBMODULES=(
-		"*"
-		"-src/gcc"
-	)
-elif [[ ${PV} == *beta* ]]; then
-	# Identify the snapshot date of the beta release:
-	# curl -Ls static.rust-lang.org/dist/channel-rust-beta.toml | grep beta-src.tar.xz
-	betaver=${PV//*beta}
-	BETA_SNAPSHOT="${betaver:0:4}-${betaver:4:2}-${betaver:6:2}"
-	MY_P="rustc-beta"
-	SRC_URI="https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz -> rustc-${PV}-src.tar.xz
-		verify-sig? ( https://static.rust-lang.org/dist/${BETA_SNAPSHOT}/rustc-beta-src.tar.xz.asc
-			-> rustc-${PV}-src.tar.xz.asc )
-		https://github.com/rust-lang/rust/pull/137020.patch -> ${P}-vendor-in-install-phase.patch
-	"
-	S="${WORKDIR}/${MY_P}-src"
-else
-	MY_P="rustc-${PV}"
-	SRC_URI="https://static.rust-lang.org/dist/${MY_P}-src.tar.xz
-		verify-sig? ( https://static.rust-lang.org/dist/${MY_P}-src.tar.xz.asc )
-	"
-	S="${WORKDIR}/${MY_P}-src"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
-fi
-
-DESCRIPTION="Systems programming language originally developed by Mozilla"
-HOMEPAGE="https://www.rust-lang.org/"
-
-# keep in sync with llvm ebuild of the same version as bundled one.
-ALL_LLVM_TARGETS=( AArch64 AMDGPU ARC ARM AVR BPF CSKY DirectX Hexagon Lanai
-	LoongArch M68k Mips MSP430 NVPTX PowerPC RISCV Sparc SPIRV SystemZ VE
-	WebAssembly X86 XCore Xtensa )
-ALL_LLVM_TARGETS=( "${ALL_LLVM_TARGETS[@]/#/llvm_targets_}" )
-LLVM_TARGET_USEDEPS=${ALL_LLVM_TARGETS[@]/%/(-)?}
-
-# https://github.com/rust-lang/llvm-project/blob/rustc-1.84.0/llvm/CMakeLists.txt
-_ALL_RUST_EXPERIMENTAL_TARGETS=( ARC CSKY DirectX M68k SPIRV Xtensa )
-declare -A ALL_RUST_EXPERIMENTAL_TARGETS
-for _x in "${_ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
-	ALL_RUST_EXPERIMENTAL_TARGETS["llvm_targets_${_x}"]=0
-done
-
-LICENSE="|| ( MIT Apache-2.0 ) BSD BSD-1 BSD-2 BSD-4"
-SLOT="${PV%%_*}" # Beta releases get to share the same SLOT as the eventual stable
-
-IUSE="big-endian clippy cpu_flags_x86_sse2 debug dist doc llvm-libunwind lto rustfmt rust-analyzer rust-src system-llvm test wasm ${ALL_LLVM_TARGETS[*]}"
-
-if [[ ${PV} = *9999* ]]; then
-	# These USE flags require nightly rust
-	IUSE+=" miri"
-fi
-
-LLVM_DEPEND=()
-# splitting usedeps needed to avoid CI/pkgcheck's UncheckableDep limitation
-for _x in "${ALL_LLVM_TARGETS[@]}"; do
-	LLVM_DEPEND+=( "	${_x}? ( $(llvm_gen_dep "llvm-core/llvm:\${LLVM_SLOT}[${_x}]") )" )
-	if [[ -v ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"] ]] ; then
-		ALL_RUST_EXPERIMENTAL_TARGETS["${_x}"]=1
-	fi
-done
-LLVM_DEPEND+=( "	wasm? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )" )
-LLVM_DEPEND+=( "	$(llvm_gen_dep 'llvm-core/llvm:${LLVM_SLOT}')" )
-
-BDEPEND="${PYTHON_DEPS}
-	app-eselect/eselect-rust
-	|| (
-		>=sys-devel/gcc-4.7[cxx]
-		>=llvm-core/clang-3.5
-	)
-	lto? ( $(llvm_gen_dep 'llvm-core/lld:${LLVM_SLOT}') )
-	!system-llvm? (
-		>=dev-build/cmake-3.13.4
-		app-alternatives/ninja
-	)
-	test? ( dev-debug/gdb )
-	verify-sig? ( sec-keys/openpgp-keys-rust )
-"
-
-DEPEND="
-	>=app-arch/xz-utils-5.2
-	net-misc/curl:=[http2,ssl]
-	sys-libs/zlib:=
-	dev-libs/openssl:0=
-	system-llvm? (
-		${LLVM_DEPEND[*]}
-		llvm-libunwind? ( llvm-runtimes/libunwind:= )
-	)
-	!system-llvm? (
-		!llvm-libunwind? (
-			elibc_musl? ( sys-libs/libunwind:= )
-		)
-	)
-"
-
-RDEPEND="${DEPEND}
-	app-eselect/eselect-rust
-	dev-lang/rust-common
-	sys-apps/lsb-release
-	!dev-lang/rust:stable
-	!dev-lang/rust-bin:stable
-"
-
-REQUIRED_USE="|| ( ${ALL_LLVM_TARGETS[*]} )
-	rust-analyzer? ( rust-src )
-	test? ( ${ALL_LLVM_TARGETS[*]} )
-	wasm? ( llvm_targets_WebAssembly )
-	x86? ( cpu_flags_x86_sse2 )
-"
-
-# we don't use cmake.eclass, but can get a warning
-CMAKE_WARN_UNUSED_CLI=no
-
-QA_FLAGS_IGNORED="
-	usr/lib/${PN}/${SLOT}/bin/.*
-	usr/lib/${PN}/${SLOT}/libexec/.*
-	usr/lib/${PN}/${SLOT}/lib/lib.*.so
-	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/.*
-	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
-"
-
-QA_SONAME="
-	usr/lib/${PN}/${SLOT}/lib/lib.*.so.*
-	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/lib.*.so
-"
-
-QA_PRESTRIPPED="
-	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/bin/rust-llvm-dwp
-	usr/lib/${PN}/${SLOT}/lib/rustlib/.*/lib/self-contained/crtn.o
-"
-
-# An rmeta file is custom binary format that contains the metadata for the crate.
-# rmeta files do not support linking, since they do not contain compiled object files.
-# so we can safely silence the warning for this QA check.
-QA_EXECSTACK="usr/lib/${PN}/${SLOT}/lib/rustlib/*/lib*.rlib:lib.rmeta"
-
-# causes double bootstrap
-RESTRICT="test"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/rust.asc
-
-PATCHES=(
-	"${DISTDIR}"/${P}-vendor-in-install-phase.patch
-	"${FILESDIR}"/1.85.0-cross-compile-libz.patch
-	"${FILESDIR}"/1.85.0-musl-dynamic-linking.patch
-	"${FILESDIR}"/1.67.0-doc-wasm.patch
-)
-
-clear_vendor_checksums() {
-	sed -i 's/\("files":{\)[^}]*/\1/' "vendor/${1}/.cargo-checksum.json" || die
-}
-
-toml_usex() {
-	usex "${1}" true false
-}
-
-src_unpack() {
-	if [[ ${PV} = *9999* ]]; then
-		git-r3_src_unpack
-		mkdir "${S}/.cargo" || die # The vendor script has a check for .cargo/config{,.toml}
-		touch "${S}/.cargo/config.toml" || die
-		local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
-		local rust_build=""
-		local rust_host=""
-		# Configure vendor to use the portage-provided toolchain. This prevents it from
-		# attempting to fetch a `beta` toolchain from the internet.
-		cat <<- _EOF_ > "${T}/vendor-config.toml"
-			[build]
-			build = "$(rust_abi "${CBUILD}")"
-			host = ["$(rust_abi "${CHOST}")"]
-			target = ["$(rust_abi "${CHOST}")"]
-			cargo = "${rust_stage0_root}/bin/cargo"
-			rustc = "${rust_stage0_root}/bin/rustc"
-			rustfmt = "${rust_stage0_root}/bin/rustfmt"
-		_EOF_
-		# We're using git sources so we need to run the Vendor script
-		# to ensure that all dependencies are present and up-to-date
-		mkdir "${S}/vendor" || die
-		# This also compiles the 'build helper', there's no way to avoid this.
-		${EPYTHON} "${S}"/x.py vendor -vvv --config="${T}"/vendor-config.toml -j$(makeopts_jobs) ||
-			die "Failed to vendor dependencies"
-		# TODO: This has to be generated somehow, this is from a 1.84.x tarball I had lying around.
-		cat <<- _EOF_ > "${S}/.cargo/config.toml"
-			[source.crates-io]
-			replace-with = "vendored-sources"
-
-			[source."git+https://github.com/rust-lang/team"]
-			git = "https://github.com/rust-lang/team"
-			replace-with = "vendored-sources"
-
-			[source.vendored-sources]
-			directory = "vendor"
-		_EOF_
-	else
-		# Until upstream merge this patch we can't use the default verify-sig_src_unpack
-		if use verify-sig; then
-			verify-sig_verify_detached "${DISTDIR}/rustc-${PV}-src.tar.xz" \
-				"${DISTDIR}/rustc-${PV}-src.tar.xz.asc"
-		fi
-		default_src_unpack
-	fi
-}
-
-pre_build_checks() {
-	local M=9216
-	# multiply requirements by 1.3 if we are doing x86-multilib
-	if use amd64; then
-		M=$(( $(usex abi_x86_32 13 10) * ${M} / 10 ))
-	fi
-	M=$(( $(usex clippy 128 0) + ${M} ))
-	if [[ ${PV} == *9999* ]]; then
-		M=$(( $(usex miri 128 0) + ${M} ))
-	fi
-	M=$(( $(usex rustfmt 256 0) + ${M} ))
-	# add 2G if we compile llvm and 256M per llvm_target
-	if ! use system-llvm; then
-		M=$(( 2048 + ${M} ))
-		local ltarget
-		for ltarget in ${ALL_LLVM_TARGETS[@]}; do
-			M=$(( $(usex ${ltarget} 256 0) + ${M} ))
-		done
-	fi
-	M=$(( $(usex wasm 256 0) + ${M} ))
-	M=$(( $(usex debug 2 1) * ${M} ))
-	eshopts_push -s extglob
-	if is-flagq '-g?(gdb)?([1-9])'; then
-		M=$(( 15 * ${M} / 10 ))
-	fi
-	eshopts_pop
-	M=$(( $(usex doc 256 0) + ${M} ))
-	CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
-}
-
-llvm_check_deps() {
-	has_version -r "llvm-core/llvm:${LLVM_SLOT}[${LLVM_TARGET_USEDEPS// /,}]"
-}
-
-# Is LLVM being linked against libc++?
-is_libcxx_linked() {
-	local code='#include <ciso646>
-#if defined(_LIBCPP_VERSION)
-	HAVE_LIBCXX
-#endif
-'
-	local out=$($(tc-getCXX) ${CXXFLAGS} ${CPPFLAGS} -x c++ -E -P - <<<"${code}") || return 1
-	[[ ${out} == *HAVE_LIBCXX* ]]
-}
-
-pkg_pretend() {
-	pre_build_checks
-}
-
-pkg_setup() {
-	pre_build_checks
-	python-any-r1_pkg_setup
-
-	export LIBGIT2_NO_PKG_CONFIG=1 #749381
-	if tc-is-cross-compiler; then
-		use system-llvm && die "USE=system-llvm not allowed when cross-compiling"
-		local cross_llvm_target="$(llvm_tuple_to_target "${CBUILD}")"
-		use "llvm_targets_${cross_llvm_target}" || \
-			die "Must enable LLVM_TARGETS=${cross_llvm_target} matching CBUILD=${CBUILD} when cross-compiling"
-	fi
-
-	rust_pkg_setup
-
-	if use system-llvm; then
-		llvm-r1_pkg_setup
-
-		local llvm_config="$(get_llvm_prefix)/bin/llvm-config"
-		export LLVM_LINK_SHARED=1
-		export RUSTFLAGS="${RUSTFLAGS} -Lnative=$("${llvm_config}" --libdir)"
-	fi
-}
-
-src_prepare() {
-	if [[ ${PV} = *9999* ]]; then
-		# We need to update / generate lockfiles for the workspace
-		${CARGO} generate-lockfile --offline
-
-	fi
-	# Rust baselines to Pentium4 on x86, this patch lowers the baseline to i586 when sse2 is not set.
-	if use x86; then
-		if ! use cpu_flags_x86_sse2; then
-			eapply "${FILESDIR}/1.82.0-i586-baseline.patch"
-			#grep -rl cmd.args.push\(\"-march=i686\" . | xargs sed  -i 's/march=i686/-march=i586/g' || die
-		fi
-	fi
-
-	if use lto && tc-is-clang && ! tc-ld-is-lld; then
-		export RUSTFLAGS+=" -C link-arg=-fuse-ld=lld"
-	fi
-
-	default
-}
-
-src_configure() {
-	if tc-is-cross-compiler; then
-		export PKG_CONFIG_ALLOW_CROSS=1
-		export PKG_CONFIG_PATH="${ESYSROOT}/usr/$(get_libdir)/pkgconfig"
-		export OPENSSL_INCLUDE_DIR="${ESYSROOT}/usr/include"
-		export OPENSSL_LIB_DIR="${ESYSROOT}/usr/$(get_libdir)"
-	fi
-
-	filter-lto # https://bugs.gentoo.org/862109 https://bugs.gentoo.org/866231
-
-	local rust_target="" rust_targets="" arch_cflags
-
-	# Collect rust target names to compile standard libs for all ABIs.
-	for v in $(multilib_get_enabled_abi_pairs); do
-		rust_targets+=",\"$(rust_abi $(get_abi_CHOST ${v##*.}))\""
-	done
-	if use wasm; then
-		rust_targets+=",\"wasm32-unknown-unknown\""
-		if use system-llvm; then
-			# un-hardcode rust-lld linker for this target
-			# https://bugs.gentoo.org/715348
-			sed -i '/linker:/ s/rust-lld/wasm-ld/' compiler/rustc_target/src/spec/base/wasm.rs || die
-		fi
-	fi
-	rust_targets="${rust_targets#,}"
-
-	# cargo and rustdoc are mandatory and should always be included
-	local tools='"cargo","rustdoc"'
-	use clippy && tools+=',"clippy"'
-	use rustfmt && tools+=',"rustfmt"'
-	use rust-analyzer && tools+=',"rust-analyzer","rust-analyzer-proc-macro-srv"'
-	use rust-src && tools+=',"src"'
-
-	if [[ ${PV} == *9999* ]]; then
-		use miri && tools+=',"miri"'
-	fi
-
-	local rust_stage0_root="$(${RUSTC} --print sysroot || die "Can't determine rust's sysroot")"
-	# in case of prefix it will be already prefixed, as --print sysroot returns full path
-	[[ -d ${rust_stage0_root} ]] || die "${rust_stage0_root} is not a directory"
-
-	rust_target="$(rust_abi)"
-	rust_build="$(rust_abi "${CBUILD}")"
-	rust_host="$(rust_abi "${CHOST}")"
-
-	RUST_EXPERIMENTAL_TARGETS=()
-	for _x in "${!ALL_RUST_EXPERIMENTAL_TARGETS[@]}"; do
-		if [[ ${ALL_RUST_EXPERIMENTAL_TARGETS[${_x}]} == 1 ]] && use ${_x} ; then
-			RUST_EXPERIMENTAL_TARGETS+=( ${_x#llvm_targets_} )
-		fi
-	done
-	RUST_EXPERIMENTAL_TARGETS=${RUST_EXPERIMENTAL_TARGETS[@]}
-
-	local cm_btype="$(usex debug DEBUG RELEASE)"
-	local build_channel
-	local build_miri="false"
-	case "${PV}" in
-		*9999*)
-			build_channel="nightly"
-			;;
-		*beta*)
-			build_channel="beta"
-			;;
-		*)
-			build_channel="stable"
-			;;
-	esac
-	cat <<- _EOF_ > "${S}"/config.toml
-		# https://github.com/rust-lang/rust/issues/135358 (bug #947897)
-		profile = "dist"
-		[llvm]
-		download-ci-llvm = false
-		optimize = $(toml_usex !debug)
-		release-debuginfo = $(toml_usex debug)
-		assertions = $(toml_usex debug)
-		ninja = true
-		targets = "${LLVM_TARGETS// /;}"
-		experimental-targets = "${RUST_EXPERIMENTAL_TARGETS// /;}"
-		link-shared = $(toml_usex system-llvm)
-		$(if is_libcxx_linked; then
-			# https://bugs.gentoo.org/732632
-			echo "use-libcxx = true"
-			echo "static-libstdcpp = false"
-		fi)
-		$(case "${rust_target}" in
-			i586-*-linux-*)
-				# https://github.com/rust-lang/rust/issues/93059
-				echo 'cflags = "-fcf-protection=none"'
-				echo 'cxxflags = "-fcf-protection=none"'
-				echo 'ldflags = "-fcf-protection=none"'
-				;;
-			*)
-				;;
-		esac)
-		enable-warnings = false
-		[llvm.build-config]
-		CMAKE_VERBOSE_MAKEFILE = "ON"
-		$(if ! tc-is-cross-compiler; then
-			# When cross-compiling, LLVM is compiled twice, once for host and
-			# once for target.  Unfortunately, this build configuration applies
-			# to both, which means any flags applicable to one target but not
-			# the other will break.  Conditionally disable respecting user
-			# flags when cross-compiling.
-			echo "CMAKE_C_FLAGS_${cm_btype} = \"${CFLAGS}\""
-			echo "CMAKE_CXX_FLAGS_${cm_btype} = \"${CXXFLAGS}\""
-			echo "CMAKE_EXE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
-			echo "CMAKE_MODULE_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
-			echo "CMAKE_SHARED_LINKER_FLAGS_${cm_btype} = \"${LDFLAGS}\""
-			echo "CMAKE_STATIC_LINKER_FLAGS_${cm_btype} = \"${ARFLAGS}\""
-		fi)
-		[build]
-		build-stage = 2
-		test-stage = 2
-		build = "${rust_build}"
-		host = ["${rust_host}"]
-		target = [${rust_targets}]
-		cargo = "${rust_stage0_root}/bin/cargo"
-		rustc = "${rust_stage0_root}/bin/rustc"
-		rustfmt = "${rust_stage0_root}/bin/rustfmt"
-		docs = $(toml_usex doc)
-		compiler-docs = false
-		submodules = false
-		python = "${EPYTHON}"
-		locked-deps = true
-		vendor = true
-		extended = true
-		tools = [${tools}]
-		verbose = 2
-		sanitizers = false
-		profiler = true
-		cargo-native-static = false
-		[install]
-		prefix = "${EPREFIX}/usr/lib/${PN}/${SLOT}"
-		sysconfdir = "etc"
-		docdir = "share/doc/rust"
-		bindir = "bin"
-		libdir = "lib"
-		mandir = "share/man"
-		[rust]
-		# https://github.com/rust-lang/rust/issues/54872
-		codegen-units-std = 1
-		optimize = true
-		debug = $(toml_usex debug)
-		debug-assertions = $(toml_usex debug)
-		debug-assertions-std = $(toml_usex debug)
-		debuginfo-level = $(usex debug 2 0)
-		debuginfo-level-rustc = $(usex debug 2 0)
-		debuginfo-level-std = $(usex debug 2 0)
-		debuginfo-level-tools = $(usex debug 2 0)
-		debuginfo-level-tests = 0
-		backtrace = true
-		incremental = false
-		$(if ! tc-is-cross-compiler; then
-			echo "default-linker = \"${CHOST}-cc\""
-		fi)
-		channel = "${build_channel}"
-		description = "gentoo"
-		rpath = true
-		verbose-tests = true
-		optimize-tests = $(toml_usex !debug)
-		codegen-tests = true
-		dist-src = false
-		remap-debuginfo = true
-		lld = $(usex system-llvm false $(toml_usex wasm))
-		$(if use lto && tc-is-clang ; then
-			echo "use-lld = true"
-		fi)
-		# only deny warnings if doc+wasm are NOT requested, documenting stage0 wasm std fails without it
-		# https://github.com/rust-lang/rust/issues/74976
-		# https://github.com/rust-lang/rust/issues/76526
-		deny-warnings = $(usex wasm $(usex doc false true) true)
-		backtrace-on-ice = true
-		jemalloc = false
-		# See https://github.com/rust-lang/rust/issues/121124
-		lto = "$(usex lto thin off)"
-		[dist]
-		src-tarball = false
-		compression-formats = ["xz"]
-		compression-profile = "balanced"
-	_EOF_
-
-	for v in $(multilib_get_enabled_abi_pairs); do
-		rust_target=$(rust_abi $(get_abi_CHOST ${v##*.}))
-		arch_cflags="$(get_abi_CFLAGS ${v##*.})"
-
-		export CFLAGS_${rust_target//-/_}="${arch_cflags}"
-
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.${rust_target}]
-			ar = "$(tc-getAR)"
-			cc = "$(tc-getCC)"
-			cxx = "$(tc-getCXX)"
-			linker = "$(tc-getCC)"
-			ranlib = "$(tc-getRANLIB)"
-			llvm-libunwind = "$(usex llvm-libunwind $(usex system-llvm system in-tree) no)"
-		_EOF_
-		if use system-llvm; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
-			_EOF_
-		fi
-		# by default librustc_target/spec/linux_musl_base.rs sets base.crt_static_default = true;
-		# but we patch it and set to false here as well
-		if use elibc_musl; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				crt-static = false
-				musl-root = "$($(tc-getCC) -print-sysroot)/usr"
-			_EOF_
-		fi
-	done
-	if use wasm; then
-		wasm_target="wasm32-unknown-unknown"
-		export CFLAGS_${wasm_target//-/_}="$(filter-flags '-mcpu*' '-march*' '-mtune*'; echo "$CFLAGS")"
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.wasm32-unknown-unknown]
-			linker = "$(usex system-llvm lld rust-lld)"
-			# wasm target does not have profiler_builtins https://bugs.gentoo.org/848483
-			profiler = false
-		_EOF_
-	fi
-
-	if [[ -n ${I_KNOW_WHAT_I_AM_DOING_CROSS} ]]; then # whitespace intentionally shifted below
-	# experimental cross support
-	# discussion: https://bugs.gentoo.org/679878
-	# TODO: c*flags, clang, system-llvm, cargo.eclass target support
-	# it would be much better if we could split out stdlib
-	# complilation to separate ebuild and abuse CATEGORY to
-	# just install to /usr/lib/rustlib/<target>
-
-	# extra targets defined as a bash array
-	# spec format:  <LLVM target>:<rust-target>:<CTARGET>
-	# best place would be /etc/portage/env/dev-lang/rust
-	# Example:
-	# RUST_CROSS_TARGETS=(
-	#	"AArch64:aarch64-unknown-linux-gnu:aarch64-unknown-linux-gnu"
-	# )
-	# no extra hand holding is done, no target transformations, all
-	# values are passed as-is with just basic checks, so it's up to user to supply correct values
-	# valid rust targets can be obtained with
-	# 	rustc --print target-list
-	# matching cross toolchain has to be installed
-	# matching LLVM_TARGET has to be enabled for both rust and llvm (if using system one)
-	# only gcc toolchains installed with crossdev are checked for now.
-
-	# BUG: we can't pass host flags to cross compiler, so just filter for now
-	# BUG: this should be more fine-grained.
-	filter-flags '-mcpu=*' '-march=*' '-mtune=*'
-
-	local cross_target_spec
-	for cross_target_spec in "${RUST_CROSS_TARGETS[@]}";do
-		# extracts first element form <LLVM target>:<rust-target>:<CTARGET>
-		local cross_llvm_target="${cross_target_spec%%:*}"
-		# extracts toolchain triples, <rust-target>:<CTARGET>
-		local cross_triples="${cross_target_spec#*:}"
-		# extracts first element after before : separator
-		local cross_rust_target="${cross_triples%%:*}"
-		# extracts last element after : separator
-		local cross_toolchain="${cross_triples##*:}"
-		use llvm_targets_${cross_llvm_target} || die "need llvm_targets_${cross_llvm_target} target enabled"
-		command -v ${cross_toolchain}-gcc > /dev/null 2>&1 || die "need ${cross_toolchain} cross toolchain"
-
-		cat <<- _EOF_ >> "${S}"/config.toml
-			[target.${cross_rust_target}]
-			ar = "${cross_toolchain}-ar"
-			cc = "${cross_toolchain}-gcc"
-			cxx = "${cross_toolchain}-g++"
-			linker = "${cross_toolchain}-gcc"
-			ranlib = "${cross_toolchain}-ranlib"
-		_EOF_
-		if use system-llvm; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				llvm-config = "$(get_llvm_prefix)/bin/llvm-config"
-			_EOF_
-		fi
-		if [[ "${cross_toolchain}" == *-musl* ]]; then
-			cat <<- _EOF_ >> "${S}"/config.toml
-				musl-root = "$(${cross_toolchain}-gcc -print-sysroot)/usr"
-			_EOF_
-		fi
-
-		# append cross target to "normal" target list
-		# example 'target = ["powerpc64le-unknown-linux-gnu"]'
-		# becomes 'target = ["powerpc64le-unknown-linux-gnu","aarch64-unknown-linux-gnu"]'
-
-		rust_targets="${rust_targets},\"${cross_rust_target}\""
-		sed -i "/^target = \[/ s#\[.*\]#\[${rust_targets}\]#" config.toml || die
-
-		ewarn
-		ewarn "Enabled ${cross_rust_target} rust target"
-		ewarn "Using ${cross_toolchain} cross toolchain"
-		ewarn
-		if ! has_version -b 'sys-devel/binutils[multitarget]' ; then
-			ewarn "'sys-devel/binutils[multitarget]' is not installed"
-			ewarn "'strip' will be unable to strip cross libraries"
-			ewarn "cross targets will be installed with full debug information"
-			ewarn "enable 'multitarget' USE flag for binutils to be able to strip object files"
-			ewarn
-			ewarn "Alternatively llvm-strip can be used, it supports stripping any target"
-			ewarn "define STRIP=\"llvm-strip\" to use it (experimental)"
-			ewarn
-		fi
-	done
-	fi # I_KNOW_WHAT_I_AM_DOING_CROSS
-
-	einfo "Rust configured with the following flags:"
-	echo
-	echo RUSTFLAGS="\"${RUSTFLAGS}\""
-	echo RUSTFLAGS_BOOTSTRAP="\"${RUSTFLAGS_BOOTSTRAP}\""
-	echo RUSTFLAGS_NOT_BOOTSTRAP="\"${RUSTFLAGS_NOT_BOOTSTRAP}\""
-	echo MAGIC_EXTRA_RUSTFLAGS="\"${MAGIC_EXTRA_RUSTFLAGS}\""
-	env | grep "CARGO_TARGET_.*_RUSTFLAGS="
-	env | grep "CFLAGS_.*"
-	echo
-	einfo "config.toml contents:"
-	cat "${S}"/config.toml || die
-	echo
-}
-
-src_compile() {
-	RUST_BACKTRACE=1 "${EPYTHON}" ./x.py build -vvv --config="${S}"/config.toml -j$(makeopts_jobs) || die
-}
-
-src_test() {
-	# https://rustc-dev-guide.rust-lang.org/tests/intro.html
-
-	# those are basic and codegen tests.
-	local tests=(
-		codegen
-		codegen-units
-		compile-fail
-		incremental
-		mir-opt
-		pretty
-		run-make
-	)
-
-	# fails if llvm is not built with ALL targets.
-	# and known to fail with system llvm sometimes.
-	use system-llvm || tests+=( assembly )
-
-	# fragile/expensive/less important tests
-	# or tests that require extra builds
-	# TODO: instead of skipping, just make some nonfatal.
-	if [[ ${ERUST_RUN_EXTRA_TESTS:-no} != no ]]; then
-		tests+=(
-			rustdoc
-			rustdoc-js
-			rustdoc-js-std
-			rustdoc-ui
-			run-make-fulldeps
-			ui
-			ui-fulldeps
-		)
-	fi
-
-	local i failed=()
-	einfo "rust_src_test: enabled tests ${tests[@]/#/src/test/}"
-	for i in "${tests[@]}"; do
-		local t="src/test/${i}"
-		einfo "rust_src_test: running ${t}"
-		if ! RUST_BACKTRACE=1 "${EPYTHON}" ./x.py test -vv --config="${S}"/config.toml \
-				-j$(makeopts_jobs) --no-doc --no-fail-fast "${t}"
-		then
-				failed+=( "${t}" )
-				eerror "rust_src_test: ${t} failed"
-		fi
-	done
-
-	if [[ ${#failed[@]} -ne 0 ]]; then
-		eerror "rust_src_test: failure summary: ${failed[@]}"
-		die "aborting due to test failures"
-	fi
-}
-
-src_install() {
-	DESTDIR="${D}" "${EPYTHON}" ./x.py install -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
-
-	docompress /usr/lib/${PN}/${SLOT}/share/man/
-
-	# bug #689562, #689160
-	rm -v "${ED}/usr/lib/${PN}/${SLOT}/etc/bash_completion.d/cargo" || die
-	rmdir -v "${ED}/usr/lib/${PN}/${SLOT}"/etc{/bash_completion.d,} || die
-
-	local symlinks=(
-		cargo
-		rustc
-		rustdoc
-		rust-gdb
-		rust-gdbgui
-		rust-lldb
-	)
-
-	use clippy && symlinks+=( clippy-driver cargo-clippy )
-	if [[ ${PV} = *9999* ]]; then
-		use miri && symlinks+=( miri cargo-miri )
-	fi
-	use rustfmt && symlinks+=( rustfmt cargo-fmt )
-	use rust-analyzer && symlinks+=( rust-analyzer )
-
-	einfo "installing eselect-rust symlinks and paths: ${symlinks[@]}"
-	local i
-	for i in "${symlinks[@]}"; do
-		# we need realpath on /usr/bin/* symlink return version-appended binary path.
-		# so /usr/bin/rustc should point to /usr/lib/rust/<ver>/bin/rustc-<ver>
-		# need to fix eselect-rust to remove this hack.
-		local ver_i="${i}-${PV%%_*}"
-		if [[ -f "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" ]]; then
-			einfo "Installing ${i} symlink"
-			ln -v "${ED}/usr/lib/${PN}/${SLOT}/bin/${i}" "${ED}/usr/lib/${PN}/${SLOT}/bin/${ver_i}" || die
-		else
-			ewarn "${i} symlink requested, but source file not found"
-			ewarn "please report this"
-		fi
-		dosym "../lib/${PN}/${SLOT}/bin/${ver_i}" "/usr/bin/${ver_i}"
-	done
-
-	# symlinks to switch components to active rust in eselect
-	dosym "${SLOT}/lib" "/usr/lib/${PN}/lib-${SLOT}"
-	use rust-analyzer && dosym "${SLOT}/libexec" "/usr/lib/${PN}/libexec-${SLOT}"
-	dosym "${SLOT}/share/man" "/usr/lib/${PN}/man-${SLOT}"
-	dosym "rust/${SLOT}/lib/rustlib" "/usr/lib/rustlib-${SLOT}"
-	dosym "../../lib/${PN}/${SLOT}/share/doc/rust" "/usr/share/doc/${P}"
-
-	newenvd - "50${P}" <<-_EOF_
-		MANPATH="${EPREFIX}/usr/lib/rust/man-${SLOT}"
-	_EOF_
-
-	rm -rf "${ED}/usr/lib/${PN}/${SLOT}"/*.old || die
-	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/bin"/*.old || die
-	rm -rf "${ED}/usr/lib/${PN}/${SLOT}/doc"/*.old || die
-
-	# note: eselect-rust adds EROOT to all paths below
-	cat <<-_EOF_ > "${T}/provider-${PN}-${SLOT}"
-		/usr/bin/cargo
-		/usr/bin/rustdoc
-		/usr/bin/rust-gdb
-		/usr/bin/rust-gdbgui
-		/usr/bin/rust-lldb
-		/usr/lib/rustlib
-		/usr/lib/rust/lib
-		/usr/lib/rust/man
-		/usr/share/doc/rust
-	_EOF_
-
-	if use clippy; then
-		echo /usr/bin/clippy-driver >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-clippy >> "${T}/provider-${P}"
-	fi
-	if [[ ${SLOT} == *9999* ]] && use miri; then
-		echo /usr/bin/miri >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-miri >> "${T}/provider-${P}"
-	fi
-	if use rustfmt; then
-		echo /usr/bin/rustfmt >> "${T}/provider-${P}"
-		echo /usr/bin/cargo-fmt >> "${T}/provider-${P}"
-	fi
-	if use rust-analyzer; then
-		echo /usr/lib/rust/libexec >> "${T}/provider-${P}"
-		echo /usr/bin/rust-analyzer >> "${T}/provider-${P}"
-	fi
-
-	insinto /etc/env.d/rust
-	doins "${T}/provider-${PN}-${SLOT}"
-
-	if use dist; then
-		"${EPYTHON}" ./x.py dist -vv --config="${S}"/config.toml -j$(makeopts_jobs) || die
-		insinto "/usr/lib/${PN}/${SLOT}/dist"
-		doins -r "${S}/build/dist/."
-	fi
-}
-
-pkg_postinst() {
-
-	eselect rust update
-
-	if has_version dev-debug/gdb || has_version llvm-core/lldb; then
-		elog "Rust installs helper scripts for calling GDB and LLDB,"
-		elog "for convenience they are installed under /usr/bin/rust-{gdb,lldb}-${PV}."
-	fi
-
-	if has_version app-editors/emacs; then
-		optfeature "emacs support for rust" app-emacs/rust-mode
-	fi
-
-	if has_version app-editors/gvim || has_version app-editors/vim; then
-		optfeature "vim support for rust" app-vim/rust-vim
-	fi
-}
-
-pkg_postrm() {
-	eselect rust cleanup
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
index cce0be6be3..7f1f164c48 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -9,7 +9,6 @@ SASLAUTHD_CONF_VER="2.1.26"
 MY_PATCH_VER="${PN}-2.1.28-r4-patches"
 DESCRIPTION="The Cyrus SASL (Simple Authentication and Security Layer)"
 HOMEPAGE="https://www.cyrusimap.org/sasl/"
-#SRC_URI="ftp://ftp.cyrusimap.org/cyrus-sasl/${P}.tar.gz"
 SRC_URI="https://github.com/cyrusimap/${PN}/releases/download/${P}/${P}.tar.gz"
 SRC_URI+=" https://dev.gentoo.org/~grobian/distfiles/${MY_PATCH_VER}.tar.xz"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r5.ebuild
index eb081cb5f0..042bcc6fc4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/cyrus-sasl/cyrus-sasl-2.1.28-r5.ebuild
@@ -9,7 +9,6 @@ SASLAUTHD_CONF_VER="2.1.26"
 MY_PATCH_VER="${PN}-2.1.28-r4-patches"
 DESCRIPTION="The Cyrus SASL (Simple Authentication and Security Layer)"
 HOMEPAGE="https://www.cyrusimap.org/sasl/"
-#SRC_URI="ftp://ftp.cyrusimap.org/cyrus-sasl/${P}.tar.gz"
 SRC_URI="https://github.com/cyrusimap/${PN}/releases/download/${P}/${P}.tar.gz"
 SRC_URI+=" https://dev.gentoo.org/~grobian/distfiles/${MY_PATCH_VER}.tar.xz"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
index a1f1486ca7..d3bd2aab46 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
@@ -2,5 +2,6 @@ DIST glib-2.78.6.tar.xz 5344808 BLAKE2B d16173794c4aa019459cf8c8c84d4107fb839382
 DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a8cfda8b8770dd391861999ff3381008f4fe382e90f0a7798fe218debda7f559f6e3ac8f9305e3be98b879969 SHA512 c9cc9f99e217fd950810fcfbfa7300c7850cae4dbfbabc03cdcadb6dcca2e51ea7979ceb68c09d8e9776fd1c04db73b89b81f748c8bd911e1f7ad9f704dff172
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
+DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
 DIST gobject-introspection-1.80.1.tar.xz 1040228 BLAKE2B 7a8c1da9bc8aef293deedde1eed97536fa2f42f79a9761ac8ededb0676e46b636545a69e20e63d812844aeb626fa4fb7ce3c7922e51554fdc79560f16443acd9 SHA512 f45c2c1b105086488d974c6134db9910746df8edb187772f2ecd249656a1047c8ac88ba51f5bf7393c3d99c3ace143ecd09be256c2f4d0ceee110c9ad51a839a
 DIST gobject-introspection-1.82.0.tar.xz 1052872 BLAKE2B 8336ae26d48a71a203655d9d268076f603055ceabb55dbfa676f2c67b4096b83afc106d485dc45d02b3a8be806f9ef50d54806a82e61f2a252ae59543c61e934 SHA512 e139fadb4174c72b648914f3774d89fc0e5eaee45bba0c13edf05de883664dad8276dbc34006217bb09871ed4bad23adab51ff232a17b9eb131329b2926cafb7
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/files/glib-2.84.1-gclosure-vs-threads.patch b/sdk_container/src/third_party/portage-stable/dev-libs/glib/files/glib-2.84.1-gclosure-vs-threads.patch
new file mode 100644
index 0000000000..dbd83e6a47
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/files/glib-2.84.1-gclosure-vs-threads.patch
@@ -0,0 +1,57 @@
+https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4575
+
+From d6798089d447977ef4416d124a83344241aab14b Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Thu, 3 Apr 2025 19:03:27 +0100
+Subject: [PATCH] gclosure: fix ATOMIC_CHANGE_FIELD to read vint atomically
+
+Depending on luck, g_closure_ref may access closure->vint and observe
+different values between reads. This manifests as a test failure in
+signals-refcount{2,4}, properties-refcount1, and closure-refcount depending
+on timing and re-runs.
+
+Jakub Jelinek analysed this on GCC bug PR119607 after I'd reported it
+over there as a possible GCC regression.
+
+The critical part being g_closure_ref -> ATOMIC_INC_ASSIGN -> ATOMIC_CHANGE_FIELD
+where closure->vint gets re-read repeatedly, both outside and inside the retry
+loop. To fix that:
+
+1. Atomically fetch it the first time;
+2. Use the cached read, not a fresh read, of vint in the loop;
+3. Use g_atomic_int_compare_and_exchange_full in the loop so we get a freshly
+cached vint if it changed in another thread.
+
+Bug: https://gcc.gnu.org/PR119607
+Fixes: 834ddd19 ('turned all modifications to the first 32 integer bits in a closure into')
+Co-authored-by: Jakub Jelinek <jakub@redhat.com>
+---
+ gobject/gclosure.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/gobject/gclosure.c b/gobject/gclosure.c
+index 2552946e3b..e6e9769e46 100644
+--- a/gobject/gclosure.c
++++ b/gobject/gclosure.c
+@@ -110,15 +110,17 @@ typedef union {
+ G_STMT_START {                                                                          \
+   ClosureInt *cunion = (ClosureInt*) _closure;                 		                \
+   gint new_int, old_int, success;                              		                \
++  old_int = g_atomic_int_get (&cunion->vint);                   	                \
+   do                                                    		                \
+     {                                                   		                \
+       ClosureInt tmp;                                   		                \
+-      tmp.vint = old_int = cunion->vint;                		                \
++      tmp.vint = old_int;                               		                \
+       _SET_OLD tmp.closure._field;                                                      \
+       tmp.closure._field _OP _value;                      		                \
+       _SET_NEW tmp.closure._field;                                                      \
+       new_int = tmp.vint;                               		                \
+-      success = g_atomic_int_compare_and_exchange (&cunion->vint, old_int, new_int);    \
++      success = g_atomic_int_compare_and_exchange_full (&cunion->vint, old_int, new_int,\
++							&old_int);			\
+     }                                                   		                \
+   while (!success && _must_set);                                                        \
+ } G_STMT_END
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
new file mode 100644
index 0000000000..e5e5ff280c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.84.1.ebuild
@@ -0,0 +1,448 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_REQ_USE="xml(+)"
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit eapi9-ver gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
+
+DESCRIPTION="The GLib library of C routines"
+HOMEPAGE="https://www.gtk.org/"
+
+INTROSPECTION_PN="gobject-introspection"
+INTROSPECTION_PV="1.82.0"
+INTROSPECTION_P="${INTROSPECTION_PN}-${INTROSPECTION_PV}"
+SRC_URI="
+	${SRC_URI}
+	introspection? ( mirror://gnome/sources/gobject-introspection/${INTROSPECTION_PV%.*}/gobject-introspection-${INTROSPECTION_PV}.tar.${GNOME_TARBALL_SUFFIX} )
+"
+INTROSPECTION_SOURCE_DIR="${WORKDIR}/${INTROSPECTION_P}"
+INTROSPECTION_BUILD_DIR="${WORKDIR}/${INTROSPECTION_P}-build"
+
+LICENSE="LGPL-2.1+"
+SLOT="2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="dbus debug +elf doc +introspection +mime selinux static-libs sysprof systemtap test utils xattr"
+RESTRICT="!test? ( test )"
+
+# * elfutils (via libelf) does not build on Windows. gresources are not embedded
+# within ELF binaries on that platform anyway and inspecting ELF binaries from
+# other platforms is not that useful so exclude the dependency in this case.
+# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
+# these are used by GIO, which glib[static-libs] consumers don't really seem
+# to need at all, thus not imposing the deps for now and once some consumers
+# are actually found to static link libgio-2.0.a, we can revisit and either add
+# them or just put the (build) deps in that rare consumer instead of recursive
+# RDEPEND here (due to lack of recursive DEPEND).
+RDEPEND="
+	!<dev-libs/gobject-introspection-1.80.1
+	!<dev-util/gdbus-codegen-${PV}
+	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/libpcre2-10.32:0=[${MULTILIB_USEDEP},unicode(+),static-libs?]
+	>=dev-libs/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
+	introspection? (
+		>=dev-libs/gobject-introspection-common-${INTROSPECTION_PV}
+	)
+	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
+	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
+	xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
+	elf? ( virtual/libelf:0= )
+	sysprof? ( >=dev-util/sysprof-capture-3.40.1:4[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+# libxml2 used for optional tests that get automatically skipped
+BDEPEND="
+	app-text/docbook-xsl-stylesheets
+	>=dev-build/meson-1.4.0
+	dev-libs/libxslt
+	>=sys-devel/gettext-0.19.8
+	doc? ( >=dev-util/gi-docgen-2023.1 )
+	dev-python/docutils
+	systemtap? ( >=dev-debug/systemtap-1.3 )
+	${PYTHON_DEPS}
+	test? ( >=sys-apps/dbus-1.2.14 )
+	virtual/pkgconfig
+
+	introspection? (
+		$(python_gen_any_dep '
+			dev-python/setuptools[${PYTHON_USEDEP}]
+		')
+		virtual/pkgconfig
+		sys-devel/bison
+		app-alternatives/lex
+		${PYTHON_DEPS}
+	)
+"
+# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
+
+PDEPEND="
+	dbus? ( gnome-base/dconf )
+	mime? ( x11-misc/shared-mime-info )
+"
+# shared-mime-info needed for gio/xdgmime, bug #409481
+# dconf is needed to be able to save settings, bug #498436
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/gio-querymodules$(get_exeext)
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.64.1-mark-gdbus-server-auth-test-flaky.patch
+	"${FILESDIR}"/${PN}-2.84.1-gclosure-vs-threads.patch
+)
+
+python_check_deps() {
+	if use introspection ; then
+		python_has_version "dev-python/setuptools[${PYTHON_USEDEP}]"
+	fi
+}
+
+pkg_setup() {
+	if use kernel_linux ; then
+		CONFIG_CHECK="~INOTIFY_USER"
+		if use test ; then
+			CONFIG_CHECK="~IPV6"
+			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
+		fi
+		linux-info_pkg_setup
+	fi
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use test; then
+		# TODO: Review the test exclusions, especially now with meson
+		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
+		if ! has_version dev-util/desktop-file-utils ; then
+			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
+			ewarn "think on installing it to get these tests run."
+			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
+			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
+		fi
+
+		# gdesktopappinfo requires existing terminal (gnome-terminal or any
+		# other), falling back to xterm if one doesn't exist
+		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
+		#	ewarn "Some tests will be skipped due to missing terminal program"
+		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
+		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready
+		# for backport (or in a bump) and file new issue if still fails
+		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
+		# desktop-app-info/launch* might fail similarly
+		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
+		#fi
+
+		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
+		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
+		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
+
+		ewarn "Tests for search-utils have been skipped"
+		sed -i -e "/search-utils/d" glib/tests/meson.build || die
+
+		# Running gdb inside a test within sandbox is brittle
+		sed -i -e '/self.__gdb = shutil.which("gdb")/s:"gdb":"gdb-idonotexist":' glib/tests/assert-msg-test.py || die
+
+		# Play nice with network-sandbox, but this approach would defeat the purpose of the test
+		#sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
+	else
+		# Don't build tests, also prevents extra deps, bug #512022
+		sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
+	fi
+
+	# Don't build fuzzing binaries - not used
+	sed -i -e '/subdir.*fuzzing/d' meson.build || die
+
+	# gdbus-codegen is a separate package
+	sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
+	sed -i -e '/install : true/d' gio/gdbus-2.0/codegen/meson.build || die
+
+	# Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
+	sed -i -e '/install_dir/d' gio/tests/meson.build || die
+
+	cat > "${T}/glib-test-ld-wrapper" <<-EOF
+		#!/usr/bin/env sh
+		exec \${LD:-ld} "\$@"
+	EOF
+	chmod a+x "${T}/glib-test-ld-wrapper" || die
+	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
+
+	# make default sane for us
+	if use prefix ; then
+		sed -i -e "s:/usr/local:${EPREFIX}/usr:" gio/xdgmime/xdgmime.c || die
+		# bug #308609, without path, bug #314057
+		export PERL=perl
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# fix standards conflicts
+		sed -i \
+			-e 's/\<\(_XOPEN_SOURCE_EXTENDED\)\>/_POSIX_PTHREAD_SEMANTICS/' \
+			-e '/\<_XOPEN_SOURCE\>/s/\<2\>/600/' \
+			meson.build || die
+		sed -i -e '/#define\s\+_POSIX_SOURCE/d' \
+			glib/giounix.c || die
+	fi
+
+	# disable native macOS integrations
+	sed -i -e '/glib_conf.set(.HAVE_\(CARBON\|COCOA\).,/s/true/false/' \
+		meson.build || die
+	sed -i \
+		-e '/AvailabilityMacros.h/d' \
+		gio/giomodule.c || die
+
+	# Link the glib source to the introspection subproject directory so it can be built there first
+	if use introspection ; then
+		ln -s "${S}" "${INTROSPECTION_SOURCE_DIR}/subprojects/glib"
+	fi
+
+	default
+	gnome2_environment_reset
+	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
+}
+
+multilib_src_configure() {
+	# TODO: figure a way to pass appropriate values for all cross properties
+	# that glib uses (search for get_cross_property)
+	#if tc-is-cross-compiler ; then
+		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
+		# TODO-meson: This should be in meson cross file as 'growing_stack'
+		# property; and more, look at get_cross_property
+		#case ${CHOST} in
+		#hppa*|metag*) export glib_cv_stack_grows=yes ;;
+		#*)            export glib_cv_stack_grows=no ;;
+		#esac
+	#fi
+
+	# Build internal copy of gobject-introspection to avoid circular dependency (built for native abi only)
+	if multilib_native_use introspection && ! has_version ">=dev-libs/${INTROSPECTION_P}" ; then
+		einfo "Bootstrapping gobject-introspection..."
+		INTROSPECTION_BIN_DIR="${T}/bootstrap-gi-prefix/usr/bin"
+		INTROSPECTION_LIB_DIR="${T}/bootstrap-gi-prefix/usr/$(get_libdir)"
+
+		local emesonargs=(
+			--prefix="${T}/bootstrap-gi-prefix/usr"
+			-Dpython="${EPYTHON}"
+			-Dbuild_introspection_data=true
+			# Build an internal copy of glib for the internal copy of gobject-introspection
+			--force-fallback-for=glib
+			# Make the paths in pkgconfig files relative as we used to not
+			# do a proper install here and it seems less risky to keep it
+			# this way.
+			-Dpkgconfig.relocatable=true
+
+			# We want as minimal a build as possible here to speed things up
+			# and reduce the risk of failures.
+			-Dglib:selinux=disabled
+			-Dglib:xattr=false
+			-Dglib:libmount=disabled
+			-Dglib:man-pages=disabled
+			-Dglib:dtrace=disabled
+			-Dglib:systemtap=disabled
+			-Dglib:sysprof=disabled
+			-Dglib:documentation=false
+			-Dglib:tests=false
+			-Dglib:installed_tests=false
+			-Dglib:nls=disabled
+			-Dglib:oss_fuzz=disabled
+			-Dglib:libelf=disabled
+			-Dglib:multiarch=false
+		)
+
+		ORIG_SOURCE_DIR=${EMESON_SOURCE}
+		EMESON_SOURCE=${INTROSPECTION_SOURCE_DIR}
+
+		# g-ir-scanner has some relocatable logic but it searches
+		# for 'lib', not 'lib64', so it can't find itself and eventually
+		# falls back to the system installation. See bug #946221.
+		sed -i -e "/^pylibdir =/s:'lib:'$(get_libdir):" "${EMESON_SOURCE}"/tools/g-ir-tool-template.in || die
+
+		ORIG_BUILD_DIR=${BUILD_DIR}
+		BUILD_DIR=${INTROSPECTION_BUILD_DIR}
+
+		pushd ${INTROSPECTION_SOURCE_DIR} || die
+
+		meson_src_configure
+		meson_src_compile
+		# We already provide a prefix in ${T} above. Blank DESTDIR
+		# as it may be set in the environment by Portage (though not
+		# guaranteed in src_configure).
+		meson_src_install --destdir ""
+
+		popd || die
+
+		EMESON_SOURCE=${ORIG_SOURCE_DIR}
+		BUILD_DIR=${ORIG_BUILD_DIR}
+
+		# Add gobject-introspection binaries and pkgconfig files to path
+		export PATH="${INTROSPECTION_BIN_DIR}:${PATH}"
+
+		# Override primary pkgconfig search paths to prioritize our internal copy
+		export PKG_CONFIG_LIBDIR="${INTROSPECTION_LIB_DIR}/pkgconfig:${INTROSPECTION_BUILD_DIR}/meson-private"
+
+		# Set the normal primary pkgconfig search paths as secondary
+		# (We also need to prepend our just-built one for later use of
+		# g-ir-scanner to use the new one and to help workaround bugs like
+		# bug #946221.)
+		export PKG_CONFIG_PATH="${PKG_CONFIG_LIBDIR}:$(pkg-config --variable pc_path pkg-config)"
+
+		# Add the paths to the built glib libraries to the library path so that gobject-introspection can load them
+		for gliblib in glib gobject gthread gmodule gio girepository; do
+			export LD_LIBRARY_PATH="${BUILD_DIR}/${gliblib}:${LD_LIBRARY_PATH}"
+		done
+
+		# Add the path to introspection libraries so that glib can call gir utilities
+		export LD_LIBRARY_PATH="${INTROSPECTION_LIB_DIR}:${LD_LIBRARY_PATH}"
+
+		# Add the paths to the gobject-introspection python modules to python path so they can be imported
+		export PYTHONPATH="${INTROSPECTION_LIB_DIR}/gobject-introspection:${PYTHONPATH}"
+	fi
+
+	# TODO: Can this be cleaned up now we have -Dglib_debug? (bug #946485)
+	use debug && EMESON_BUILD_TYPE=debug
+
+	local emesonargs=(
+		-Ddefault_library=$(usex static-libs both shared)
+		-Druntime_dir="${EPREFIX}"/run
+		$(meson_feature debug glib_debug)
+		$(meson_feature selinux)
+		$(meson_use xattr)
+		-Dlibmount=enabled # only used if host_system == 'linux'
+		-Dman-pages=enabled
+		$(meson_feature systemtap dtrace)
+		$(meson_feature systemtap)
+		$(meson_feature sysprof)
+		$(meson_use doc documentation)
+		$(meson_use test tests)
+		-Dinstalled_tests=false
+		-Dnls=enabled
+		-Doss_fuzz=disabled
+		$(meson_native_use_feature elf libelf)
+		-Dmultiarch=false
+		$(meson_native_use_feature introspection)
+	)
+
+	# Workaround for bug #938302
+	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
+		local native_file="${T}"/meson.${CHOST}.ini.local
+		cat >> ${native_file} <<-EOF || die
+		[binaries]
+		dtrace='stap-dtrace'
+		EOF
+		emesonargs+=( --native-file "${native_file}" )
+	fi
+
+	meson_src_configure
+}
+
+multilib_src_test() {
+	export XDG_CONFIG_DIRS=/etc/xdg
+	export XDG_DATA_DIRS=/usr/local/share:/usr/share
+	# TODO: Use ${ABI} here to be unique for multilib?
+	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
+	export LC_TIME=C # bug #411967
+	export TZ=UTC
+	unset GSETTINGS_BACKEND # bug #596380
+	python_setup
+
+	# https://bugs.gentoo.org/839807
+	local -x SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict /usr/b
+
+	# Related test is a bit nitpicking
+	mkdir -p "$G_DBUS_COOKIE_SHA1_KEYRING_DIR" || die
+	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR" || die
+
+	meson_src_test --timeout-multiplier 20 --no-suite flaky
+}
+
+multilib_src_install() {
+	meson_src_install
+	keepdir /usr/$(get_libdir)/gio/modules
+}
+
+multilib_src_install_all() {
+	# These are installed by dev-util/glib-utils
+	# TODO: With patching we might be able to get rid of the python-any deps
+	# and removals, and test depend on glib-utils instead; revisit now with
+	# meson
+	rm "${ED}/usr/bin/glib-genmarshal" || die
+	rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
+	rm "${ED}/usr/bin/glib-mkenums" || die
+	rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
+	rm "${ED}/usr/bin/gtester-report" || die
+	rm "${ED}/usr/share/man/man1/gtester-report.1" || die
+	# gdbus-codegen manpage installed by dev-util/gdbus-codegen
+	rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
+}
+
+pkg_preinst() {
+	xdg_pkg_preinst
+
+	# Make gschemas.compiled belong to glib alone
+	local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
+
+	if [[ -e ${EROOT}${cache} ]]; then
+		cp "${EROOT}"${cache} "${ED}"/${cache} || die
+	else
+		touch "${ED}"${cache} || die
+	fi
+
+	multilib_pkg_preinst() {
+		# Make giomodule.cache belong to glib alone
+		local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
+
+		if [[ -e ${EROOT}${cache} ]]; then
+			cp "${EROOT}"${cache} "${ED}"${cache} || die
+		else
+			touch "${ED}"${cache} || die
+		fi
+	}
+
+	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
+	# file due to inability to create it and GIO might not look at any of the modules there
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_preinst
+	fi
+}
+
+pkg_postinst() {
+	xdg_pkg_postinst
+	# glib installs no schemas itself, but we force update for fresh install in case
+	# something has dropped in a schemas file without direct glib dep; and for upgrades
+	# in case the compiled schema format could have changed
+	gnome2_schemas_update
+
+	multilib_pkg_postinst() {
+		gnome2_giomodule_cache_update \
+			|| die "Update GIO modules cache failed (for ${ABI})"
+	}
+	if ! tc-is-cross-compiler ; then
+		multilib_foreach_abi multilib_pkg_postinst
+	else
+		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
+		ewarn "You might want to run gio-querymodules manually on the target for"
+		ewarn "your final image for performance reasons and re-run it when packages"
+		ewarn "installing GIO modules get upgraded or added to the image."
+	fi
+
+	if ver_replacing "-lt" "2.63.6"; then
+		ewarn "glib no longer installs the gio-launch-desktop binary. You may need"
+		ewarn "to restart your session for \"Open With\" dialogs to work."
+	fi
+}
+
+pkg_postrm() {
+	xdg_pkg_postrm
+	gnome2_schemas_update
+
+	if [[ -z ${REPLACED_BY_VERSION} ]]; then
+		multilib_pkg_postrm() {
+			rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache || die
+		}
+		multilib_foreach_abi multilib_pkg_postrm
+		rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/inih/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/inih/Manifest
index 52b0f107e1..6d494f135b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/inih/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/inih/Manifest
@@ -1,2 +1,3 @@
 DIST inih-57.tar.gz 18954 BLAKE2B df2e2a14b4186616071f6ad2a64e0423148fb9a4624a74d4b16845a4a12eb72b1965f1314b92a710b80cc68d85dbe4ef09d6db159b76be856a4041f21a8c520c SHA512 9f758df876df54ed7e228fd82044f184eefbe47e806cd1e6d62e1b0ea28e2c08e67fa743042d73b4baef0b882480e6afe2e72878b175822eb2bdbb6d89c0e411
 DIST inih-58.tar.gz 19964 BLAKE2B ba71b21b30c039df026adbd29b422b064934046ced21a37479421e866b73969826dc1fea4e3bc0c5ea427248c774d8f80b83056c54769d454bafa2f336d08024 SHA512 d69f488299c1896e87ddd3dd20cd9db5848da7afa4c6159b8a99ba9a5d33f35cadfdb9f65d6f2fe31decdbadb8b43bf610ff2699df475e1f9ff045e343ac26ae
+DIST inih-59.tar.gz 20513 BLAKE2B 6162749ae4f162972041abad6f18dd85a65a70a6672ab90bb41d13ae049a58548a7b9031960a934cab697edf884aac8bb35131c373aa952efe7647eaccb29f80 SHA512 cd5ee8796c1be1ff7f589069ec90fee6fc4464ae7b2f0b39600ab08cf01cda9e4c006aa1cba0ee3c78df0111de5da23fa314816bfd327e34211a0dfcfa1d993b
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
new file mode 100644
index 0000000000..f5614b08d6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/inih/inih-59.ebuild
@@ -0,0 +1,27 @@
+# Copyright 2020-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit meson-multilib
+
+DESCRIPTION="inih (INI not invented here) simple .INI file parser"
+HOMEPAGE="https://github.com/benhoyt/inih"
+SRC_URI="https://github.com/benhoyt/inih/archive/r${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}"/inih-r${PV}
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+DOCS=( README.md )
+
+src_configure() {
+	local emesonargs=(
+		-Ddefault_library=shared
+		-Ddistro_install=true
+		-Dwith_INIReader=true
+	)
+
+	meson-multilib_src_configure
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
index b5e24ed5bf..90f9651fa1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/Manifest
@@ -1,2 +1 @@
-DIST libtool-2.4.7.tar.xz 1016040 BLAKE2B 5e022586337637dd634bd40578ad944bec6e3b8de41f95d55777b90cc88cbc4badb3d76cbf0e638166ece1ea7de828e83590e1e6bac30c1e4b1c254a11a742f2 SHA512 47f4c6de40927254ff9ba452612c0702aea6f4edc7e797f0966c8c6bf0340d533598976cdba17f0bdc64545572e71cd319bbb587aa5f47cd2e7c1d96f873a3da
 DIST libtool-2.5.4.tar.xz 1056924 BLAKE2B 47de3c49a690d44d7ddd5e3b5e4090c91dc5fbb9c40fc4a3963e150fb7329326ee3e21b8c149974726171c4b0380028e0efc7a369c4f04357eea46f69852e1cc SHA512 eed207094bcc444f4bfbb13710e395e062e3f1d312ca8b186ab0cbd22dc92ddef176a0b3ecd43e02676e37bd9e328791c59a38ef15846d4eae15da4f20315724
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.4.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.4.7-r1.ebuild
deleted file mode 100644
index f780731c28..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libltdl/libltdl-2.4.7-r1.ebuild
+++ /dev/null
@@ -1,40 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-
-# Please bump with dev-build/libtool.
-
-inherit multilib-minimal flag-o-matic
-
-MY_P="libtool-${PV}"
-
-DESCRIPTION="A shared library tool for developers"
-HOMEPAGE="https://www.gnu.org/software/libtool/"
-SRC_URI="mirror://gnu/libtool/${MY_P}.tar.xz"
-S="${WORKDIR}"/${MY_P}/libltdl
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="static-libs"
-# libltdl doesn't have a testsuite.  Don't bother trying.
-RESTRICT="test"
-
-BDEPEND="app-arch/xz-utils"
-
-multilib_src_configure() {
-	append-lfs-flags
-	ECONF_SOURCE="${S}" \
-	econf \
-		--enable-ltdl-install \
-		$(use_enable static-libs static)
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	# While the libltdl.la file is not used directly, the m4 ltdl logic
-	# keys off of its existence when searching for ltdl support. # bug #293921
-	#use static-libs || find "${D}" -name libltdl.la -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/Manifest
index 7f7a526e44..3275bd5760 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/Manifest
@@ -16,3 +16,4 @@ DIST protobuf-28.0.tar.gz 9259114 BLAKE2B 328e09ebffb296d838557ea72a4fc4da8e0ad5
 DIST protobuf-28.3.tar.gz 9256608 BLAKE2B 05162124676abe18300481e9f985fd2cfb09b052d06670a993e79ef02f3daf0d5380b521977ebc2362d4094486151ea285fe1c98a1d2f3799b18a1fa422fdc13 SHA512 a91e175fed7eb01c4240842a5af73a7d3cefccbb10885434bceeb7bc89ab6c56a74912cee290bf46e81d4026f3c9c2b10faad5545816064e215c4bae7908263d
 DIST protobuf-29.2.tar.gz 9348408 BLAKE2B 847798474bc6a76b9badfdbf605e118dece5e321e81242d7fa1bf5f5d17ee05a3d365ec112dc6d861cade97efff8be1d5d04006a5144f613bdb3ff5eacc63b99 SHA512 aeb21773edc3dd92a6c1ba6ccd721cc8a20d61230a5309c75ee3ef19baa554c228a6d1095f191ccc18f10183b646f3140dfe6526f5812bcaa64b7d5260572643
 DIST protobuf-29.4.tar.gz 9350942 BLAKE2B fd3b81905e26db2ec3b54eaf30cf250db2894f91d5da73130106f6778f4e2f13b690961eecb8f5b8c23ac72428753611cd9bf719da986083e09ab32160e25314 SHA512 c888cb9961d58b7fb11a3363ff4d2684605cdd79756712f407ffe5f275569bf69b4370f1d2a0e20775646745cddd41a9b510f1c1981be4e969c9acf0dc2ba734
+DIST protobuf-30.2.tar.gz 9506934 BLAKE2B 3a7d6bfa38500b16b1ce52b244fd9448fe7be2933a77224a1423a67e3ae3155846c0974ee1b6c579f6050f60b7784ace21b149b3cbdff2ef1e6bf954acbb1b51 SHA512 555d1b18d175eeaf17f3879f124d33080f490367840d35b34bfc4e4a5b383bf6a1d09f1570acb6af9c53ac4940a14572d46423b6e3dd0c712e7802c986fb6be6
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/files/protobuf-30.0-findJsonCpp.patch b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/files/protobuf-30.0-findJsonCpp.patch
new file mode 100644
index 0000000000..9848a61013
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/files/protobuf-30.0-findJsonCpp.patch
@@ -0,0 +1,44 @@
+From 2fe6cac5797bead74c473c795fdc5f9d50703894 Mon Sep 17 00:00:00 2001
+From: Paul Zander <negril.nx+gentoo@gmail.com>
+Date: Thu, 6 Mar 2025 13:19:01 +0100
+Subject: [PATCH] fix JsonCPP name
+
+Signed-off-by: Paul Zander <negril.nx+gentoo@gmail.com>
+
+diff --git a/cmake/conformance.cmake b/cmake/conformance.cmake
+index 7377841..dba05aa 100644
+--- a/cmake/conformance.cmake
++++ b/cmake/conformance.cmake
+@@ -1,9 +1,9 @@
+ # Don't run jsoncpp tests.
+ set(JSONCPP_WITH_TESTS OFF)
+ 
+-if (NOT TARGET jsoncpp_lib)
++if (NOT TARGET JsonCpp::JsonCpp)
+   if (NOT protobuf_FORCE_FETCH_DEPENDENCIES)
+-    find_package(jsoncpp)
++    find_package(JsonCpp)
+   endif()
+ 
+   # Fallback to fetching Googletest from github if it's not found locally.
+@@ -21,7 +21,7 @@ if (NOT TARGET jsoncpp_lib)
+   endif()
+ endif()
+ 
+-if (NOT TARGET jsoncpp_lib)
++if (NOT TARGET JsonCpp::JsonCpp)
+   message(FATAL_ERROR
+           "Cannot find jsoncpp dependency that's needed to build conformance tests.\n"
+           "If instead you want to skip these tests, run cmake with:\n"
+@@ -151,7 +151,7 @@ add_test(NAME conformance_cpp_test
+ set(JSONCPP_WITH_TESTS OFF CACHE BOOL "Disable tests")
+ 
+ if(BUILD_SHARED_LIBS)
+-  target_link_libraries(conformance_test_runner jsoncpp_lib)
++  target_link_libraries(conformance_test_runner JsonCpp::JsonCpp)
+ else()
+   target_link_libraries(conformance_test_runner jsoncpp_static)
+ endif()
+-- 
+2.48.1
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-21.12.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-21.12.ebuild
index 3672570cf1..7c343d581c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-21.12.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-21.12.ebuild
@@ -1,9 +1,9 @@
-# Copyright 2008-2023 Gentoo Authors
+# Copyright 2008-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit cmake-multilib elisp-common toolchain-funcs
+inherit cmake-multilib elisp-common
 
 if [[ "${PV}" == *9999 ]]; then
 	inherit git-r3
@@ -40,15 +40,6 @@ PATCHES=(
 
 DOCS=( CONTRIBUTORS.txt README.md )
 
-src_configure() {
-	if tc-ld-is-gold; then
-		# https://sourceware.org/bugzilla/show_bug.cgi?id=24527
-		tc-ld-disable-gold
-	fi
-
-	cmake-multilib_src_configure
-}
-
 multilib_src_configure() {
 	local mycmakeargs=(
 		-Dprotobuf_DISABLE_RTTI=ON
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.3.ebuild
index d878a5ea4e..cf1d9198d9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.3.ebuild
@@ -1,9 +1,9 @@
-# Copyright 2008-2024 Gentoo Authors
+# Copyright 2008-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-inherit cmake-multilib elisp-common toolchain-funcs
+inherit cmake-multilib elisp-common
 
 ABSEIL_BRANCH="lts_2023_08_02" # NOTE from https://github.com/protocolbuffers/protobuf/blob/main/.gitmodules
 
@@ -54,15 +54,6 @@ PATCHES=(
 
 DOCS=( CONTRIBUTORS.txt README.md )
 
-src_configure() {
-	if tc-ld-is-gold; then
-		# https://sourceware.org/bugzilla/show_bug.cgi?id=24527
-		tc-ld-disable-gold
-	fi
-
-	cmake-multilib_src_configure
-}
-
 multilib_src_configure() {
 	local mycmakeargs=(
 		-Dprotobuf_DISABLE_RTTI="yes" # TODO why?
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.5.ebuild
index 6a9820f1a0..e947731a59 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.5.ebuild
@@ -14,29 +14,27 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
-IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
+IUSE="conformance debug emacs examples +libprotoc +protobuf +protoc test zlib"
 
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
@@ -81,7 +79,6 @@ multilib_src_configure() {
 
 		-Dprotobuf_BUILD_CONFORMANCE="$(usex test "$(usex conformance)")"
 		-Dprotobuf_BUILD_LIBPROTOC="$(usex libprotoc)"
-		-Dprotobuf_BUILD_LIBUPB="$(usex libupb)"
 		-Dprotobuf_BUILD_PROTOBUF_BINARIES="$(usex protobuf)"
 		-Dprotobuf_BUILD_PROTOC_BINARIES="$(usex protoc)"
 		-Dprotobuf_BUILD_SHARED_LIBS="yes"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
index 6a9820f1a0..e947731a59 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-25.6.ebuild
@@ -14,29 +14,27 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
-IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
+IUSE="conformance debug emacs examples +libprotoc +protobuf +protoc test zlib"
 
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
@@ -81,7 +79,6 @@ multilib_src_configure() {
 
 		-Dprotobuf_BUILD_CONFORMANCE="$(usex test "$(usex conformance)")"
 		-Dprotobuf_BUILD_LIBPROTOC="$(usex libprotoc)"
-		-Dprotobuf_BUILD_LIBUPB="$(usex libupb)"
 		-Dprotobuf_BUILD_PROTOBUF_BINARIES="$(usex protobuf)"
 		-Dprotobuf_BUILD_PROTOC_BINARIES="$(usex protoc)"
 		-Dprotobuf_BUILD_SHARED_LIBS="yes"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.0.ebuild
index 08a9d6fd46..2621d4f7ba 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.0.ebuild
@@ -14,29 +14,28 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
 	KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
 IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
 
+# Require protobuf for the time being
 REQUIRED_USE="
-	|| (
-		libprotoc
-		libupb
-		protobuf
-		protoc
-	)
+	protobuf
+	protobuf? ( protoc )
+	examples? ( protobuf )
+	libprotoc? ( protobuf )
+	libupb? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
index ed7af80707..e53658010c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-28.3-r1.ebuild
@@ -14,29 +14,28 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
 IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
 
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
+	libupb? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.2.ebuild
index 90c31cdfe7..d1c1fc5e95 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.2.ebuild
@@ -14,29 +14,28 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
 IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
 
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
+	libupb? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
index 90c31cdfe7..8ce1e903d9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-29.4.ebuild
@@ -14,29 +14,28 @@ ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
 	EGIT_SUBMODULES=( '-*' )
-	MY_SLOT="28.0"
+	SLOT="0/9999"
 
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
-	MY_SLOT=$(ver_cut 1-2)
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+	SLOT="0/$(ver_cut 1-2).0"
 fi
 
 DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
 HOMEPAGE="https://protobuf.dev/"
 
 LICENSE="BSD"
-SLOT="0/${MY_SLOT}.0"
 IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
 
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
+	libupb? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
new file mode 100644
index 0000000000..b100f58a75
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-30.2.ebuild
@@ -0,0 +1,172 @@
+# Copyright 2008-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake-multilib elisp-common multilib
+
+# NOTE from https://github.com/protocolbuffers/protobuf/blob/main/cmake/dependencies.cmake
+ABSEIL_MIN_VER="20250127.0"
+
+if [[ "${PV}" == *9999 ]]; then
+	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
+	EGIT_SUBMODULES=( '-*' )
+	SLOT="0/9999"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+	SLOT="0/$(ver_cut 1-2).0"
+fi
+
+DESCRIPTION="Google's Protocol Buffers - Extensible mechanism for serializing structured data"
+HOMEPAGE="https://protobuf.dev/"
+
+LICENSE="BSD"
+IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test zlib"
+
+# Require protobuf for the time being
+REQUIRED_USE="
+	protobuf
+	protobuf? ( protoc )
+	examples? ( protobuf )
+	libprotoc? ( protobuf )
+	libupb? ( protobuf )
+"
+
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	emacs? ( app-editors/emacs:* )
+"
+
+COMMON_DEPEND="
+	>=dev-cpp/abseil-cpp-${ABSEIL_MIN_VER}:=[${MULTILIB_USEDEP}]
+	zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="
+	${COMMON_DEPEND}
+	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
+	test? ( dev-cpp/gtest[${MULTILIB_USEDEP}] )
+"
+RDEPEND="
+	${COMMON_DEPEND}
+	${BDEPEND}
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-23.3-static_assert-failure.patch"
+	"${FILESDIR}/${PN}-28.0-disable-test_upb-lto.patch"
+	"${FILESDIR}/${PN}-30.0-findJsonCpp.patch"
+)
+
+DOCS=( CONTRIBUTORS.txt README.md )
+
+src_prepare() {
+	cmake_src_prepare
+
+	cp "${FILESDIR}/FindJsonCpp.cmake" "${S}/cmake" || die
+}
+
+multilib_src_configure() {
+	local mycmakeargs=(
+		-Dprotobuf_BUILD_CONFORMANCE="$(usex test "$(usex conformance)")"
+		-Dprotobuf_BUILD_LIBPROTOC="$(usex libprotoc)"
+		-Dprotobuf_BUILD_LIBUPB="$(usex libupb)"
+		-Dprotobuf_BUILD_PROTOBUF_BINARIES="$(usex protobuf)"
+		-Dprotobuf_BUILD_PROTOC_BINARIES="$(usex protoc)"
+		-Dprotobuf_BUILD_SHARED_LIBS="yes"
+		-Dprotobuf_BUILD_TESTS="$(usex test)"
+
+		-Dprotobuf_DISABLE_RTTI="no"
+
+		-Dprotobuf_INSTALL="yes"
+		-Dprotobuf_TEST_XML_OUTDIR="$(usex test)"
+
+		-Dprotobuf_WITH_ZLIB="$(usex zlib)"
+		-Dprotobuf_VERBOSE="$(usex debug)"
+		-DCMAKE_MODULE_PATH="${S}/cmake"
+
+		-Dprotobuf_LOCAL_DEPENDENCIES_ONLY="yes"
+		# -Dprotobuf_FORCE_FETCH_DEPENDENCIES="no"
+	)
+	if use protobuf ; then
+		if use examples ; then
+			mycmakeargs+=(
+				-Dprotobuf_BUILD_EXAMPLES="$(usex examples)"
+				-Dprotobuf_INSTALL_EXAMPLES="$(usex examples)"
+			)
+		fi
+	fi
+
+	cmake_src_configure
+}
+
+src_compile() {
+	cmake-multilib_src_compile
+
+	if use emacs; then
+		elisp-compile editors/protobuf-mode.el
+	fi
+}
+
+src_test() {
+	local -x srcdir="${S}/src"
+
+	# we override here to inject env vars
+	multilib_src_test() {
+		local -x TEST_TMPDIR="${T%/}/TEST_TMPDIR_${ABI}"
+		mkdir -p -m 770 "${TEST_TMPDIR}" || die
+
+		ln -srf "${S}/src" "${BUILD_DIR}/include" || die
+
+		cmake_src_test "${_cmake_args[@]}"
+	}
+
+	# Do headstands for LTO # 942985
+	local -x GTEST_FILTER
+	GTEST_FILTER="-FileDescriptorSetSource/EncodeDecodeTest*:LazilyBuildDependenciesTest.GeneratedFile:PythonGeneratorTest/PythonGeneratorTest.PythonWithCppFeatures/*"
+
+	cmake-multilib_src_test
+
+	GTEST_FILTER="${GTEST_FILTER//-/}"
+
+	cmake-multilib_src_test
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	if [[ ! -f "${ED}/usr/$(get_libdir)/libprotobuf$(get_libname "${SLOT#*/}")" ]]; then
+		eerror "No matching library found with SLOT variable, currently set: ${SLOT}\n" \
+			"Expected value: ${ED}/usr/$(get_libdir)/libprotobuf$(get_libname "${SLOT#*/}")"
+		die "Please update SLOT variable"
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins editors/proto.vim
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/proto.vim"
+
+	if use emacs; then
+		elisp-install "${PN}" editors/protobuf-mode.el*
+		elisp-site-file-install "${FILESDIR}/70${PN}-gentoo.el"
+	fi
+
+	if use examples; then
+		DOCS+=(examples)
+		docompress -x "/usr/share/doc/${PF}/examples"
+	fi
+
+	einstalldocs
+}
+
+pkg_postinst() {
+	use emacs && elisp-site-regen
+}
+
+pkg_postrm() {
+	use emacs && elisp-site-regen
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
index 42712e4699..b100f58a75 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/protobuf/protobuf-9999.ebuild
@@ -5,11 +5,8 @@ EAPI=8
 
 inherit cmake-multilib elisp-common multilib
 
-# NOTE from https://github.com/protocolbuffers/protobuf/blob/main/.gitmodules
-ABSEIL_BRANCH="lts_2023_08_02"
-
-ABSEIL_MIN_VER="${ABSEIL_BRANCH//lts_}"
-ABSEIL_MIN_VER="${ABSEIL_MIN_VER//_/}"
+# NOTE from https://github.com/protocolbuffers/protobuf/blob/main/cmake/dependencies.cmake
+ABSEIL_MIN_VER="20250127.0"
 
 if [[ "${PV}" == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/protocolbuffers/protobuf.git"
@@ -19,7 +16,7 @@ if [[ "${PV}" == *9999 ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/protocolbuffers/protobuf/releases/download/v${PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
 	SLOT="0/$(ver_cut 1-2).0"
 fi
 
@@ -32,10 +29,10 @@ IUSE="conformance debug emacs examples +libprotoc libupb +protobuf +protoc test
 # Require protobuf for the time being
 REQUIRED_USE="
 	protobuf
-	examples? ( protobuf protoc )
+	protobuf? ( protoc )
+	examples? ( protobuf )
 	libprotoc? ( protobuf )
-	libupb? (	protobuf )
-	protoc? ( protobuf )
+	libupb? ( protobuf )
 "
 
 RESTRICT="!test? ( test )"
@@ -52,7 +49,7 @@ COMMON_DEPEND="
 DEPEND="
 	${COMMON_DEPEND}
 	conformance? ( dev-libs/jsoncpp[${MULTILIB_USEDEP}] )
-	test? ( >=dev-cpp/gtest-1.11[${MULTILIB_USEDEP}] )
+	test? ( dev-cpp/gtest[${MULTILIB_USEDEP}] )
 "
 RDEPEND="
 	${COMMON_DEPEND}
@@ -61,8 +58,8 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}/${PN}-23.3-static_assert-failure.patch"
-	"${FILESDIR}/${PN}-27.4-findJsonCpp.patch"
 	"${FILESDIR}/${PN}-28.0-disable-test_upb-lto.patch"
+	"${FILESDIR}/${PN}-30.0-findJsonCpp.patch"
 )
 
 DOCS=( CONTRIBUTORS.txt README.md )
@@ -75,9 +72,6 @@ src_prepare() {
 
 multilib_src_configure() {
 	local mycmakeargs=(
-		-Dprotobuf_ABSL_PROVIDER="package"
-		-Dprotobuf_JSONCPP_PROVIDER="package"
-
 		-Dprotobuf_BUILD_CONFORMANCE="$(usex test "$(usex conformance)")"
 		-Dprotobuf_BUILD_LIBPROTOC="$(usex libprotoc)"
 		-Dprotobuf_BUILD_LIBUPB="$(usex libupb)"
@@ -94,6 +88,9 @@ multilib_src_configure() {
 		-Dprotobuf_WITH_ZLIB="$(usex zlib)"
 		-Dprotobuf_VERBOSE="$(usex debug)"
 		-DCMAKE_MODULE_PATH="${S}/cmake"
+
+		-Dprotobuf_LOCAL_DEPENDENCIES_ONLY="yes"
+		# -Dprotobuf_FORCE_FETCH_DEPENDENCIES="no"
 	)
 	if use protobuf ; then
 		if use examples ; then
@@ -104,8 +101,6 @@ multilib_src_configure() {
 		fi
 	fi
 
-	use test && mycmakeargs+=( -Dprotobuf_USE_EXTERNAL_GTEST="yes" )
-
 	cmake_src_configure
 }
 
@@ -120,18 +115,19 @@ src_compile() {
 src_test() {
 	local -x srcdir="${S}/src"
 
-	local -x TEST_TMPDIR="${T%/}/TEST_TMPDIR_${ABI}"
-	mkdir -m 777 "${TEST_TMPDIR}" || die
+	# we override here to inject env vars
+	multilib_src_test() {
+		local -x TEST_TMPDIR="${T%/}/TEST_TMPDIR_${ABI}"
+		mkdir -p -m 770 "${TEST_TMPDIR}" || die
 
-	setup_test_env() {
-		ln -sr "${S}/src" "${BUILD_DIR}/include" || die
+		ln -srf "${S}/src" "${BUILD_DIR}/include" || die
+
+		cmake_src_test "${_cmake_args[@]}"
 	}
 
-	multilib_foreach_abi setup_test_env
-
 	# Do headstands for LTO # 942985
 	local -x GTEST_FILTER
-	GTEST_FILTER="-FileDescriptorSetSource/EncodeDecodeTest*"
+	GTEST_FILTER="-FileDescriptorSetSource/EncodeDecodeTest*:LazilyBuildDependenciesTest.GeneratedFile:PythonGeneratorTest/PythonGeneratorTest.PythonWithCppFeatures/*"
 
 	cmake-multilib_src_test
 
@@ -143,9 +139,9 @@ src_test() {
 multilib_src_install_all() {
 	find "${ED}" -name "*.la" -delete || die
 
-	if [[ ! -f "${ED}/usr/$(get_libdir)/libprotobuf$(get_libname ${SLOT#*/})" ]]; then
+	if [[ ! -f "${ED}/usr/$(get_libdir)/libprotobuf$(get_libname "${SLOT#*/}")" ]]; then
 		eerror "No matching library found with SLOT variable, currently set: ${SLOT}\n" \
-			"Expected value: ${ED}/usr/$(get_libdir)/libprotobuf$(get_libname ${SLOT#*/})"
+			"Expected value: ${ED}/usr/$(get_libdir)/libprotobuf$(get_libname "${SLOT#*/}")"
 		die "Please update SLOT variable"
 	fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
index a572f678c4..ba11525c42 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest
@@ -1,2 +1,4 @@
 DIST cython-3.0.11.gh.tar.gz 2775463 BLAKE2B f5f53c328a1b48b04548f1ee7be3988451d2a8e339b785285e2d973e63b37dabc6021f32ba1691ae8dbe9ee7706a5feda399b071b4893a3be4fe4afcd608f46b SHA512 8f7982af5be1db1072b1090257a9d487dc341d79522f442f4608303d18b388349a7d586ec74e66fbffd0ce88c00ca622202729907fe7cefef71828cfd3f68fe6
 DIST cython-3.0.12.gh.tar.gz 2777066 BLAKE2B 3e2730b7b0ef90ba6a7d4a510dbaa24b7c966d68c397196727b6d63b435c6775aa818a7d1b741819a7940ad44cadbc83be4aa48117b2dcf7bd844f4c9bc268bc SHA512 bbf2cc662b846cf5ff9b686046ec210ea9d3893482e2b5a2696d2ad44f12facd15075b168a3eb6d1f4ea799786f676868eab2593451bceb2937aec2cb1aea99e
+DIST cython-3.0.12.tar.gz 2757617 BLAKE2B 064549e36e03424065eab081b60e2761d198490cfd4d7836ea236b833ada3962e6ed42ba1710b33418f8a31ac282cdc156ceb544ee21be80ee34b7a3d3f6c7fb SHA512 c4e85596eeea444fae983d32ce8731cc5d0d612d1f96b998db3aa7946e8be151a7ea62c6df163d875111e306c870656b82a8468dd873cacf84c7bd5671a39bc3
+DIST cython-3.1.0b1.tar.gz 3192916 BLAKE2B 13a8fa48319d9c4c8cc634d3cf5af599b867466d5de4cf3a24dd342b7812a392e854d9a6152309c6ef84a2925ebfa2257792d0f4e0c8fa36580d7138a663105a SHA512 ced9d57536d3bacd274b5edc4137d400a6182b4b7a89a28cf358f843dcbb0e0e7171fb0842441a81e1d2ac12acb6fd6a3df7018fe2a8708cb188a96cb184d799
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
new file mode 100644
index 0000000000..8f2aa670ba
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.12-r1.ebuild
@@ -0,0 +1,78 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{10..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 pypy3_11 python3_13 )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			<dev-python/numpy-2[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-test_exceptions-py310.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	# https://github.com/cython/cython/issues/1911
+	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_beta1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_beta1.ebuild
new file mode 100644
index 0000000000..69a8f0805b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.1.0_beta1.ebuild
@@ -0,0 +1,76 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{10..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 pypy3_11 python3_13 )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing pypi toolchain-funcs
+
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			<dev-python/numpy-2[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja2 \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	# https://github.com/cython/cython/issues/1911
+	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index c80b3785c8..45a41f2110 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,2 +1 @@
-DIST docutils-0.20.1.tar.gz 2058365 BLAKE2B 73fb8302599ffe57b0840c898b0b2e3ccd39ff9ea6eec2b5d345d02c950e1a8357bd821e62733b0484e82bc30e71d30fab381390b0edaef4375b02bcd9eeeb40 SHA512 a0ddca315d03677003036d6a8052ac96fbd3fcc4508564938ea684d79bedb4d322d83449c7b26e55b19b0aadd6e46ca9ac409bb16279a20f06c70e9c15ef5eb0
 DIST docutils-0.21.2.tar.gz 2204444 BLAKE2B 727c2f97fc5835a0ffa62e38ea85af366cd89ad1eaec0b8af8b1f3b12e6cddfddb65161ba34f9109952d37ba2cf8985f3c3b6905ebb2ac1c9a984cce3fb4d170 SHA512 7fafa331f5687448e80d299c20cdccc4b49819fa471b5f586bf0ab18c694ba43a70f58e7c76b0a70a16267585548389214e11a4998ad7fdc19a27f0f7644539c
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1-r1.ebuild
deleted file mode 100644
index 8bee50d450..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1-r1.ebuild
+++ /dev/null
@@ -1,79 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 optfeature pypi
-
-DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
-HOMEPAGE="
-	https://docutils.sourceforge.io/
-	https://pypi.org/project/docutils/
-"
-
-# GPL-3+ only for emacs/rst.el
-LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	dev-python/pygments[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	${RDEPEND}
-"
-
-python_compile_all() {
-	# Generate html docs from reStructured text sources.
-
-	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
-	cp docutils/writers/html4css1/html4css1.css . || die
-
-	cd tools || die
-	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
-		--stylesheet-path=../html4css1.css, --traceback ../docs || die
-}
-
-src_test() {
-	cd test || die
-	distutils-r1_src_test
-}
-
-python_test() {
-	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
-}
-
-python_install() {
-	distutils-r1_python_install
-
-	# Install tools.
-	python_doscript tools/buildhtml.py
-}
-
-install_txt_doc() {
-	local doc="${1}"
-	local dir="txt/$(dirname ${doc})"
-	docinto "${dir}"
-	dodoc "${doc}"
-}
-
-python_install_all() {
-	local DOCS=( *.txt )
-	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
-
-	distutils-r1_python_install_all
-
-	local doc
-	while IFS= read -r -d '' doc; do
-		install_txt_doc "${doc}"
-	done < <(find docs tools -name '*.txt' -print0)
-}
-
-pkg_postinst() {
-	optfeature \
-		"auto-detecting the image dimensions when using the 'scale' option" \
-		dev-python/pillow
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
index 9f75406894..56e0885170 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/Manifest
@@ -1,2 +1 @@
-DIST gpep517-16.gh.tar.gz 23951 BLAKE2B 9be3bf7845f85b756444e5699509cf12455ea71204fb0e9a4899000cd2802cc063cd785f490d6e3d9ac48bf79a9e43a0edcfb483d898f718be6d783a98834cdd SHA512 fcd7cb0f98003a8ecb9976cffe3d4140b16e537dbfcfa8e8416569cd7e38e8e9ab359b35c1e22b830dc2711b3c07f8e3113c0f6b73d415ce63ad5f7d76f180c6
 DIST gpep517-17.gh.tar.gz 24403 BLAKE2B 51273a2e5ea0154d3e7d974f31b31a96dfa087d8bb3a49d89960568b02632fe104e62a4217a2295ef3dcc69f86f875c4e9de1220f3ef15fbff59a44bebcaac33 SHA512 cadf5b2fbd8c00eba928c3d8c893711516f66acc9bf74fc4ad9f0261021f8f6b7c4853035e6b916deba215ecf2f1e567d82161a74b69313b7e0f296e83e75c84
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-16.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-16.ebuild
deleted file mode 100644
index 94694d45c6..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-16.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2022-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=no
-PYTHON_COMPAT=( pypy3 pypy3_11 python3_{10..13} python3_13t )
-
-inherit distutils-r1
-
-DESCRIPTION="A backend script to aid installing Python packages in Gentoo"
-HOMEPAGE="
-	https://pypi.org/project/gpep517/
-	https://github.com/projg2/gpep517/
-"
-SRC_URI="
-	https://github.com/projg2/gpep517/archive/v${PV}.tar.gz
-		-> ${P}.gh.tar.gz
-"
-
-LICENSE="GPL-2+"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-1.2.3[${PYTHON_USEDEP}]
-	' 3.10)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -o tmp_path_retention_policy=all
-}
-
-python_install() {
-	python_domodule gpep517
-	python_newscript - gpep517 <<-EOF
-		#!${EPREFIX}/usr/bin/python
-		import sys
-		from gpep517.__main__ import main
-		sys.exit(main())
-	EOF
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild
index e225bae086..94694d45c6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gpep517/gpep517-17.ebuild
@@ -21,7 +21,7 @@ SRC_URI="
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	>=dev-python/installer-0.5.0[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
index 70121184a0..61747f1bb3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest
@@ -1 +1,2 @@
 DIST lxml-5.3.1.gh.tar.gz 951340 BLAKE2B e73cc8513cfe42d163b8475788472f00f2f3492deb7536b6556ed4f14924ffe57497947e660a161ec5a0821135b3d103799c0da0b9c647ccdcbfa9b0c5d6a1d9 SHA512 e89ada765791b67e4e83a9151c500f2e8d924c05d421a46bece1183666fc566d545d2e6b62987075e82cbafb8cd4b1f48f6f94e9ebcc0bbd7227d687b2282794
+DIST lxml-5.3.2.gh.tar.gz 951502 BLAKE2B d9a9bc49ecbc2d9dba2539c0fa884afc62fbb7a8d6b02571c1ee387386f473472e7cea66e776d758ab1f9307c77f938761ef1be58b029edb2c3b9546aa5f8561 SHA512 d128f7d6dd2a08286f8478508cb2693c7749c5f3822acfcd10877b92bec24e82c3da624b3a1872f95f72d310247083c84f76a42eadfc910b8180749d85b32d8b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.2.ebuild
new file mode 100644
index 0000000000..6a33fc0b24
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.3.2.ebuild
@@ -0,0 +1,121 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+
+inherit distutils-r1 optfeature toolchain-funcs
+
+DESCRIPTION="A Pythonic binding for the libxml2 and libxslt libraries"
+HOMEPAGE="
+	https://lxml.de/
+	https://pypi.org/project/lxml/
+	https://github.com/lxml/lxml/
+"
+SRC_URI="
+	https://github.com/lxml/lxml/archive/${P}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+S=${WORKDIR}/lxml-${P}
+
+LICENSE="BSD ElementTree GPL-2 PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="doc examples +threads test"
+RESTRICT="!test? ( test )"
+
+# Note: lib{xml2,xslt} are used as C libraries, not Python modules.
+DEPEND="
+	>=dev-libs/libxml2-2.10.3
+	>=dev-libs/libxslt-1.1.38
+"
+RDEPEND="
+	${DEPEND}
+"
+# cython: they are using __pyx_empty_tuple directly
+BDEPEND="
+	virtual/pkgconfig
+	<dev-python/cython-3.1[${PYTHON_USEDEP}]
+	>=dev-python/cython-3.0.10[${PYTHON_USEDEP}]
+	doc? (
+		$(python_gen_any_dep '
+			dev-python/docutils[${PYTHON_USEDEP}]
+			dev-python/pygments[${PYTHON_USEDEP}]
+			dev-python/sphinx[${PYTHON_USEDEP}]
+			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+		')
+	)
+	test? (
+		dev-python/cssselect[${PYTHON_USEDEP}]
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-5.3.0-pypy.patch"
+)
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version -b "dev-python/docutils[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/pygments[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/sphinx[${PYTHON_USEDEP}]" &&
+	python_has_version -b "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
+}
+
+python_prepare_all() {
+	# don't use some random SDK on Darwin
+	sed -i -e '/_ldflags =/s/=.*isysroot.*darwin.*None/= None/' \
+		setupinfo.py || die
+
+	distutils-r1_python_prepare_all
+}
+
+python_compile() {
+	local DISTUTILS_ARGS=(
+		# by default it adds -w to CFLAGS
+		--warnings
+	)
+	tc-export PKG_CONFIG
+	distutils-r1_python_compile
+}
+
+python_compile_all() {
+	use doc && emake html
+}
+
+python_test() {
+	local dir=${BUILD_DIR}/test$(python_get_sitedir)/lxml
+	local -x PATH=${BUILD_DIR}/test/usr/bin:${PATH}
+
+	cp -al "${BUILD_DIR}"/{install,test} || die
+	cp -al src/lxml/tests "${dir}/" || die
+	cp -al src/lxml/html/tests "${dir}/html/" || die
+	mkdir "${dir}"/../../doc || die
+	# this one needs to be copied, because upstream uses doc/../../../doc
+	cp -r "${S}"/doc "${dir}"/../../ || die
+	ln -s "${S}"/doc "${dir}"/../../../../ || die
+
+	"${EPYTHON}" test.py --no-src -vv --all-levels -p ||
+		die "Tests fail on ${EPYTHON}"
+}
+
+python_install_all() {
+	if use doc; then
+		local DOCS=( README.rst *.txt doc/*.txt )
+		local HTML_DOCS=( doc/html/. )
+	fi
+	if use examples; then
+		dodoc -r samples
+	fi
+
+	distutils-r1_python_install_all
+}
+
+pkg_postinst() {
+	optfeature "Support for BeautifulSoup as a parser backend" dev-python/beautifulsoup4
+	optfeature "Translates CSS selectors to XPath 1.0 expressions" dev-python/cssselect
+	optfeature "Support for lxml.html.clean sanitizer" dev-python/lxml-html-clean
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
index cf74834f59..f6b090d7eb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/Manifest
@@ -1,3 +1,4 @@
 DIST pillow-11.1.0.gh.tar.gz 46815201 BLAKE2B 7990683c90359e0a72e17a13e1a29455bc3ace8ce3616d6af59360edfc1ac87541bd1fd6967160bd8d7dd25cfedfc9d2e9b058c3ed433a6208379834f15bc312 SHA512 bb0622fae0b9c3903ddd945dced8e2b94348b2bd06c14bc74da00d8aa3a795aab2daaff39ca6c40b712dcce4f10218cd30739f0eb616c9dfbc16efcf80886f1e
+DIST pillow-11.2.0.gh.tar.gz 47097571 BLAKE2B d59e87e7249e7a2b64dd420702d08f6da1d29d91fd32d7043eacac7c5cf33e4cef6d378545454bcb460ea1ae49052e2e684335966e00f6003e018e9241ad50eb SHA512 4ab01472accb056ef48feab6c945a3792b622053c1dc166daf0095597a2df846562ae5ee56e66e595d65e76e7b7bfaf3d5b0cf7847777603a1abdc7af135ec44
 DIST pillow-test-images-716bdc4adaf97601e5b9a31c9be25f8975381ee1.gh.tar.gz 57416881 BLAKE2B 8ea5fff2231567f957fc911120c1b50610722477da99559639317e4513e4bc4e73b8b49368a6d95c6938333f0c48db7672c3713eaef70494f7896dadd07cc42d SHA512 b00009be0f5ca85ec0c761fa780f0e650c1877b456b9a9426a4d2300a0c5654358495299e129ded411fccb641e4add7e460bcb3ca7be055f3b207407ccefb33c
 DIST pythoncapi_compat.h 61109 BLAKE2B 9b8d9f774a6803dee73aedc5465519f2956c284bf70314f5e046d0d5522a10891bf55358a85fea5a156d4063736424c0f019bc71dd18592bbf56c364db7b6bce SHA512 d0ca43186fdc3cd8d0e993135b50fc86eeea05e8b84cba529d89f60ce28bc9502f8d3825eb508be5d68d1fbfc53423a69756c0e79fe0fe7adf94c602b1cf79ff
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.0.ebuild
new file mode 100644
index 0000000000..2ccb1f4c5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pillow/pillow-11.2.0.ebuild
@@ -0,0 +1,166 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+# setuptools wrapper
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+PYTHON_REQ_USE='tk?,threads(+)'
+
+inherit distutils-r1 toolchain-funcs virtualx
+
+MY_PN=Pillow
+MY_P=${MY_PN}-${PV}
+
+# upstream always fetches from main
+TEST_IMAGE_COMMIT="716bdc4adaf97601e5b9a31c9be25f8975381ee1"
+
+DESCRIPTION="Python Imaging Library (fork)"
+HOMEPAGE="
+	https://python-pillow.org/
+	https://github.com/python-pillow/Pillow/
+	https://pypi.org/project/pillow/
+"
+SRC_URI="
+	https://github.com/python-pillow/Pillow/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+	test? (
+		https://github.com/python-pillow/test-images/archive/${TEST_IMAGE_COMMIT}.tar.gz
+			-> pillow-test-images-${TEST_IMAGE_COMMIT}.gh.tar.gz
+	)
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="HPND"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos"
+IUSE="examples imagequant +jpeg jpeg2k lcms test tiff tk truetype webp xcb zlib"
+REQUIRED_USE="test? ( jpeg jpeg2k lcms tiff truetype )"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	imagequant? ( media-gfx/libimagequant:= )
+	jpeg? ( media-libs/libjpeg-turbo:= )
+	jpeg2k? ( media-libs/openjpeg:2= )
+	lcms? ( media-libs/lcms:2= )
+	tiff? ( media-libs/tiff:=[jpeg,zlib] )
+	truetype? (
+		media-libs/freetype:2=
+		media-libs/harfbuzz:=
+	)
+	webp? ( media-libs/libwebp:= )
+	xcb? ( x11-libs/libxcb )
+	zlib? ( sys-libs/zlib:= )
+"
+RDEPEND="
+	${DEPEND}
+	dev-python/olefile[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	dev-python/wheel[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	test? (
+		dev-python/defusedxml[${PYTHON_USEDEP}]
+		dev-python/packaging[${PYTHON_USEDEP}]
+		dev-python/pytest-timeout[${PYTHON_USEDEP}]
+		|| (
+			media-gfx/imagemagick[png]
+			media-gfx/graphicsmagick[png]
+		)
+	)
+"
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_prepare() {
+	local PATCHES=(
+		# https://github.com/python-pillow/pillow/pull/7634
+		"${FILESDIR}/${PN}-10.2.0-cross.patch"
+	)
+
+	distutils-r1_src_prepare
+
+	if use test; then
+		mv "${WORKDIR}/test-images-${TEST_IMAGE_COMMIT}"/* \
+			Tests/images || die
+	fi
+}
+
+usepil() {
+	usex "${1}" enable disable
+}
+
+python_configure_all() {
+	cat >> setup.cfg <<-EOF || die
+		[build_ext]
+		debug = True
+		disable_platform_guessing = True
+		$(usepil truetype)_freetype = True
+		$(usepil jpeg)_jpeg = True
+		$(usepil jpeg2k)_jpeg2000 = True
+		$(usepil lcms)_lcms = True
+		$(usepil tiff)_tiff = True
+		$(usepil imagequant)_imagequant = True
+		$(usepil webp)_webp = True
+		$(usepil xcb)_xcb = True
+		$(usepil zlib)_zlib = True
+	EOF
+	if use truetype; then
+		# these dependencies are implicitly disabled by USE=-truetype
+		# and we can't pass both disable_* and vendor_*
+		# https://bugs.gentoo.org/935124
+		cat >> setup.cfg <<-EOF || die
+			vendor_raqm = False
+			vendor_fribidi = False
+		EOF
+	fi
+
+	tc-export PKG_CONFIG
+}
+
+src_test() {
+	virtx distutils-r1_src_test
+}
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# TODO (is clipboard unreliable in Xvfb?)
+		Tests/test_imagegrab.py::TestImageGrab::test_grabclipboard
+		# requires xz-utils[extra-filters]?
+		Tests/test_file_libtiff.py::TestFileLibTiff::test_lzma
+	)
+
+	case ${ARCH} in
+		ppc)
+			EPYTEST_DESELECT+=(
+				# https://github.com/python-pillow/Pillow/issues/7008
+				# (we've reverted the upstream patch because it was worse
+				# than the original issue)
+				Tests/test_file_libtiff.py::TestFileLibTiff::test_exif_ifd
+			)
+			;;
+	esac
+
+	"${EPYTHON}" selftest.py --installed || die "selftest failed with ${EPYTHON}"
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# leak tests are fragile and broken under xdist
+	epytest -k "not leak" -p timeout || die "Tests failed with ${EPYTHON}"
+}
+
+python_install() {
+	python_doheader src/libImaging/*.h
+	distutils-r1_python_install
+}
+
+python_install_all() {
+	if use examples ; then
+		docinto example
+		dodoc docs/example/*
+		docompress -x /usr/share/doc/${PF}/example
+	fi
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index 3df9d1334c..7bf70ea3cb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1,2 +1 @@
-DIST platformdirs-4.3.6.tar.gz 21302 BLAKE2B 3488d33c70c420a7234fa773a7b61eaabc85e7aabfa75c9de308074ef653b534823a133038eb8098d41f987596d7fa6c70abd6cdde28234590261ecd6c8a9f56 SHA512 8a14126346f5472798074bd9ef73b39cd0c6517951556f7ab839d2c1993d8001a3359101fe3a7a00e803d8a5540cf33057d99e1a2e93b1bd5e20a948c89e4e44
 DIST platformdirs-4.3.7.tar.gz 21291 BLAKE2B 8abe5b99140d1968d0341c025a65cd373d798b4b3848686888e754aad95d5d7e526db9618b2f44300d5b84700655b1562fa40929362a78ed50502a6ef54a55fa SHA512 d2d131aabc448d80581e930b7bb6ced950ce7f2fe595243f0a57ab2e990f7c6669cc45fb4592971f7601f268455451881ceaf303618b5f963056e818c1580bcc
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild
deleted file mode 100644
index 14b98a8879..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.6.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 2021-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
-HOMEPAGE="
-	https://pypi.org/project/platformdirs/
-	https://github.com/tox-dev/platformdirs/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
-
-BDEPEND="
-	test? (
-		dev-python/appdirs[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "hatchling' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "${PN}"
-		version = "${PV}"
-		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
-	EOF
-	# sigh
-	cat > src/platformdirs/version.py <<-EOF || die
-		__version__ = version = '${PV}'
-		__version_tuple__ = version_tuple = (${PV//./, })
-	EOF
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	epytest -p pytest_mock
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild
index c14ecbf372..14b98a8879 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.3.7.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
index 8af3d857f1..805e27434b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/Manifest
@@ -1 +1,2 @@
 DIST rich-13.9.4.gh.tar.gz 15064359 BLAKE2B bf0bd53f3993fbfa309012b646d293799699040827c160a627fb4dbf292146e43b4a823606a6d9855d835f9739c1d75f539328aa093471db54adff44ef7d4e77 SHA512 36d9f0442759784453a75c9a80cd3dde113db5544d62da1eb85bc0572c16b6247da9b5254246fa571007ce0e70a234aea2ab1ed5dc20c1ec23084070733d39a1
+DIST rich-14.0.0.gh.tar.gz 15065886 BLAKE2B b1e47ee163561f714cbddf6d809e7f5b2c28d09c196ec0132a04bdcaa05415fe7189a9c471bd68d3cb18e526d4aecb4499229cf3adac85164cf6309c77f53b74 SHA512 e3192d75d35d9f63fa687a8e9e7893ea273ef193b7e27c266d2f1a1c62c7fa44e83cfb6ea3fef716fff6d337a826af393c223d5d4bddc52b4ec84aa6554379ef
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
new file mode 100644
index 0000000000..d12fe38408
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/rich/rich-14.0.0.ebuild
@@ -0,0 +1,74 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=poetry
+PYTHON_COMPAT=( python3_{10..13} pypy3 pypy3_11 )
+
+inherit distutils-r1 optfeature
+
+DESCRIPTION="Python library for rendering rich text, tables, etc. to the terminal"
+HOMEPAGE="
+	https://github.com/Textualize/rich/
+	https://pypi.org/project/rich/
+"
+SRC_URI="
+	https://github.com/Textualize/rich/archive/v${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+
+RDEPEND="
+	dev-python/colorama[${PYTHON_USEDEP}]
+	>=dev-python/markdown-it-py-2.2.0[${PYTHON_USEDEP}]
+	>=dev-python/pygments-2.13.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/typing-extensions-4.0.0[${PYTHON_USEDEP}]
+	' 3.10)
+"
+BDEPEND="
+	test? (
+		>=dev-python/attrs-21.4.0[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# TODO
+		tests/test_console.py::test_size_can_fall_back_to_std_descriptors
+		# TODO: segfault in recursion (PyQt6 interfering?)
+		tests/test_traceback.py::test_recursive
+		# TODO: some random dep changes?
+		tests/test_markdown.py::test_inline_code
+		tests/test_syntax.py::test_blank_lines
+		tests/test_syntax.py::test_python_render_simple_indent_guides
+	)
+	# version-specific output -- the usual deal
+	case ${EPYTHON} in
+		pypy3)
+			EPYTEST_DESELECT+=(
+				# pypy3.10, to be more precise
+				tests/test_inspect.py::test_inspect_integer_with_methods_python310only
+			)
+			;;
+		pypy3.11)
+			EPYTEST_DESELECT+=(
+				tests/test_inspect.py::test_inspect_integer_with_methods_python311
+			)
+			;;
+	esac
+
+	local -x COLUMNS=80
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}
+
+pkg_postinst() {
+	optfeature "integration with HTML widgets for Jupyter" dev-python/ipywidgets
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
index db039bba50..9217a4d8ad 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
@@ -1,2 +1 @@
-DIST setuptools_scm-8.2.0.tar.gz 77572 BLAKE2B 105ddebf318a1bc0d1f0ee0e5232f5af8a43a8ed0908bd6ffceb6ba188ff8640b681a0a98006f67cc8c2f82917e6e0565f8a1aba44e8d7ff29700e3d158dde22 SHA512 3f4c4eb8a3e4f71a29187486cdc00b1e9af9b577c55a58b5ad03e6c6bad50b638b2e23ed8ee3db739481f8380d126635b42213b16172e79ba9f6ec81ce774e27
 DIST setuptools_scm-8.2.1.tar.gz 78075 BLAKE2B e026c02cd172b6a7cbcea93c2ceeeaaff9912722063523b1f12039b7d9c147a9b5d1267e907867e27d8c8deb14e9d32e4c48cdf5683ec796a0c1fc01dabf1843 SHA512 4afa1bba1a9e3791be5b2cda945ee9c6a0d3b085a528ec9d74ca4e3649522d947594aade9e146164df3548a853aed96c62a14c617d38b50a7797f8e1f53f7ab1
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.0.ebuild
deleted file mode 100644
index c99de4cc8f..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.0.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=standalone
-PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Manage versions by scm tags via setuptools"
-HOMEPAGE="
-	https://github.com/pypa/setuptools-scm/
-	https://pypi.org/project/setuptools-scm/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-# there's an optional dep on rich for cute logs
-RDEPEND="
-	dev-python/packaging[${PYTHON_USEDEP}]
-	>=dev-python/setuptools-61[${PYTHON_USEDEP}]
-	$(python_gen_cond_dep '
-		>=dev-python/tomli-2.0.2[${PYTHON_USEDEP}]
-	' 3.10)
-"
-BDEPEND="
-	dev-python/setuptools[${PYTHON_USEDEP}]
-	test? (
-		dev-python/build[${PYTHON_USEDEP}]
-		dev-python/typing-extensions[${PYTHON_USEDEP}]
-		dev-vcs/git
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	local EPYTEST_DESELECT=(
-		# the usual nondescript gpg-agent failure
-		testing/test_git.py::test_git_getdate_signed_commit
-
-		# fetching from the Internet
-		testing/test_regressions.py::test_pip_download
-
-		# calls flake8, unpredictable
-		testing/test_functions.py::test_dump_version_flake8
-	)
-
-	if has_version dev-python/nose; then
-		EPYTEST_DESELECT+=(
-			# https://bugs.gentoo.org/892639
-			testing/test_integration.py::test_pyproject_support
-		)
-	fi
-
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild
index b3466e7f8a..c99de4cc8f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.2.1.ebuild
@@ -17,7 +17,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # there's an optional dep on rich for cute logs
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index 2ec5c0a63a..e8a56df076 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1,2 +1,3 @@
 DIST typing_extensions-4.12.2.tar.gz 85321 BLAKE2B 8f32740675f5da226c6fd5fa95e0b903794d76cc25d759bee6b136913a3eedc7a702cdc7709587cae13ba3b3d44a7bb1acbdad61333fe655382e3d01d63a3fa7 SHA512 b06f26ae55194f37ee48dcb894bf583051c9e74f639f25195990f56330eae7b585ab4b8655ca575539f48254c20f1920628db6db10512953d1f6364e3c076a27
 DIST typing_extensions-4.13.0.tar.gz 106520 BLAKE2B 65aff07587aae79fce1e69c127dc02955169288f944542e560347e33eff3e65d86380efcbf647efffa0b6d253096ee409f065345adc97c913d3ae0f079099024 SHA512 5d2a9fc8f0ef41e585f5c0ad155672018e9e6e76391ebe294ed32a2e8934ace8ad997b40dd14d335ebe2d74dbee5eb477f7816fbf29d832d3f3118cfcfd18e31
+DIST typing_extensions-4.13.1.tar.gz 106633 BLAKE2B 766e4adb9e534c0c998407f101862ad38ee4407fd844548c05f7a4a59c70e839620700daf6aa30fd7204f84117b6e88145daa2d3d7b7474abddd5eb3c4a385e5 SHA512 63775b10380a02e9bd7ec5f5fe59952731e0fefa9cd9b25073bbd2b12f71718d4c44926809f6785a04c2cdd2d9486f4c35c91345cda2cc9ada034deb006c404c
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild
new file mode 100644
index 0000000000..fddc778a16
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.13.1.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
+HOMEPAGE="
+	https://pypi.org/project/typing-extensions/
+	https://github.com/python/typing_extensions/
+"
+
+LICENSE="PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	>=dev-python/flit-core-3.11[${PYTHON_USEDEP}]
+	test? (
+		dev-python/test[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests unittest
+
+python_test() {
+	cd src || die
+	eunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
index c6f56f57d7..ade4a826f2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/Manifest
@@ -1 +1,2 @@
 DIST wheel-0.45.1.tar.gz 107545 BLAKE2B 13c8d60a2e39ded3d911c9e03915b01bda201f7e8cd6de456484ce6eeb2a990861a01f26e5d9f2ac4ca0ab2b6d0fea9db437d6f82cb39db9b1059c3c53202ec0 SHA512 df45f00e9eaeae2f27f813f31591590c961da2f6bff15bba6fb2a14d529c221f39b29894b8da408fe49cd4b760840a0e05c4baef377ccfacd9983c0bba83d6d8
+DIST wheel-0.46.0.tar.gz 49842 BLAKE2B de27540cc6a31be0b834c28e3861040e8fe2949d4c5d048ce1c708cf17ffa8efbea48c00fb5429f7be32ab5ccd0ec0918c72f9e131250ceb3159c16a9f887ed7 SHA512 ca3632b03ffb4b23008c6e897a32993ef5926d34103fea9b978206bdeda573650678f1292c6d4f810390703f50012781a87482a732b14fd61bf292aa32e97357
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.0.ebuild
new file mode 100644
index 0000000000..575c8758eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/wheel/wheel-0.46.0.ebuild
@@ -0,0 +1,41 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..13} python3_13t pypy3 pypy3_11 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A built-package format for Python"
+HOMEPAGE="
+	https://github.com/pypa/wheel/
+	https://pypi.org/project/wheel/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/packaging-24.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/setuptools[${PYTHON_USEDEP}]
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fails if any setuptools plugin imported the module first
+	tests/test_bdist_wheel.py::test_deprecated_import
+)
+
+distutils_enable_tests pytest
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
index 7649a05851..6a78a190c4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
@@ -2,3 +2,4 @@ DIST glib-2.78.6.tar.xz 5344808 BLAKE2B d16173794c4aa019459cf8c8c84d4107fb839382
 DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a8cfda8b8770dd391861999ff3381008f4fe382e90f0a7798fe218debda7f559f6e3ac8f9305e3be98b879969 SHA512 c9cc9f99e217fd950810fcfbfa7300c7850cae4dbfbabc03cdcadb6dcca2e51ea7979ceb68c09d8e9776fd1c04db73b89b81f748c8bd911e1f7ad9f704dff172
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
+DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.1.ebuild
new file mode 100644
index 0000000000..0c7b742832
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.84.1.ebuild
@@ -0,0 +1,78 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+GNOME_ORG_MODULE="glib"
+PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_REQ_USE="xml(+)"
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_SINGLE_IMPL=1
+
+inherit gnome.org distutils-r1
+
+DESCRIPTION="GDBus code and documentation generator"
+HOMEPAGE="https://www.gtk.org/"
+
+S="${WORKDIR}/glib-${PV}/gio/gdbus-2.0/codegen"
+
+LICENSE="LGPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	>=dev-libs/glib-${PV}
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-libs/libxslt
+	app-text/docbook-xsl-stylesheets
+	>=dev-python/docutils-0.21.1
+"
+
+python_prepare_all() {
+	PATCHES=(
+		"${FILESDIR}/${PN}-2.56.1-sitedir.patch"
+	)
+	distutils-r1_python_prepare_all
+
+	local MAJOR_VERSION=$(ver_cut 1)
+	local MINOR_VERSION=$(ver_cut 2)
+	sed -e 's:@PYTHON@:python:' gdbus-codegen.in > gdbus-codegen || die
+	sed -e "s:@VERSION@:${PV}:" \
+		-e "s:@MAJOR_VERSION@:${MAJOR_VERSION}:" \
+		-e "s:@MINOR_VERSION@:${MINOR_VERSION}:" config.py.in > config.py || die
+	cp "${FILESDIR}/setup.py-2.32.4" setup.py || die "cp failed"
+	sed -e "s/@PV@/${PV}/" -i setup.py || die "sed setup.py failed"
+}
+
+do_xsltproc_command() {
+	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/glib-utils)
+	xsltproc \
+		--nonet \
+		--stringparam man.output.quietly 1 \
+		--stringparam funcsynopsis.style ansi \
+		--stringparam man.th.extra1.suppress 1 \
+		--stringparam man.authors.section.enabled 0 \
+		--stringparam man.copyright.section.enabled 0 \
+		-o "${2}" \
+		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
+		"${1}" || die "manpage generation failed"
+}
+
+src_compile() {
+	distutils-r1_src_compile
+	rst2man \
+		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.rst" \
+		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
+}
+
+src_test() {
+	einfo "Skipping tests. This package is tested by dev-libs/glib"
+	einfo "when merged with FEATURES=test"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all # no-op, but prevents QA warning
+	doman "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
index 7649a05851..6a78a190c4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
@@ -2,3 +2,4 @@ DIST glib-2.78.6.tar.xz 5344808 BLAKE2B d16173794c4aa019459cf8c8c84d4107fb839382
 DIST glib-2.80.5.tar.xz 5538308 BLAKE2B 3f17ff85a85d20858b69c2dccc1e5d6ffd92661a8cfda8b8770dd391861999ff3381008f4fe382e90f0a7798fe218debda7f559f6e3ac8f9305e3be98b879969 SHA512 c9cc9f99e217fd950810fcfbfa7300c7850cae4dbfbabc03cdcadb6dcca2e51ea7979ceb68c09d8e9776fd1c04db73b89b81f748c8bd911e1f7ad9f704dff172
 DIST glib-2.82.5.tar.xz 5554704 BLAKE2B e7853034be1137f8b793483df9e9ce1465dd10a990eb9b3cb9ac76c9f8f86ccc6fda85645b04b35963b28c33e0f6c02df4f3d03e06cc278b8515e588d6bd05f6 SHA512 a6b035c32a42b9d6f4c031a29da405848002619654b58c9205f2f78dbb9698cd5866f31ab213adc04aa214d2c48840a9592c0a1e9201e6851ebd435635f393ae
 DIST glib-2.84.0.tar.xz 5613328 BLAKE2B a482076d6b0c82824179094974110dbd10d47fce93f84f4626d0d3dbea528602c41ac4a7ab8feedc3d7cc5e404ef8bef30c6c744b6f0f4f3a764644e28210e28 SHA512 72b85e30c535c5da7d8598d1cec02b1b481c467e612dbb396a0a64ad1d37cf2f1802c6fa576885c99cf8a22f4f0fc7dfdf42a3f32f7f40394f72db588fdbebb7
+DIST glib-2.84.1.tar.xz 5615396 BLAKE2B d20ade482eb95873adaefc656e22c57e6712a6263a4812e448220040e30144919331cb279566a89a2ab46495b46d6a79e3821e491317587325fa3a64b40d62cc SHA512 ee7f38a4726fd72e41ddb75c4933c7b1bb30935bb2fddc84902d0627a836af512534195132cc02e3d15f168fefc816576181a8d6e436472b582191437b79a456
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.1.ebuild
new file mode 100644
index 0000000000..8b1ce3fe27
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.84.1.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+PYTHON_COMPAT=( python3_{10..13} )
+GNOME_ORG_MODULE="glib"
+
+inherit gnome.org python-single-r1
+
+DESCRIPTION="Build utilities for GLib using projects"
+HOMEPAGE="https://www.gtk.org/"
+
+LICENSE="LGPL-2.1+"
+SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-python/docutils-0.21.1
+"
+
+src_configure() { :; }
+
+do_rst2man_command() {
+	rst2man \
+		--syntax-highlight=none \
+		"${1}" "${2}" || die "manpage generation failed"
+}
+
+src_compile() {
+	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-genmarshal.in > gobject/glib-genmarshal || die
+	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-mkenums.in > gobject/glib-mkenums || die
+	sed -e "s:@GLIB_VERSION@:${PV}:g;s:@PYTHON@:python:g" glib/gtester-report.in > glib/gtester-report || die
+	do_rst2man_command docs/reference/gobject/glib-genmarshal.rst docs/reference/gobject/glib-genmarshal.1
+	do_rst2man_command docs/reference/gobject/glib-mkenums.rst docs/reference/gobject/glib-mkenums.1
+	do_rst2man_command docs/reference/glib/gtester-report.rst docs/reference/glib/gtester-report.1
+}
+
+src_install() {
+	python_fix_shebang gobject/glib-genmarshal
+	python_fix_shebang gobject/glib-mkenums
+	python_fix_shebang glib/gtester-report
+	exeinto /usr/bin
+	doexe gobject/glib-genmarshal
+	doexe gobject/glib-mkenums
+	doexe glib/gtester-report
+	doman docs/reference/gobject/glib-genmarshal.1
+	doman docs/reference/gobject/glib-mkenums.1
+	doman docs/reference/glib/gtester-report.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.3.ebuild
index 1c7441b062..340429ab71 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/maturin/maturin-1.8.3.ebuild
@@ -24,7 +24,7 @@ LICENSE+="
 	MPL-2.0 Unicode-3.0 Unicode-DFS-2016
 " # crates
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="doc +ssl test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index 393d40a615..899a0fef99 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,6 +1,7 @@
 DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
 DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
 DIST linux-6.13.tar.xz 148523052 BLAKE2B 9f617ecb3f2393b57ba03c654fea62a7213f24c835989f333a1ef29492af551bfa7d9ad786d5ef1484854adc77c7c6af38fb09a72d994d305695f512c325e77f SHA512 1137e6440132b0958f89165440e99208f82b204e7245ae69dc9c808df97d13ce8f58136db92407e0e93394fa7f6283ec7a34597c6e92a5b6d9025e0960357957
+DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.7.tar.xz 141406528 BLAKE2B cecdbd19905e43e485ab73b352ced18b37f2a138c97a6956cadcda5d3d271001117dc1cf896b166ff019fc7f405f9539e2ed0d6112b0890efb04d182adf4fd0e SHA512 de06de556191614bd9daf077ae239360352a402bab407748e67f1e5108c92fd933e451707840ab22fe0f9976db3d1e1b60ca9d41cf894f015ca09b3f652b74ad
 DIST patch-6.11.7.xz 669756 BLAKE2B f2ec79bd337eaa61c7203c00ce61b3e5afa9eee38a3e38e63a7fc9270af86674e5c369ca7ddfe4fa5f79601b1c874af1ce732bd8987529c7db2f2f9ca54ba85b SHA512 031c22e2fa7e1c7808f50dc2120a35d10a0b81d30636c5d19146fe12558999517f132213b72c39a32d8cc2c0e14e16ff64cac63ef97f8be0ebe8e709a3de8156
 DIST patch-6.13.5.xz 459896 BLAKE2B 08f3dc28f8f9cbf561570dc74b1a7070be07f966c442e9a4baf98fc5d7b18ec9d15360911049747ecbc1fe91c3f32188006ce85817caf2ba10925bf9456d76cf SHA512 d1d4b60f6072291624fcab6c630e8cd06795ad84282ad7fd55b1ab288b762a092b8486d2905f1de8e91e7b0e7d6e9a0046bd76d8e7352ff7ab5129e2ef67613b
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.14-lto.patch b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.14-lto.patch
new file mode 100644
index 0000000000..e5e54fd00b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/files/perf-6.14-lto.patch
@@ -0,0 +1,17 @@
+
+Adapted to v6.14 from patch submitted upstream:
+https://lore.kernel.org/all/20250321082038.27901-2-holger@applied-asynchrony.com/
+
+Bug: https://bugs.gentoo.org/951151
+
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -820,7 +820,7 @@ else
+   PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS))
+   PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null)
+   PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS))
+-  PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS))
++  PERL_EMBED_CCOPTS := $(filter-out -flto=% -ffat-lto-objects, $(PERL_EMBED_CCOPTS))
+   PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS))
+   FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS)
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
index 2a4e4eada6..caa72e3254 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/metadata.xml
@@ -27,7 +27,7 @@
     <flag name="libpfm">Enable <pkg>dev-libs/libpfm</pkg> support</flag>
     <flag name="libtraceevent">Enable <pkg>dev-libs/libtraceevent</pkg> support</flag>
     <flag name="libtracefs">Enable <pkg>dev-libs/libtracefs</pkg> support</flag>
-    <flag name="numa">Enable NUMA support</flag>
+    <flag name="numa">Enable NUMA support using <pkg>sys-process/numactl</pkg> (NUMA kernel support is also required)</flag>
     <flag name="perl">
       Add support for Perl as a scripting language for perf tools.
     </flag>
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.14.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.14.ebuild
new file mode 100644
index 0000000000..99e4b1b918
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.14.ebuild
@@ -0,0 +1,350 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {18..20} )
+PYTHON_COMPAT=( python3_{10..13} python3_13t)
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm-r1 toolchain-funcs python-r1
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perf.wiki.kernel.org/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="abi_mips_o32 abi_mips_n32 abi_mips_n64 babeltrace capstone big-endian bpf caps crypt debug +doc gtk java libpfm +libtraceevent +libtracefs lzma numa perl +python +slang systemtap tcmalloc unwind"
+
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.34-r2
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="
+	babeltrace? ( dev-util/babeltrace:0/1 )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+		$(llvm_gen_dep '
+			llvm-core/clang:${LLVM_SLOT}=
+			llvm-core/llvm:${LLVM_SLOT}=
+		')
+	)
+	caps? ( sys-libs/libcap )
+	capstone? ( dev-libs/capstone )
+	crypt? ( dev-libs/openssl:= )
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-debug/systemtap )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	app-arch/zstd:=
+	dev-libs/elfutils
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+	virtual/libcrypt
+"
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	local CONFIG_CHECK="
+		~!SCHED_OMIT_FRAME_POINTER
+		~DEBUG_INFO
+		~FRAME_POINTER
+		~FTRACE
+		~FTRACE_SYSCALLS
+		~FUNCTION_TRACER
+		~KALLSYMS
+		~KALLSYMS_ALL
+		~KPROBES
+		~KPROBE_EVENTS
+		~PERF_EVENTS
+		~STACKTRACE
+		~TRACEPOINTS
+		~UPROBES
+		~UPROBE_EVENTS
+	"
+
+	use bpf && llvm-r1_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT ~UNWINDER_FRAME_POINTER"
+	fi
+
+	linux-info_pkg_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		'arch/*/include/*' 'arch/*/lib/*' 'arch/*/tools/*' 'include/*'
+		'kernel/bpf/*' 'lib/*' 'scripts/*' 'tools/arch/*' 'tools/bpf/*'
+		'tools/build/*' 'tools/include/*' 'tools/lib/*' 'tools/perf/*'
+		'tools/scripts/*'
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		xzcat "${DISTDIR}"/${LINUX_PATCH} | filterdiff -p1 ${paths[@]/#/-i} > ${P}.patch
+		assert -n "Unpacking to ${P} from ${DISTDIR}/${LINUX_PATCH} failed"
+		eend $? || die "filterdiff failed"
+		test -s ${P}.patch || die "patch is empty?!"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	# Gentoo patches go here
+		eapply "${FILESDIR}"/${P}-lto.patch
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" 1; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+
+	# sync this with the whitelist in tools/perf/Makefile.config
+	local disable_libdw
+	if ! use amd64 && ! use x86 && \
+	   ! use arm && \
+	   ! use arm64 && \
+	   ! use ppc && ! use ppc64 \
+	   ! use s390 && \
+	   ! use riscv && \
+	   ! use loong
+	then
+		disable_libdw=1
+	fi
+
+	# perf directly invokes LD for linking without going through CC, on mips
+	# it is required to specify the emulation.  port of below buildroot patch
+	# https://patchwork.ozlabs.org/project/buildroot/patch/20170217105905.32151-1-Vincent.Riera@imgtec.com/
+	local linker="$(tc-getLD)"
+	if use mips
+	then
+		if use big-endian
+		then
+			use abi_mips_n64 && linker+=" -m elf64btsmip"
+			use abi_mips_n32 && linker+=" -m elf32btsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32btsmip"
+		else
+			use abi_mips_n64 && linker+=" -m elf64ltsmip"
+			use abi_mips_n32 && linker+=" -m elf32ltsmipn32"
+			use abi_mips_o32 && linker+=" -m elf32ltsmip"
+		fi
+	fi
+
+	# FIXME: NO_CORESIGHT
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="${linker}" NM="$(tc-getNM)"
+		CLANG="${CHOST}-clang"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_CAPSTONE=$(puse capstone)
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=1
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND="${disable_libdw}"
+		NO_LIBELF=
+		NO_LIBLLVM=$(puse bpf)
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_SDT=$(puse systemtap)
+		NO_SHELLCHECK=1
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		DEBUG=$(usex debug 1 "")
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
+		"$@"
+	)
+	emake "${emakeargs[@]}"
+}
+
+src_compile() {
+	filter-lto
+
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
index ecb9062863..46155090d3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/Manifest
@@ -1 +1,2 @@
 DIST pkgcheck-0.10.33.tar.gz 380205 BLAKE2B 7f732443cc03e5bfb184f976f1af507cae55f3c98b9d251701d209cc18e76a99e168afcdffe359b9b3ec731aa754eb6223381cc7bc5a7661cfde82a50337f8fe SHA512 f4a1de6d99982d6ec4d77e245ea968922a2a906087449a0d98ebe3d8fc22a4a6cf060b09d3455efdbe7e9a445e785c0312120d3158a08790880a94c8e045e9c6
+DIST pkgcheck-0.10.34.tar.gz 382566 BLAKE2B d91302f673326bf4756e06c2bad1ad89b10f14a08ac54a24a6a00d7a95d4313e5e1755393aefa55e1057a396483b023cc38e67902238e2620a76961feb8b2a81 SHA512 57ec0ccea00cde4187219f85d23f755878e2298f6219cb9b18eb35f927a685aac2d9b9c73045f6750f90959abb6313a1ed99dedaae4f0ec6b59f08585253a410
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild
new file mode 100644
index 0000000000..ad3b084458
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgcheck/pkgcheck-0.10.34.ebuild
@@ -0,0 +1,93 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{10..13} )
+inherit elisp-common distutils-r1 optfeature
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/pkgcheck.git
+		https://github.com/pkgcore/pkgcheck.git"
+	inherit git-r3
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	inherit pypi
+fi
+
+DESCRIPTION="pkgcore-based QA utility for ebuild repos"
+HOMEPAGE="https://github.com/pkgcore/pkgcheck"
+
+LICENSE="BSD MIT"
+SLOT="0"
+IUSE="emacs"
+
+if [[ ${PV} == *9999 ]]; then
+	RDEPEND="
+		~dev-python/snakeoil-9999[${PYTHON_USEDEP}]
+		~sys-apps/pkgcore-9999[${PYTHON_USEDEP}]"
+else
+	RDEPEND="
+		>=dev-python/snakeoil-0.10.10[${PYTHON_USEDEP}]
+		>=sys-apps/pkgcore-0.12.25[${PYTHON_USEDEP}]"
+fi
+RDEPEND+="
+	>=dev-libs/tree-sitter-bash-0.21.0[python,${PYTHON_USEDEP}]
+	dev-python/chardet[${PYTHON_USEDEP}]
+	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
+	dev-python/lxml[${PYTHON_USEDEP}]
+	dev-python/pathspec[${PYTHON_USEDEP}]
+	>=dev-python/tree-sitter-0.23.0[${PYTHON_USEDEP}]
+	<dev-python/tree-sitter-0.25.0[${PYTHON_USEDEP}]
+	emacs? (
+		>=app-editors/emacs-24.1:*
+		app-emacs/ebuild-mode
+		app-emacs/flycheck
+	)
+"
+BDEPEND="${RDEPEND}
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
+	test? (
+		dev-python/requests[${PYTHON_USEDEP}]
+		dev-vcs/git
+	)
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+distutils_enable_tests pytest
+
+export USE_SYSTEM_TREE_SITTER_BASH=1
+
+src_compile() {
+	distutils-r1_src_compile
+
+	if use emacs ; then
+	   pushd "${S}"/contrib/emacs >/dev/null || die
+	   elisp-compile *.el
+	   popd >/dev/null || die
+	fi
+}
+
+python_install_all() {
+	local DOCS=( NEWS.rst )
+	[[ ${PV} == *9999 ]] || doman build/sphinx/man/*
+	distutils-r1_python_install_all
+
+	if use emacs ; then
+		elisp-install ${PN} "${S}"/contrib/emacs/*.el{,c}
+		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
+	fi
+}
+
+pkg_postinst() {
+	use emacs && elisp-site-regen
+
+	optfeature "Network check support" dev-python/requests
+	optfeature "Perl module version check support" dev-perl/Gentoo-PerlMod-Version
+}
+
+pkg_postrm() {
+	use emacs && elisp-site-regen
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.49.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.49.0-r1.ebuild
deleted file mode 100644
index 386116e4e0..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.49.0-r1.ebuild
+++ /dev/null
@@ -1,492 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-GENTOO_DEPEND_ON_PERL=no
-
-# bug #329479: git-remote-testgit is not multiple-version aware
-PYTHON_COMPAT=( python3_{10..13} )
-
-inherit toolchain-funcs perl-module bash-completion-r1 optfeature plocale python-single-r1 systemd meson
-
-PLOCALES="bg ca de es fr is it ko pt_PT ru sv vi zh_CN"
-
-if [[ ${PV} == *9999 ]]; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/git/git.git"
-
-	inherit git-r3
-	# Please ensure that all _four_ 9999 ebuilds get updated; they track the 4 upstream branches.
-	# See https://git-scm.com/docs/gitworkflows#_graduation
-	# In order of stability:
-	# 9999-r0: maint
-	# 9999-r1: master
-	# 9999-r2: next
-	# 9999-r3: seen
-	case ${PVR} in
-		9999) EGIT_BRANCH=maint ;;
-		9999-r1) EGIT_BRANCH=master ;;
-		9999-r2) EGIT_BRANCH=next;;
-		9999-r3) EGIT_BRANCH=seen ;;
-	esac
-fi
-
-MY_PV="${PV/_rc/.rc}"
-MY_P="${PN}-${MY_PV}"
-
-DOC_VER="${MY_PV}"
-
-DESCRIPTION="Stupid content tracker: distributed VCS designed for speed and efficiency"
-HOMEPAGE="https://www.git-scm.com/"
-
-if [[ ${PV} != *9999 ]]; then
-	SRC_URI_SUFFIX="xz"
-	SRC_URI_KORG="https://www.kernel.org/pub/software/scm/git"
-
-	[[ ${PV/rc} != ${PV} ]] && SRC_URI_KORG+='/testing'
-
-	SRC_URI="${SRC_URI_KORG}/${MY_P}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" ${SRC_URI_KORG}/${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}"
-	SRC_URI+=" doc? ( ${SRC_URI_KORG}/${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX} )"
-
-	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+curl cgi cvs doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion test tk +webdav xinetd"
-
-# Common to both DEPEND and RDEPEND
-DEPEND="
-	dev-libs/openssl:=
-	sys-libs/zlib
-	curl? (
-		net-misc/curl
-		webdav? ( dev-libs/expat )
-	)
-	keyring? (
-		app-crypt/libsecret
-		dev-libs/glib:2
-	)
-	iconv? ( virtual/libiconv )
-	pcre? ( dev-libs/libpcre2:= )
-	perl? ( dev-lang/perl:=[-build(-)] )
-	tk? ( dev-lang/tk:= )
-"
-RDEPEND="
-	${DEPEND}
-	gpg? ( app-crypt/gnupg )
-	perl? (
-		dev-perl/Error
-		dev-perl/MailTools
-		dev-perl/Authen-SASL
-		>=virtual/perl-libnet-3.110.0-r4[ssl]
-		cgi? (
-			dev-perl/CGI
-			highlight? ( app-text/highlight )
-		)
-		cvs? (
-			>=dev-vcs/cvsps-2.1:0
-			dev-perl/DBI
-			dev-perl/DBD-SQLite
-		)
-		mediawiki? (
-			dev-perl/DateTime-Format-ISO8601
-			dev-perl/HTML-Tree
-			dev-perl/MediaWiki-API
-		)
-		subversion? (
-			dev-vcs/subversion[-dso(-),perl]
-			dev-perl/libwww-perl
-			dev-perl/TermReadKey
-		)
-	)
-	perforce? ( ${PYTHON_DEPS} )
-	selinux? ( sec-policy/selinux-git )
-"
-
-# This is how info docs are created with Git:
-#   .txt/asciidoc --(asciidoc)---------> .xml/docbook
-#   .xml/docbook  --(docbook2texi.pl)--> .texi
-#   .texi         --(makeinfo)---------> .info
-BDEPEND="
-	doc? (
-		app-text/asciidoc
-		app-text/docbook2X
-		app-text/xmlto
-		sys-apps/texinfo
-	)
-	keyring? ( virtual/pkgconfig )
-	nls? ( sys-devel/gettext )
-	test? (
-		app-arch/unzip
-		app-crypt/gnupg
-		dev-lang/perl
-	)
-"
-
-# Live ebuild builds man pages and HTML docs, additionally
-if [[ ${PV} == *9999 ]]; then
-	BDEPEND+=" app-text/asciidoc"
-fi
-
-SITEFILE="50${PN}-gentoo.el"
-
-REQUIRED_USE="
-	cgi? ( perl )
-	cvs? ( perl )
-	mediawiki? ( perl )
-	perforce? ( ${PYTHON_REQUIRED_USE} )
-	subversion? ( perl )
-	webdav? ( curl )
-"
-
-RESTRICT="!test? ( test )"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.48.1-macos-no-fsmonitor.patch
-	"${FILESDIR}"/${PN}-2.49.0-meson-use-test_environment-conditionally.patch
-	"${FILESDIR}"/${PN}-2.49.0-docs.patch
-)
-
-pkg_setup() {
-	if use subversion && has_version "dev-vcs/subversion[dso]" ; then
-		ewarn "Per Gentoo bugs #223747, #238586, when subversion is built"
-		ewarn "with USE=dso, there may be weird crashes in git-svn. You"
-		ewarn "have been warned!"
-	fi
-
-	if use perforce ; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-src_unpack() {
-	if [[ ${PV} != *9999 ]] ; then
-		unpack ${MY_P}.tar.${SRC_URI_SUFFIX}
-
-		cd "${S}" || die
-		unpack ${PN}-manpages-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-
-		if use doc ; then
-			pushd "${S}"/Documentation &>/dev/null || die
-			unpack ${PN}-htmldocs-${DOC_VER}.tar.${SRC_URI_SUFFIX}
-			popd &>/dev/null || die
-		fi
-	else
-		git-r3_src_unpack
-	fi
-
-}
-
-src_prepare() {
-	if ! use safe-directory ; then
-		# This patch neuters the "safe directory" detection.
-		# bugs #838271, #838223
-		PATCHES+=(
-			"${FILESDIR}"/git-2.46.2-unsafe-directory.patch
-		)
-	fi
-
-	default
-}
-
-src_configure() {
-	local contrib=(
-		completion
-		subtree
-
-		$(usev perl 'contacts')
-	)
-	local credential_helpers=(
-		$(usev keyring 'libsecret')
-		$(usev perl 'netrc')
-	)
-
-	# Needs macOS Frameworks that can't currently be built with GCC.
-	if [[ ${CHOST} == *-darwin* ]] && tc-is-clang ; then
-		credential_helpers+=( osxkeychain )
-	fi
-
-	local native_file="${T}"/meson.ini.local
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	# We don't want to bake /usr/bin/sh from usrmerged systems into
-	# binaries. /bin/sh is required by POSIX.
-	sh='/bin/sh'
-	EOF
-
-	local emesonargs=(
-		--native-file "${native_file}"
-
-		$(meson_feature curl)
-		$(meson_feature cgi gitweb)
-		$(meson_feature webdav expat)
-		$(meson_feature iconv)
-		$(meson_feature nls gettext)
-		$(meson_feature pcre pcre2)
-		$(meson_feature perl)
-		$(meson_feature perforce python)
-		$(meson_use test tests)
-
-		-Dcontrib=$(IFS=, ; echo "${contrib[*]}" )
-		-Dcredential_helpers=$(IFS=, ; echo "${credential_helpers[*]}" )
-
-		-Dmacos_use_homebrew_gettext=false
-		-Dperl_cpan_fallback=false
-		# TODO: allow zlib-ng
-		-Dzlib_backend=zlib
-	)
-
-	[[ ${CHOST} == *-darwin* ]] && emesonargs+=( -Dfsmonitor=false )
-
-	# For non-live, we use a downloaded docs tarball instead.
-	if [[ ${PV} == *9999 ]] || use doc ; then
-		emesonargs+=(
-			-Ddocs="man$(usev doc ',html')"
-		)
-	fi
-
-	if [[ ${PV} != *9999 ]] ; then
-		# Non-live ebuilds download the sources from a tarball which does not
-		# include a .git directory.  Coccinelle assumes it exists and fails
-		# otherwise.
-		#
-		# Fixes https://bugs.gentoo.org/952004
-		emesonargs+=(
-			-Dcoccinelle=disabled
-		)
-	fi
-
-	meson_src_configure
-
-	if use tk ; then
-		(
-			EMESON_SOURCE="${S}"/gitk-git
-			BUILD_DIR="${WORKDIR}"/gitk-git_build
-			emesonargs=()
-			meson_src_configure
-		)
-	fi
-}
-
-git_emake() {
-	local mymakeargs=(
-		prefix="${EPREFIX}"/usr
-		htmldir="${EPREFIX}"/usr/share/doc/${PF}/html
-		sysconfdir="${EPREFIX}"/etc
-		perllibdir="$(use perl && perl_get_raw_vendorlib)"
-
-		CC="$(tc-getCC)"
-		CFLAGS="${CFLAGS}"
-		LDFLAGS="${LDFLAGS}"
-		PKG_CONFIG="$(tc-getPKG_CONFIG)"
-		OPTAR="$(tc-getAR)"
-		OPTCC="$(tc-getCC)"
-		OPTCFLAGS="${CFLAGS}"
-		OPTLDFLAGS="${LDFLAGS}"
-
-		PERL_PATH="${EPREFIX}/usr/bin/perl"
-		PERL_MM_OPT=""
-
-		V=1
-
-		"$@"
-	)
-
-	emake "${mymakeargs[@]}"
-}
-
-src_compile() {
-	meson_src_compile
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git
-	fi
-
-	if use tk ; then
-		git_emake -C git-gui
-
-		(
-			EMESON_SOURCE="${S}"/gitk-git
-			BUILD_DIR="${WORKDIR}"/gitk-git_build
-			meson_src_compile
-		)
-
-	fi
-
-	if use doc ; then
-		# Workaround fragments that still use the Makefile and can't
-		# find the bits from Meson's out-of-source build
-		ln -s "${BUILD_DIR}"/Documentation/asciidoc.conf "${S}"/Documentation/asciidoc.conf || die
-	fi
-
-	git_emake -C contrib/diff-highlight
-}
-
-src_test() {
-	# t0610-reftable-basics.sh uses $A
-	local -x A=
-
-	meson_src_test
-}
-
-src_install() {
-	meson_src_install
-
-	if use doc ; then
-		cp -r "${ED}"/usr/share/doc/git-doc/. "${ED}"/usr/share/doc/${PF}/html || die
-		rm -rf "${ED}"/usr/share/doc/git-doc/ || die
-	fi
-
-	# Depending on the tarball and manual rebuild of the documentation, the
-	# manpages may exist in either OR both of these directories.
-	find man?/*.[157] >/dev/null 2>&1 && doman man?/*.[157]
-	find Documentation/*.[157] >/dev/null 2>&1 && doman Documentation/*.[157]
-	dodoc README* Documentation/{SubmittingPatches,CodingGuidelines}
-
-	local d
-	for d in / /howto/ /technical/ ; do
-		docinto ${d}
-		dodoc Documentation${d}*.adoc
-	done
-	docinto /
-
-	newbashcomp contrib/completion/git-completion.bash ${PN}
-	bashcomp_alias git gitk
-	# Not really a bash-completion file (bug #477920)
-	# but still needed uncompressed (bug #507480)
-	insinto /usr/share/${PN}
-	doins contrib/completion/git-prompt.sh
-
-	#dobin contrib/fast-import/git-p4 # Moved upstream
-	#dodoc contrib/fast-import/git-p4.txt # Moved upstream
-	newbin contrib/fast-import/import-tars.perl import-tars
-	exeinto /usr/libexec/git-core/
-	newexe contrib/git-resurrect.sh git-resurrect
-
-	# diff-highlight
-	dobin contrib/diff-highlight/diff-highlight
-	newdoc contrib/diff-highlight/README README.diff-highlight
-
-	# git-jump
-	exeinto /usr/libexec/git-core/
-	doexe contrib/git-jump/git-jump
-	newdoc contrib/git-jump/README git-jump.txt
-
-	dodir /usr/share/${PN}/contrib
-	# The following are excluded:
-	# completion - installed above
-	# diff-highlight - done above
-	# emacs - removed upstream
-	# examples - these are stuff that is not used in Git anymore actually
-	# git-jump - done above
-	# gitview - installed above
-	# p4import - excluded because fast-import has a better one
-	# patches - stuff the Git guys made to go upstream to other places
-	# persistent-https - TODO
-	# mw-to-git - TODO
-	# subtree - built seperately
-	# svnimport - use git-svn
-	# thunderbird-patch-inline - fixes thunderbird
-	local contrib_objects=(
-		buildsystems
-		fast-import
-		hooks
-		remotes2config.sh
-		rerere-train.sh
-		stats
-		workdir
-	)
-	local i
-	for i in "${contrib_objects[@]}" ; do
-		cp -rf "${S}"/contrib/${i} "${ED}"/usr/share/${PN}/contrib || die "Failed contrib ${i}"
-	done
-
-	if use cgi ; then
-		# We used to install in /usr/share/${PN}/gitweb
-		# but upstream installs in /usr/share/gitweb
-		# so we will install a symlink and use their location for compat with other
-		# distros
-		dosym ../gitweb /usr/share/${PN}/gitweb
-
-		# INSTALL discusses configuration issues, not just installation
-		docinto /
-		newdoc  "${S}"/gitweb/INSTALL INSTALL.gitweb
-		newdoc  "${S}"/gitweb/README README.gitweb
-
-		for d in "${ED}"/usr/lib{,64}/perl5/ ; do
-			if [[ -d "${d}" ]] ; then
-				find "${d}" -name .packlist -delete || die
-			fi
-		done
-	else
-		rm -rf "${ED}"/usr/share/gitweb
-	fi
-
-	if use perl ; then
-		dodir "$(perl_get_vendorlib)"
-		mv "${ED}"/usr/share/perl5/Git.pm "${ED}/$(perl_get_vendorlib)" || die
-		mv "${ED}"/usr/share/perl5/Git "${ED}/$(perl_get_vendorlib)" || die
-	fi
-
-	if use mediawiki ; then
-		git_emake -C contrib/mw-to-git DESTDIR="${D}" install
-	fi
-
-	if ! use subversion ; then
-		rm -f "${ED}"/usr/libexec/git-core/git-svn \
-			"${ED}"/usr/share/man/man1/git-svn.1*
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}"/git-daemon.xinetd git-daemon
-	fi
-
-	if ! use prefix ; then
-		newinitd "${FILESDIR}"/git-daemon-r2.initd git-daemon
-		newconfd "${FILESDIR}"/git-daemon.confd git-daemon
-		systemd_newunit "${FILESDIR}/git-daemon_at-r1.service" "git-daemon@.service"
-		systemd_dounit "${FILESDIR}/git-daemon.socket"
-	fi
-
-	if use tk ; then
-		(
-			EMESON_SOURCE="${S}"/gitk-git
-			BUILD_DIR="${WORKDIR}"/gitk-git_build
-			meson_src_install
-		)
-
-		git_emake -C git-gui DESTDIR="${D}" install
-	fi
-
-	perl_delete_localpod
-
-	# Remove disabled linguas
-	# we could remove sources in src_prepare, but install does not
-	# handle missing locale dir well
-	rm_loc() {
-		if [[ -e "${ED}/usr/share/locale/${1}" ]] ; then
-			rm -r "${ED}/usr/share/locale/${1}" || die
-		fi
-	}
-	plocale_for_each_disabled_locale rm_loc
-}
-
-pkg_postinst() {
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		elog "Please read /usr/share/bash-completion/completions/git for Git bash command"
-		elog "completion."
-		elog "Please read /usr/share/git/git-prompt.sh for Git bash prompt"
-		elog "Note that the prompt bash code is now in that separate script"
-	fi
-
-	optfeature_header "Some scripts require additional dependencies:"
-	optfeature git-quiltimport dev-util/quilt
-	optfeature git-instaweb www-servers/lighttpd www-servers/apache www-servers/nginx
-}
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
index 95d485ab20..d93ae17234 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cargo.eclass
@@ -603,12 +603,12 @@ cargo_live_src_unpack() {
 	export CARGO_HOME="${ECARGO_REGISTRY_DIR}"
 
 	# Absence of quotes around offline arg is intentional, as cargo bails out if it encounters ''
-	einfo "cargo fetch ${offline:+--offline}"
-	cargo fetch ${offline:+--offline} || die #nowarn
+	einfo "${CARGO} fetch ${offline:+--offline}"
+	"${CARGO}" fetch ${offline:+--offline} || die #nowarn
 
 	# Let cargo copy all required crates to "${WORKDIR}" for offline use in later phases.
-	einfo "cargo vendor ${offline:+--offline} ${ECARGO_VENDOR}"
-	cargo vendor ${offline:+--offline} "${ECARGO_VENDOR}" || die #nowarn
+	einfo "${CARGO} vendor ${offline:+--offline} ${ECARGO_VENDOR}"
+	"${CARGO}" vendor ${offline:+--offline} "${ECARGO_VENDOR}" || die #nowarn
 
 	# Users may have git checkouts made by cargo.
 	# While cargo vendors the sources, it still needs git checkout to be present.
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
index 8079a5cb03..e1bad4cbd1 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: cmake.eclass
@@ -681,6 +681,19 @@ cmake-utils_src_make() {
 	die "cmake-utils_src_make is banned. Use cmake_build instead"
 }
 
+# @ECLASS_VARIABLE: CTEST_JOBS
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Maximum number of CTest jobs to run in parallel.  If unset, the value
+# will be determined from make options.
+
+# @ECLASS_VARIABLE: CTEST_LOADAVG
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Maximum load, over which no new jobs will be started by CTest.  Note
+# that unlike make, CTest will not start *any* jobs if the load
+# is exceeded.  If unset, the value will be determined from make options.
+
 # @FUNCTION: cmake_src_test
 # @DESCRIPTION:
 # Function for testing the package. Automatically detects the build type.
@@ -694,8 +707,9 @@ cmake_src_test() {
 	[[ -n ${TEST_VERBOSE} ]] && myctestargs+=( --extra-verbose --output-on-failure )
 	[[ -n ${CMAKE_SKIP_TESTS} ]] && myctestargs+=( -E '('$( IFS='|'; echo "${CMAKE_SKIP_TESTS[*]}")')'  )
 
-	set -- ctest -j "$(makeopts_jobs "${MAKEOPTS}" 999)" \
-		--test-load "$(makeopts_loadavg)" "${myctestargs[@]}" "$@"
+	set -- ctest -j "${CTEST_JOBS:-$(get_makeopts_jobs 999)}" \
+		--test-load "${CTEST_LOADAVG:-$(get_makeopts_loadavg)}" \
+		"${myctestargs[@]}" "$@"
 	echo "$@" >&2
 	if "$@" ; then
 		einfo "Tests succeeded."
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index a65dd3ef2a..e1672dd3c3 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: distutils-r1.eclass
@@ -137,6 +137,8 @@
 # - standalone - standalone build systems without external deps
 #   (used for bootstrapping).
 #
+# - uv-build - uv-build backend (using dev-python/uv)
+#
 # The variable needs to be set before the inherit line.  The eclass
 # adds appropriate build-time dependencies and verifies the value.
 #
@@ -151,6 +153,20 @@
 # files are found in ${BUILD_DIR}/install after python_install(), they
 # will be merged into ${D}.
 
+# @ECLASS_VARIABLE: DISTUTILS_UPSTREAM_PEP517
+# @DESCRIPTION:
+# Specifies the PEP517 build backend used upstream.  It is used
+# by the eclass to verify the correctness of DISTUTILS_USE_PEP517,
+# and matches DISTUTILS_USE_PEP517 by default.  However, it can be
+# overriden to workaround the eclass check, when it is desirable
+# to build the wheel using other backend than the one used upstream.
+#
+# Please note that even in packages using PEP621 metadata, there can
+# be subtle differences between the behavior of different PEP517 build
+# backends, for example regarding finding package files.  When using
+# this option, please make sure that the package is installed correctly.
+: "${DISTUTILS_UPSTREAM_PEP517:=${DISTUTILS_USE_PEP517}}"
+
 # @ECLASS_VARIABLE: DISTUTILS_USE_SETUPTOOLS
 # @DEFAULT_UNSET
 # @PRE_INHERIT
@@ -246,22 +262,23 @@ _distutils_set_globals() {
 		fi
 
 		bdep='
-			>=dev-python/gpep517-15[${PYTHON_USEDEP}]
+			>=dev-python/gpep517-16[${PYTHON_USEDEP}]
 		'
 		case ${DISTUTILS_USE_PEP517} in
 			flit)
 				bdep+='
-					>=dev-python/flit-core-3.9.0[${PYTHON_USEDEP}]
+					>=dev-python/flit-core-3.11.0[${PYTHON_USEDEP}]
 				'
 				;;
 			flit_scm)
 				bdep+='
+					>=dev-python/flit-core-3.11.0[${PYTHON_USEDEP}]
 					>=dev-python/flit-scm-1.7.0[${PYTHON_USEDEP}]
 				'
 				;;
 			hatchling)
 				bdep+='
-					>=dev-python/hatchling-1.21.1[${PYTHON_USEDEP}]
+					>=dev-python/hatchling-1.27.0[${PYTHON_USEDEP}]
 				'
 				;;
 			jupyter)
@@ -271,7 +288,7 @@ _distutils_set_globals() {
 				;;
 			maturin)
 				bdep+='
-					>=dev-util/maturin-1.7.4[${PYTHON_USEDEP}]
+					>=dev-util/maturin-1.8.2[${PYTHON_USEDEP}]
 				'
 				;;
 			no)
@@ -280,41 +297,46 @@ _distutils_set_globals() {
 				;;
 			meson-python)
 				bdep+='
-					>=dev-python/meson-python-0.15.0[${PYTHON_USEDEP}]
+					>=dev-python/meson-python-0.17.1[${PYTHON_USEDEP}]
 				'
 				;;
 			pbr)
 				bdep+='
-					>=dev-python/pbr-6.0.0[${PYTHON_USEDEP}]
+					>=dev-python/pbr-6.1.1[${PYTHON_USEDEP}]
 				'
 				;;
 			pdm-backend)
 				bdep+='
-					>=dev-python/pdm-backend-2.1.8[${PYTHON_USEDEP}]
+					>=dev-python/pdm-backend-2.4.3[${PYTHON_USEDEP}]
 				'
 				;;
 			poetry)
 				bdep+='
-					>=dev-python/poetry-core-1.9.0[${PYTHON_USEDEP}]
+					>=dev-python/poetry-core-2.1.1[${PYTHON_USEDEP}]
 				'
 				;;
 			scikit-build-core)
 				bdep+='
-					>=dev-python/scikit-build-core-0.9.4[${PYTHON_USEDEP}]
+					>=dev-python/scikit-build-core-0.10.7[${PYTHON_USEDEP}]
 				'
 				;;
 			setuptools)
 				bdep+='
-					>=dev-python/setuptools-69.0.3[${PYTHON_USEDEP}]
+					>=dev-python/setuptools-75.8.2[${PYTHON_USEDEP}]
 				'
 				;;
 			sip)
 				bdep+='
-					>=dev-python/sip-6.8.3[${PYTHON_USEDEP}]
+					>=dev-python/sip-6.10.0[${PYTHON_USEDEP}]
 				'
 				;;
 			standalone)
 				;;
+			uv-build)
+				bdep+='
+					dev-python/uv-build[${PYTHON_USEDEP}]
+				'
+				;;
 			*)
 				die "Unknown DISTUTILS_USE_PEP517=${DISTUTILS_USE_PEP517}"
 				;;
@@ -325,7 +347,7 @@ _distutils_set_globals() {
 			eqawarn "is enabled."
 		fi
 	else
-		local setuptools_dep='>=dev-python/setuptools-69.0.3[${PYTHON_USEDEP}]'
+		local setuptools_dep='>=dev-python/setuptools-75.8.2[${PYTHON_USEDEP}]'
 
 		case ${DISTUTILS_USE_SETUPTOOLS:-bdepend} in
 			no|manual)
@@ -501,7 +523,7 @@ distutils_enable_sphinx() {
 	_DISTUTILS_SPHINX_PLUGINS=( "${@}" )
 
 	local deps autodoc=1 d
-	deps=">=dev-python/sphinx-7.2.6[\${PYTHON_USEDEP}]"
+	deps=">=dev-python/sphinx-8.1.3[\${PYTHON_USEDEP}]"
 	for d; do
 		if [[ ${d} == --no-autodoc ]]; then
 			autodoc=
@@ -525,7 +547,7 @@ distutils_enable_sphinx() {
 			use doc || return 0
 
 			local p
-			for p in ">=dev-python/sphinx-7.2.6" \
+			for p in ">=dev-python/sphinx-8.1.3" \
 				"${_DISTUTILS_SPHINX_PLUGINS[@]}"
 			do
 				python_has_version "${p}[${PYTHON_USEDEP}]" ||
@@ -533,7 +555,7 @@ distutils_enable_sphinx() {
 			done
 		}
 	else
-		deps=">=dev-python/sphinx-7.2.6"
+		deps=">=dev-python/sphinx-8.1.3"
 	fi
 
 	sphinx_compile_all() {
@@ -904,6 +926,12 @@ _distutils-r1_print_package_versions() {
 					dev-python/sip
 				)
 				;;
+			uv-build)
+				packages+=(
+					dev-python/uv
+					dev-python/uv-build
+				)
+				;;
 		esac
 	else
 		case ${DISTUTILS_USE_SETUPTOOLS} in
@@ -1050,55 +1078,57 @@ _distutils-r1_copy_egg_info() {
 	find -name '*.egg-info' -type d -exec cp -R -p {} "${BUILD_DIR}"/ ';' || die
 }
 
-# @FUNCTION: _distutils-r1_backend_to_key
-# @USAGE: <backend>
+# @FUNCTION: _distutils-r1_key_to_backend
+# @USAGE: <key>
 # @INTERNAL
 # @DESCRIPTION:
-# Print the DISTUTILS_USE_PEP517 value corresponding to the backend
-# passed as the only argument.
-_distutils-r1_backend_to_key() {
+# Print the backend corresponding to the DISTUTILS_USE_PEP517 value.
+_distutils-r1_key_to_backend() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	local backend=${1}
-	case ${backend} in
-		flit_core.buildapi|flit.buildapi)
-			echo flit
+	local key=${1}
+	case ${key} in
+		flit)
+			echo flit_core.buildapi
 			;;
-		flit_scm:buildapi)
-			echo flit_scm
+		flit_scm)
+			echo flit_scm:buildapi
 			;;
-		hatchling.build)
-			echo hatchling
+		hatchling)
+			echo hatchling.build
 			;;
-		jupyter_packaging.build_api)
-			echo jupyter
+		jupyter)
+			echo jupyter_packaging.build_api
 			;;
 		maturin)
 			echo maturin
 			;;
-		mesonpy)
-			echo meson-python
+		meson-python)
+			echo mesonpy
 			;;
-		pbr.build)
-			echo pbr
+		pbr)
+			echo pbr.build
 			;;
-		pdm.backend|pdm.pep517.api)
-			echo pdm-backend
+		pdm-backend)
+			echo pdm.backend
 			;;
-		poetry.core.masonry.api|poetry.masonry.api)
-			echo poetry
+		poetry)
+			echo poetry.core.masonry.api
 			;;
-		scikit_build_core.build)
-			echo scikit-build-core
+		scikit-build-core)
+			echo scikit_build_core.build
 			;;
-		setuptools.build_meta|setuptools.build_meta:__legacy__)
-			echo setuptools
+		setuptools)
+			echo setuptools.build_meta
 			;;
-		sipbuild.api)
-			echo sip
+		sip)
+			echo sipbuild.api
+			;;
+		uv-build)
+			echo uv_build
 			;;
 		*)
-			die "Unknown backend: ${backend}"
+			die "Unknown DISTUTILS_USE_PEP517 key: ${key}"
 			;;
 	esac
 }
@@ -1111,65 +1141,61 @@ _distutils-r1_backend_to_key() {
 _distutils-r1_get_backend() {
 	debug-print-function ${FUNCNAME} "$@"
 
-	local build_backend legacy_fallback
+	local build_backend
 	if [[ -f pyproject.toml ]]; then
 		# if pyproject.toml exists, try getting the backend from it
 		# NB: this could fail if pyproject.toml doesn't list one
 		build_backend=$("${EPYTHON}" -m gpep517 get-backend)
 	fi
-	if [[ -z ${build_backend} && ${DISTUTILS_USE_PEP517} == setuptools &&
-		-f setup.py ]]
-	then
-		# use the legacy setuptools backend as a fallback
-		build_backend=setuptools.build_meta:__legacy__
-		legacy_fallback=1
-	fi
 	if [[ -z ${build_backend} ]]; then
-		die "Unable to obtain build-backend from pyproject.toml"
+		if [[ ${DISTUTILS_USE_PEP517} == setuptools && -f setup.py ]]
+		then
+			# use the legacy setuptools backend as a fallback
+			echo setuptools.build_meta:__legacy__
+			return
+		else
+			die "Unable to obtain build-backend from pyproject.toml"
+		fi
 	fi
 
-	if [[ ${DISTUTILS_USE_PEP517} != standalone ]]; then
-		# verify whether DISTUTILS_USE_PEP517 was set correctly
-		local expected_value=$(_distutils-r1_backend_to_key "${build_backend}")
-		if [[ ${DISTUTILS_USE_PEP517} != ${expected_value} ]]; then
-			eerror "DISTUTILS_USE_PEP517 does not match pyproject.toml!"
-			eerror "    have: DISTUTILS_USE_PEP517=${DISTUTILS_USE_PEP517}"
-			eerror "expected: DISTUTILS_USE_PEP517=${expected_value}"
-			eerror "(backend: ${build_backend})"
-			die "DISTUTILS_USE_PEP517 value incorrect"
-		fi
+	if [[ ${DISTUTILS_USE_PEP517} == standalone ]]; then
+		echo "${build_backend}"
+		return
+	fi
 
-		# fix deprecated backends up
-		local new_backend=
+	# verify that the ebuild correctly specifies the build backend
+	local expected_backend=$(_distutils-r1_key_to_backend "${DISTUTILS_UPSTREAM_PEP517}")
+	if [[ ${expected_backend} != ${build_backend} ]]; then
+		# special-case deprecated backends
 		case ${build_backend} in
 			flit.buildapi)
-				new_backend=flit_core.buildapi
 				;;
 			pdm.pep517.api)
-				new_backend=pdm.backend
 				;;
 			poetry.masonry.api)
-				new_backend=poetry.core.masonry.api
 				;;
 			setuptools.build_meta:__legacy__)
-				# this backend should only be used as implicit fallback
-				[[ ! ${legacy_fallback} ]] &&
-					new_backend=setuptools.build_meta
 				;;
+			uv)
+				;;
+			*)
+				eerror "DISTUTILS_UPSTREAM_PEP517 does not match pyproject.toml!"
+				eerror "  DISTUTILS_UPSTREAM_PEP517=${DISTUTILS_USE_PEP517}"
+				eerror "  implies backend: ${expected_backend}"
+				eerror "   pyproject.toml: ${build_backend}"
+				die "DISTUTILS_USE_PEP517 value incorrect"
 		esac
 
-		if [[ -n ${new_backend} ]]; then
-			if [[ ! -f ${T}/.distutils_deprecated_backend_warned ]]; then
-				eqawarn "${build_backend} backend is deprecated.  Please see:"
-				eqawarn "https://projects.gentoo.org/python/guide/qawarn.html#deprecated-pep-517-backends"
-				eqawarn "The eclass will be using ${new_backend} instead."
-				> "${T}"/.distutils_deprecated_backend_warned || die
-			fi
-			build_backend=${new_backend}
+		# if we didn't die, we're dealing with a deprecated backend
+		if [[ ! -f ${T}/.distutils_deprecated_backend_warned ]]; then
+			eqawarn "${build_backend} backend is deprecated.  Please see:"
+			eqawarn "https://projects.gentoo.org/python/guide/qawarn.html#deprecated-pep-517-backends"
+			eqawarn "The project should use ${expected_backend} instead."
+			> "${T}"/.distutils_deprecated_backend_warned || die
 		fi
 	fi
 
-	echo "${build_backend}"
+	echo "$(_distutils-r1_key_to_backend "${DISTUTILS_USE_PEP517}")"
 }
 
 # @FUNCTION: distutils_wheel_install
@@ -1220,6 +1246,8 @@ distutils_wheel_install() {
 		-o -path '*.dist-info/licenses' \
 		-o -path '*.dist-info/zip-safe' \
 		\) -delete || die
+
+	_DISTUTILS_WHL_INSTALLED=1
 }
 
 # @VARIABLE: DISTUTILS_WHEEL_PATH
@@ -1258,6 +1286,7 @@ distutils_pep517_install() {
 	fi
 
 	# set it globally in case we were using "standalone" wrapper
+	local -x FLIT_ALLOW_INVALID=1
 	local -x HATCH_METADATA_CLASSIFIERS_NO_VERIFY=1
 	local -x VALIDATE_PYPROJECT_NO_NETWORK=1
 	local -x VALIDATE_PYPROJECT_NO_TROVE_CLASSIFIERS=1
@@ -1457,67 +1486,66 @@ distutils-r1_python_compile() {
 
 	_python_check_EPYTHON
 
-	case ${DISTUTILS_USE_PEP517:-unset} in
-		no)
-			return
-			;;
-		unset)
-			# legacy mode
-			_distutils-r1_copy_egg_info
-			esetup.py build -j "$(makeopts_jobs "${MAKEOPTS} ${*}")" "${@}"
-			;;
-		*)
-			# we do this for all build systems, since other backends
-			# and custom hooks may wrap setuptools
-			mkdir -p "${BUILD_DIR}" || die
-			local -x DIST_EXTRA_CONFIG="${BUILD_DIR}/extra-setup.cfg"
-			cat > "${DIST_EXTRA_CONFIG}" <<-EOF || die
-				[build]
-				build_base = ${BUILD_DIR}/build
+	[[ ${DISTUTILS_USE_PEP517} == no ]] && return
 
-				[build_ext]
-				parallel = $(makeopts_jobs "${MAKEOPTS} ${*}")
-			EOF
-			;;
-	esac
-
-	if [[ ${DISTUTILS_USE_PEP517} ]]; then
-		if [[ ${DISTUTILS_ALLOW_WHEEL_REUSE} ]]; then
-			local whl
-			for whl in "${!DISTUTILS_WHEELS[@]}"; do
-				# use only wheels corresponding to the current directory
-				if [[ ${PWD} != ${DISTUTILS_WHEELS["${whl}"]} ]]; then
-					continue
-				fi
-
-				# 1. Use pure Python wheels only if we're not expected
-				# to build extensions.  Otherwise, we may end up
-				# not building the extension at all when e.g. PyPy3
-				# is built without one.
-				#
-				# 2. For CPython, we can reuse stable ABI wheels.  Note
-				# that this relies on the assumption that we're building
-				# from the oldest to the newest implementation,
-				# and the wheels are forward-compatible.
-				if [[
-					( ! ${DISTUTILS_EXT} && ${whl} == *py3-none-any* ) ||
-					(
-						${EPYTHON} == python* &&
-						# freethreading does not support stable ABI
-						# at the moment
-						${EPYTHON} != *t &&
-						${whl} == *-abi3-*
-					)
-				]]; then
-					distutils_wheel_install "${BUILD_DIR}/install" "${whl}"
-					return
-				fi
-			done
-		fi
-
-		distutils_pep517_install "${BUILD_DIR}/install"
-		DISTUTILS_WHEELS+=( "${DISTUTILS_WHEEL_PATH}" "${PWD}" )
+	if [[ ! ${DISTUTILS_USE_PEP517} ]]; then
+		# legacy mode
+		_distutils-r1_copy_egg_info
+		esetup.py build -j "$(makeopts_jobs "${MAKEOPTS} ${*}")" "${@}"
+		return
 	fi
+
+	# we do this for all build systems, since other backends
+	# and custom hooks may wrap setuptools
+	#
+	# we are appending a dynamic component so that
+	# distutils-r1_python_compile can be called multiple
+	# times and don't end up combining resulting packages
+	mkdir -p "${BUILD_DIR}" || die
+	local -x DIST_EXTRA_CONFIG="${BUILD_DIR}/extra-setup.cfg"
+	cat > "${DIST_EXTRA_CONFIG}" <<-EOF || die
+		[build]
+		build_base = ${BUILD_DIR}/build${#DISTUTILS_WHEELS[@]}
+
+		[build_ext]
+		parallel = $(makeopts_jobs "${MAKEOPTS} ${*}")
+	EOF
+
+	if [[ ${DISTUTILS_ALLOW_WHEEL_REUSE} ]]; then
+		local whl
+		for whl in "${!DISTUTILS_WHEELS[@]}"; do
+			# use only wheels corresponding to the current directory
+			if [[ ${PWD} != ${DISTUTILS_WHEELS["${whl}"]} ]]; then
+				continue
+			fi
+
+			# 1. Use pure Python wheels only if we're not expected
+			# to build extensions.  Otherwise, we may end up
+			# not building the extension at all when e.g. PyPy3
+			# is built without one.
+			#
+			# 2. For CPython, we can reuse stable ABI wheels.  Note
+			# that this relies on the assumption that we're building
+			# from the oldest to the newest implementation,
+			# and the wheels are forward-compatible.
+			if [[
+				( ! ${DISTUTILS_EXT} && ${whl} == *py3-none-any* ) ||
+				(
+					${EPYTHON} == python* &&
+					# freethreading does not support stable ABI
+					# at the moment
+					${EPYTHON} != *t &&
+					${whl} == *-abi3-*
+				)
+			]]; then
+				distutils_wheel_install "${BUILD_DIR}/install" "${whl}"
+				return
+			fi
+		done
+	fi
+
+	distutils_pep517_install "${BUILD_DIR}/install"
+	DISTUTILS_WHEELS+=( "${DISTUTILS_WHEEL_PATH}" "${PWD}" )
 }
 
 # @FUNCTION: _distutils-r1_wrap_scripts
@@ -1985,6 +2013,11 @@ _distutils-r1_compare_installed_files() {
 _distutils-r1_post_python_compile() {
 	debug-print-function ${FUNCNAME} "$@"
 
+	if [[ ! ${_DISTUTILS_WHL_INSTALLED} && ${DISTUTILS_USE_PEP517:-no} != no ]]
+	then
+		die "No wheel installed in python_compile(), did you call distutils-r1_python_compile?"
+	fi
+
 	local root=${BUILD_DIR}/install
 	if [[ ${DISTUTILS_USE_PEP517} && -d ${root} ]]; then
 		# copy executables to python-exec directory
diff --git a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
index a9ccfed4cf..ae590284db 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rust.eclass
@@ -68,7 +68,7 @@ fi
 # Definitive list of Rust slots and the associated LLVM slot, newest first.
 declare -A -g -r _RUST_LLVM_MAP=(
 	["9999"]=20
-	["1.86.0"]=19
+	["1.86"]=19
 	["1.85.1"]=19
 	["1.85.0"]=19
 	["1.84.1"]=19
@@ -94,7 +94,7 @@ declare -A -g -r _RUST_LLVM_MAP=(
 # this array is used to store the Rust slots in a more convenient order for iteration.
 declare -a -g -r _RUST_SLOTS_ORDERED=(
 	"9999"
-	"1.86.0"
+	"1.86"
 	"1.85.1"
 	"1.85.0"
 	"1.84.1"
diff --git a/sdk_container/src/third_party/portage-stable/licenses/MIT-with-advertising b/sdk_container/src/third_party/portage-stable/licenses/MIT-with-advertising
index d99348e079..03be995a51 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/MIT-with-advertising
+++ b/sdk_container/src/third_party/portage-stable/licenses/MIT-with-advertising
@@ -1,20 +1,23 @@
-Copyright (C) <year> <copyright holders>
+Copyright (c) <year> <copyright holders>
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to
-deal in the Software without restriction, including without limitation the
-rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-sell copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
 
-The above copyright notice and this permission notice shall be included in
-all copies of the Software, its documentation and marketing & publicity
-materials, and acknowledgment shall be given in the documentation, materials
-and software packages that this Software was used.
+The above copyright notice and this permission notice shall be
+included in all copies of the Software, its documentation and
+marketing & publicity materials, and acknowledgment shall be given
+in the documentation, materials and software packages that
+this Software was used.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
-IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
-CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
diff --git a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.10.ebuild b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.10.ebuild
index 3019838c4c..64897a321e 100644
--- a/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dialup/minicom/minicom-2.10.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://salsa.debian.org/${PN}-team/${PN}/-/archive/${PV}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="nls"
 
 DEPEND="sys-libs/ncurses:="
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
index 6afce3ebf9..630ce74245 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/Manifest
@@ -1,8 +1,3 @@
-DIST bind-9.16.48.tar.xz 5131176 BLAKE2B 4a503b45df412c435cb0f75b54ee1270140cccce7ecc159cdf3e0e3cbd3c0a0866b7472782f20aacf130f57df12d20a102ac6979498138ce00a2655806d003e7 SHA512 83829a5045e2a29dd2b491d3ab72b545f5664023fcd4aa205a44dbb7bcc5c737b4466c0d73f124b8d88fd33c56776871a07dde1ba0530d43eec8e7304a08d353
-DIST bind-9.16.48.tar.xz.asc 833 BLAKE2B 740ed58863ed3a7dee6ada4edd03cad5378ea0aa53cd6f071ca1911bb2d6b285ed292f32846790d42b97e8d9bb72588f1cd30c4e10557ac1e9f1df545923a9b1 SHA512 7bd813b5ab6f9677fc4ef21e0c3930f6319fa6c49d6869570794bc28212fe8935b72f9f217cfce692a2dec9ec29994f345d1b1145cef1ca976c5361f6ce0f75d
-DIST bind-9.16.50.tar.xz 5134620 BLAKE2B 0464d1e246d0a5c39e20faf733b7f4ee21d192cc0ccce5bba2a22ae4303c82005ccfb319fe2da51872c7258852a747984d7327c70dec08414ab2d194c412199b SHA512 7627e0606ac389343046fa9d1ca789ed732b3c8d99e83ba6f59593f816cebc0b2ebd319c2812ac1f604c68f5115bbc281d432036c0d31bbe489ee2d678374213
-DIST bind-9.16.50.tar.xz.asc 833 BLAKE2B 7eabf67b96d1fc94ec096adf1b4d075c370b603b7225522fe5b97d04c519f68f017fe0ccaf7ddeff029d17c0b4c3932a09f009376553f987671ba21f6b9cdb7d SHA512 0650ad5d55da2d9fe848d68aa59b16998b781152209ebcaabaea68144dab75ff9f4cfcceaa87a6b6da4f2f98fcf6f9eddd16d19ddf958fef242d93da03516dbc
 DIST bind-9.18.29.tar.xz 5562720 BLAKE2B f3e7de6936362bcce4993e401ed8fdd9d597459e82ad908a918fff1da619f91ef4896595ea210b43f2b492d763d7be2b71105495858da55431b60874c7fd2312 SHA512 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716
 DIST bind-9.18.31.tar.xz 5385812 BLAKE2B e069ab3caab887a87220b54804e5b19a4c21b8d3e4e8f1bc6a7135b3990a228d6c48b1ca4a22c75242485275eff1de145a9aff89addf81124e7dfcafd8ab30cf SHA512 e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034
 DIST bind-9.20.7.tar.xz 5655168 BLAKE2B c5198939382e7295b4dfcb2ddbd86e5bccc10047d5e963dab2381404eb7a14543218e3caa438b395a2982cb607da84012f3a76a41c790a48ed615238bc080b5c SHA512 b9570c0c6588819108017d30dc7fb5e2f34361f941186d29da3d2830bbe3333c8c16bdb6581f5bec4786d90b74db860a9cad5f66d4f1c65168eae69f401a9df0
-DIST dyndns-samples.tbz2 22866 BLAKE2B 409890653c6536cb9c0e3ba809d2bfde0e0ae73a2a101b4f229b46c01568466bc022bbbc37712171adbd08c572733e93630feab95a0fcd1ac50a7d37da1d1108 SHA512 83b0bf99f8e9ff709e8e9336d8c5231b98a4b5f0c60c10792f34931e32cc638d261967dfa5a83151ec3740977d94ddd6e21e9ce91267b3e279b88affdbc18cac
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.48.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.48.ebuild
deleted file mode 100644
index ecea29f9b8..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.48.ebuild
+++ /dev/null
@@ -1,398 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
-inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles verify-sig
-
-MY_PV="${PV/_p/-P}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-
-RRL_PV="${MY_PV}"
-
-# SDB-LDAP: http://bind9-ldap.bayour.com/
-
-DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="
-	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
-	doc? ( mirror://gentoo/dyndns-samples.tbz2 )
-	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-# -berkdb by default re bug #602682
-IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi"
-IUSE+=" json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
-RESTRICT="!test? ( test )"
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mysql? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	acct-group/named
-	acct-user/named
-	dev-libs/libuv:=
-	berkdb? ( sys-libs/db:= )
-	dev-libs/openssl:=[-bindist(-)]
-	mysql? ( dev-db/mysql-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap:= )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
-	geoip? ( dev-libs/libmaxminddb:= )
-	geoip2? ( dev-libs/libmaxminddb:= )
-	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
-	lmdb? ( dev-db/lmdb:= )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c:= )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-"
-RDEPEND="
-	${DEPEND}
-	sys-process/psmisc
-	selinux? ( sec-policy/selinux-bind )
-"
-BDEPEND="
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-	verify-sig? ( sec-keys/openpgp-keys-isc )
-"
-
-PATCHES=(
-	"${FILESDIR}/ldap-library-path-on-multilib-machines.patch"
-)
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	default
-
-	# Should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# Slow tests
-	sed -i "s/{name='mem_test'}/{name='mem_test',timeout=900}/" "lib/isc/tests/Kyuafile" || die
-	sed -i "s/{name='timer_test'}/{name='timer_test',timeout=900}/" "lib/isc/tests/Kyuafile" || die
-
-	# Conditionally broken
-	use sparc && ( sed -i "/{name='netmgr_test'}/d" "lib/isc/tests/Kyuafile" || die )
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
-
-	use python && python_copy_sources
-}
-
-src_configure() {
-	bind_configure --without-python
-	use python && python_foreach_impl python_configure
-}
-
-bind_configure() {
-	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
-		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
-		--with-libtool
-		--enable-full-report
-		--without-readline
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with test cmocka)
-		# Removed in 9.17, drags in libunwind dependency too
-		--disable-backtrace
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
-		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with berkdb dlz-bdb "${ESYSROOT}"/usr)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
-		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mysql dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
-		$(use_with lmdb)
-		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
-	)
-
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# bug #158664
-	#gcc-specs-ssp && replace-flags -O[23s] -O
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
-
-	export BUILD_CC=$(tc-getBUILD_CC)
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-python_configure() {
-	pushd "${BUILD_DIR}" >/dev/null || die
-	bind_configure --with-python
-	popd >/dev/null || die
-}
-
-src_compile() {
-	default
-	use python && python_foreach_impl python_compile
-}
-
-python_compile() {
-	emake -C "${BUILD_DIR}"/bin/python
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake -Onone unit
-}
-
-src_install() {
-	default
-
-	dodoc CHANGES README
-
-	if use doc; then
-		docinto misc
-		dodoc -r doc/misc/
-
-		# might a 'html' useflag make sense?
-		docinto html
-		dodoc -r doc/arm/
-
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
-
-		# some handy-dandy dynamic dns examples
-		pushd "${ED}"/usr/share/doc/${PF} 1>/dev/null || die
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
-		popd 1>/dev/null || die
-	fi
-
-	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-
-	# ftp://ftp.rs.internic.net/domain/named.cache:
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r4 named.cache
-
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-
-	newinitd "${FILESDIR}"/named.init-r14 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-
-	newenvd "${FILESDIR}"/10bind.env 10bind
-
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
-	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-	revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
-
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	use python && python_foreach_impl python_install
-
-	# bug 450406
-	dosym named.cache /var/bind/root.cache
-
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
-	keepdir /var/bind/{pri,sec,dyn} /var/log/named
-
-	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0750 /etc/bind /var/bind/pri
-	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
-
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
-	dotmpfiles "${FILESDIR}"/named.conf
-	exeinto /usr/libexec
-	doexe "${FILESDIR}/generate-rndc-key.sh"
-}
-
-python_install() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_doscript dnssec-{checkds,coverage}
-	python_optimize
-	popd >/dev/null || die
-}
-
-pkg_postinst() {
-	tmpfiles_process named.conf
-
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		einfo "Using /dev/urandom for generating rndc.key"
-		/usr/sbin/rndc-confgen -a
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
-	fi
-
-	einfo
-	einfo "You can edit /etc/conf.d/named to customize named settings"
-	einfo
-	use mysql || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
-	einfo "If you'd like to run bind in a chroot AND this is a new"
-	einfo "install OR your bind doesn't already run in a chroot:"
-	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
-	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
-	einfo
-
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
-	if [[ -n ${CHROOT} ]]; then
-		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		elog "To enable the old behaviour (without using mount) uncomment the"
-		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		elog "If you decide to use the new/default method, ensure to make backup"
-		elog "first and merge your existing configs/zones to /etc/bind and"
-		elog "/var/bind because bind will now mount the needed directories into"
-		elog "the chroot dir."
-	fi
-}
-
-pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
-
-	if [[ -z "${CHROOT}" ]]; then
-		eerror "This config script is designed to automate setting up"
-		eerror "a chrooted bind/named. To do so, please first uncomment"
-		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
-		die "Unset CHROOT"
-	fi
-	if [[ -d "${CHROOT}" ]]; then
-		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		ewarn "To enable the old behaviour (without using mount) uncomment the"
-		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		ewarn
-		ewarn "${CHROOT} already exists... some things might become overridden"
-		ewarn "press CTRL+C if you don't want to continue"
-		sleep 10
-	fi
-
-	echo; einfo "Setting up the chroot directory..."
-
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
-
-	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
-		|| die
-
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
-
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
-
-	mknod ${CHROOT}/dev/urandom c 1 9 || die
-	chmod 0666 ${CHROOT}/dev/urandom || die
-
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
-		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
-		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
-		fi
-	fi
-
-	elog "You may need to add the following line to your syslog-ng.conf:"
-	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.50.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.50.ebuild
deleted file mode 100644
index 2bd38cc304..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/bind-9.16.50.ebuild
+++ /dev/null
@@ -1,398 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# Re dlz/mysql and threads, needs to be verified..
-# MySQL uses thread local storage in its C api. Thus MySQL
-# requires that each thread of an application execute a MySQL
-# thread initialization to setup the thread local storage.
-# This is impossible to do safely while staying within the DLZ
-# driver API. This is a limitation caused by MySQL, and not the DLZ API.
-# Because of this BIND MUST only run with a single thread when
-# using the MySQL driver.
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{10..12} )
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/isc.asc
-inherit python-r1 autotools multiprocessing toolchain-funcs flag-o-matic db-use systemd tmpfiles verify-sig
-
-MY_PV="${PV/_p/-P}"
-MY_PV="${MY_PV/_rc/rc}"
-MY_P="${PN}-${MY_PV}"
-
-SDB_LDAP_VER="1.1.0-fc14"
-
-RRL_PV="${MY_PV}"
-
-# SDB-LDAP: http://bind9-ldap.bayour.com/
-
-DESCRIPTION="Berkeley Internet Name Domain - Name Server"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="
-	https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz
-	doc? ( mirror://gentoo/dyndns-samples.tbz2 )
-	verify-sig? ( https://downloads.isc.org/isc/bind9/${PV}/${P}.tar.xz.asc )
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-# -berkdb by default re bug #602682
-IUSE="berkdb +caps +dlz dnstap doc dnsrps fixed-rrset geoip geoip2 gssapi"
-IUSE+=" json ldap lmdb mysql odbc postgres python selinux static-libs test xml +zlib"
-# sdb-ldap - patch broken
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
-RESTRICT="!test? ( test )"
-
-# Upstream dropped the old geoip library, but the BIND configuration for using
-# GeoIP remained the same.
-REQUIRED_USE="
-	postgres? ( dlz )
-	berkdb? ( dlz )
-	mysql? ( dlz )
-	odbc? ( dlz )
-	ldap? ( dlz )
-	dnsrps? ( dlz )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DEPEND="
-	acct-group/named
-	acct-user/named
-	dev-libs/libuv:=
-	berkdb? ( sys-libs/db:= )
-	dev-libs/openssl:=[-bindist(-)]
-	mysql? ( dev-db/mysql-connector-c:0= )
-	odbc? ( >=dev-db/unixODBC-2.2.6 )
-	ldap? ( net-nds/openldap:= )
-	postgres? ( dev-db/postgresql:= )
-	caps? ( >=sys-libs/libcap-2.1.0 )
-	xml? ( dev-libs/libxml2 )
-	geoip? ( dev-libs/libmaxminddb:= )
-	geoip2? ( dev-libs/libmaxminddb:= )
-	gssapi? ( virtual/krb5 )
-	json? ( dev-libs/json-c:= )
-	lmdb? ( dev-db/lmdb:= )
-	zlib? ( sys-libs/zlib )
-	dnstap? ( dev-libs/fstrm dev-libs/protobuf-c:= )
-	python? (
-		${PYTHON_DEPS}
-		dev-python/ply[${PYTHON_USEDEP}]
-	)
-"
-RDEPEND="
-	${DEPEND}
-	sys-process/psmisc
-	selinux? ( sec-policy/selinux-bind )
-"
-BDEPEND="
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-	verify-sig? ( sec-keys/openpgp-keys-isc )
-"
-
-PATCHES=(
-	"${FILESDIR}/ldap-library-path-on-multilib-machines.patch"
-)
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	default
-
-	# Should be installed by bind-tools
-	sed -i -r -e "s:(nsupdate|dig|delv) ::g" bin/Makefile.in || die
-
-	# Slow tests
-	sed -i "s/{name='mem_test'}/{name='mem_test',timeout=900}/" "lib/isc/tests/Kyuafile" || die
-	sed -i "s/{name='timer_test'}/{name='timer_test',timeout=900}/" "lib/isc/tests/Kyuafile" || die
-
-	# Conditionally broken
-	use sparc && ( sed -i "/{name='netmgr_test'}/d" "lib/isc/tests/Kyuafile" || die )
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-	eautoreconf
-
-	use python && python_copy_sources
-}
-
-src_configure() {
-	bind_configure --without-python
-	use python && python_foreach_impl python_configure
-}
-
-bind_configure() {
-	local myeconfargs=(
-		AR="$(type -P $(tc-getAR))"
-		--prefix="${EPREFIX}"/usr
-		--sysconfdir=/etc/bind
-		--localstatedir=/var
-		--with-libtool
-		--enable-full-report
-		--without-readline
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with test cmocka)
-		# Removed in 9.17, drags in libunwind dependency too
-		--disable-backtrace
-		$(use_enable caps linux-caps)
-		$(use_enable dnsrps)
-		$(use_enable dnstap)
-		$(use_enable fixed-rrset)
-		$(use_with berkdb dlz-bdb "${ESYSROOT}"/usr)
-		$(use_with dlz dlopen)
-		$(use_with dlz dlz-filesystem)
-		$(use_with dlz dlz-stub)
-		$(use_with gssapi)
-		$(use_with json json-c)
-		$(use_with ldap dlz-ldap)
-		$(use_with mysql dlz-mysql)
-		$(use_with odbc dlz-odbc)
-		$(use_with postgres dlz-postgres)
-		$(use_with lmdb)
-		$(use_with xml libxml2)
-		$(use_with zlib)
-		"${@}"
-	)
-
-	# This is for users to start to migrate back to USE=geoip, rather than
-	# USE=geoip2
-	if use geoip ; then
-		myeconfargs+=( $(use_with geoip maxminddb) --enable-geoip )
-	elif use geoip2 ; then
-		# Added 2020/09/30
-		# Remove USE=geoip2 support after 2020/03/01
-		ewarn "USE=geoip2 is deprecated; update your USE flags!"
-		myeconfargs+=( $(use_with geoip2 maxminddb) --enable-geoip )
-	else
-		myeconfargs+=( --without-maxminddb --disable-geoip )
-	fi
-
-	# bug #158664
-	#gcc-specs-ssp && replace-flags -O[23s] -O
-
-	# To include db.h from proper path
-	use berkdb && append-flags "-I$(db_includedir)"
-
-	export BUILD_CC=$(tc-getBUILD_CC)
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-python_configure() {
-	pushd "${BUILD_DIR}" >/dev/null || die
-	bind_configure --with-python
-	popd >/dev/null || die
-}
-
-src_compile() {
-	default
-	use python && python_foreach_impl python_compile
-}
-
-python_compile() {
-	emake -C "${BUILD_DIR}"/bin/python
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake -Onone unit
-}
-
-src_install() {
-	default
-
-	dodoc CHANGES README
-
-	if use doc; then
-		docinto misc
-		dodoc -r doc/misc/
-
-		# might a 'html' useflag make sense?
-		docinto html
-		dodoc -r doc/arm/
-
-		docinto contrib
-		dodoc contrib/scripts/{nanny.pl,named-bootconf.sh}
-
-		# some handy-dandy dynamic dns examples
-		pushd "${ED}"/usr/share/doc/${PF} 1>/dev/null || die
-		tar xf "${DISTDIR}"/dyndns-samples.tbz2 || die
-		popd 1>/dev/null || die
-	fi
-
-	insinto /etc/bind
-	newins "${FILESDIR}"/named.conf-r8 named.conf
-
-	# ftp://ftp.rs.internic.net/domain/named.cache:
-	insinto /var/bind
-	newins "${FILESDIR}"/named.cache-r4 named.cache
-
-	insinto /var/bind/pri
-	newins "${FILESDIR}"/localhost.zone-r3 localhost.zone
-
-	newinitd "${FILESDIR}"/named.init-r14 named
-	newconfd "${FILESDIR}"/named.confd-r7 named
-
-	newenvd "${FILESDIR}"/10bind.env 10bind
-
-	# Let's get rid of those tools and their manpages since they're provided by bind-tools
-	rm -f "${ED}"/usr/share/man/man1/{dig,host,nslookup,delv,nsupdate}.1* || die
-	rm -f "${ED}"/usr/share/man/man8/nsupdate.8* || die
-	rm -f "${ED}"/usr/bin/{dig,host,nslookup,nsupdate} || die
-	rm -f "${ED}"/usr/sbin/{dig,host,nslookup,nsupdate} || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-	revoke settime signzone verify; do
-		rm -f "${ED}"/usr/{,s}bin/dnssec-"${tool}" || die
-		rm -f "${ED}"/usr/share/man/man8/dnssec-"${tool}".8* || die
-	done
-
-	# bug 405251, library archives aren't properly handled by --enable/disable-static
-	if ! use static-libs; then
-		find "${ED}" -type f -name '*.a' -delete || die
-	fi
-
-	# bug 405251
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	use python && python_foreach_impl python_install
-
-	# bug 450406
-	dosym named.cache /var/bind/root.cache
-
-	dosym ../../var/bind/pri /etc/bind/pri
-	dosym ../../var/bind/sec /etc/bind/sec
-	dosym ../../var/bind/dyn /etc/bind/dyn
-	keepdir /var/bind/{pri,sec,dyn} /var/log/named
-
-	fowners root:named /{etc,var}/bind /var/log/named /var/bind/{sec,pri,dyn}
-	fowners root:named /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0640 /var/bind/named.cache /var/bind/pri/localhost.zone /etc/bind/{bind.keys,named.conf}
-	fperms 0750 /etc/bind /var/bind/pri
-	fperms 0770 /var/log/named /var/bind/{,sec,dyn}
-
-	systemd_newunit "${FILESDIR}/named.service-r1" named.service
-	dotmpfiles "${FILESDIR}"/named.conf
-	exeinto /usr/libexec
-	doexe "${FILESDIR}/generate-rndc-key.sh"
-}
-
-python_install() {
-	pushd "${BUILD_DIR}"/bin/python >/dev/null || die
-	emake DESTDIR="${D}" install
-	python_scriptinto /usr/sbin
-	python_doscript dnssec-{checkds,coverage}
-	python_optimize
-	popd >/dev/null || die
-}
-
-pkg_postinst() {
-	tmpfiles_process named.conf
-
-	if [[ ! -f '/etc/bind/rndc.key' && ! -f '/etc/bind/rndc.conf' ]]; then
-		einfo "Using /dev/urandom for generating rndc.key"
-		/usr/sbin/rndc-confgen -a
-		chown root:named /etc/bind/rndc.key || die
-		chmod 0640 /etc/bind/rndc.key || die
-	fi
-
-	einfo
-	einfo "You can edit /etc/conf.d/named to customize named settings"
-	einfo
-	use mysql || use postgres || use ldap && {
-		elog "If your named depends on MySQL/PostgreSQL or LDAP,"
-		elog "uncomment the specified rc_named_* lines in your"
-		elog "/etc/conf.d/named config to ensure they'll start before bind"
-		einfo
-	}
-	einfo "If you'd like to run bind in a chroot AND this is a new"
-	einfo "install OR your bind doesn't already run in a chroot:"
-	einfo "1) Uncomment and set the CHROOT variable in /etc/conf.d/named."
-	einfo "2) Run \`emerge --config '=${CATEGORY}/${PF}'\`"
-	einfo
-
-	CHROOT=$(source /etc/conf.d/named 2>/dev/null; echo ${CHROOT})
-	if [[ -n ${CHROOT} ]]; then
-		elog "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		elog "To enable the old behaviour (without using mount) uncomment the"
-		elog "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		elog "If you decide to use the new/default method, ensure to make backup"
-		elog "first and merge your existing configs/zones to /etc/bind and"
-		elog "/var/bind because bind will now mount the needed directories into"
-		elog "the chroot dir."
-	fi
-}
-
-pkg_config() {
-	CHROOT=$(source /etc/conf.d/named; echo ${CHROOT})
-	CHROOT_NOMOUNT=$(source /etc/conf.d/named; echo ${CHROOT_NOMOUNT})
-	CHROOT_GEOIP=$(source /etc/conf.d/named; echo ${CHROOT_GEOIP})
-
-	if [[ -z "${CHROOT}" ]]; then
-		eerror "This config script is designed to automate setting up"
-		eerror "a chrooted bind/named. To do so, please first uncomment"
-		eerror "and set the CHROOT variable in '/etc/conf.d/named'."
-		die "Unset CHROOT"
-	fi
-	if [[ -d "${CHROOT}" ]]; then
-		ewarn "NOTE: As of net-dns/bind-9.4.3_p5-r1 the chroot part of the init-script got some major changes!"
-		ewarn "To enable the old behaviour (without using mount) uncomment the"
-		ewarn "CHROOT_NOMOUNT option in your /etc/conf.d/named config."
-		ewarn
-		ewarn "${CHROOT} already exists... some things might become overridden"
-		ewarn "press CTRL+C if you don't want to continue"
-		sleep 10
-	fi
-
-	echo; einfo "Setting up the chroot directory..."
-
-	mkdir -m 0750 -p ${CHROOT} || die
-	mkdir -m 0755 -p ${CHROOT}/{dev,etc,var/log,run} || die
-	mkdir -m 0750 -p ${CHROOT}/etc/bind || die
-	mkdir -m 0770 -p ${CHROOT}/var/{bind,log/named} ${CHROOT}/run/named/ || die
-
-	chown root:named \
-		${CHROOT} \
-		${CHROOT}/var/{bind,log/named} \
-		${CHROOT}/run/named/ \
-		${CHROOT}/etc/bind \
-		|| die
-
-	mknod ${CHROOT}/dev/null c 1 3 || die
-	chmod 0666 ${CHROOT}/dev/null || die
-
-	mknod ${CHROOT}/dev/zero c 1 5 || die
-	chmod 0666 ${CHROOT}/dev/zero || die
-
-	mknod ${CHROOT}/dev/urandom c 1 9 || die
-	chmod 0666 ${CHROOT}/dev/urandom || die
-
-	if [ "${CHROOT_NOMOUNT:-0}" -ne 0 ]; then
-		cp -a /etc/bind ${CHROOT}/etc/ || die
-		cp -a /var/bind ${CHROOT}/var/ || die
-	fi
-
-	if [ "${CHROOT_GEOIP:-0}" -eq 1 ]; then
-		if use geoip; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP || die
-		elif use geoip2; then
-			mkdir -m 0755 -p ${CHROOT}/usr/share/GeoIP2 || die
-		fi
-	fi
-
-	elog "You may need to add the following line to your syslog-ng.conf:"
-	elog "source jail { unix-stream(\"${CHROOT}/dev/log\"); };"
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml b/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
index aa2583bf55..5dfa7226e5 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind/metadata.xml
@@ -8,12 +8,9 @@
 	<use>
 		<flag name="dnstap">Enables dnstap packet logging</flag>
 		<flag name="dnsrps">Enable the DNS Response Policy Service (DNSRPS) API, a mechanism to allow an external response policy provider</flag>
-		<flag name="dlz">Enables dynamic loaded zones, 3rd party extension</flag>
 		<flag name="doh">Enables dns-over-https</flag>
 		<flag name="fixed-rrset">Enables fixed rrset-order option</flag>
-		<flag name="geoip2">Enable GeoIP2 API from MaxMind</flag>
 		<flag name="gssapi">Enable gssapi support</flag>
-		<flag name="json">Enable JSON statistics channel</flag>
 		<flag name="lmdb">Enable LMDB support to store configuration for 'addzone' zones</flag>
 	</use>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index 74528f45a2..057cbaa94d 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -1,6 +1,4 @@
-DIST curl-8.11.1.tar.xz 2751236 BLAKE2B a87ec2c78c5d6daf44eee4cf8e3ed124849d067f6c63145205fda18f33ddd3adce386058ead8f9b713f8e595f5e059acd13479eb00edc226247aabd3c2234112 SHA512 7c7c47a49505575b610c56b455f0919ea5082a993bf5483eeb258ead167aadb87078d626b343b417dcfc5439c53556425c8fb4fe3b01b53a87b47c01686a3e57
-DIST curl-8.11.1.tar.xz.asc 488 BLAKE2B 53d58ebb8ab722d8394b7ce94b646c876324cd89b3e47d9129bddcfbb6db338c1dbe93a5e72a25caf7be9ddd450c2b0832cfee17beb8ba701bdeefe653235d53 SHA512 c09bedb67e83fb8ca3ad73c5bd0d92fed7fc2c26dbe5a71cccb193fd151c7219713241a9fe74baefcd1d008cfafba78142bf04cec24dd4a88d67179184d35824
 DIST curl-8.12.1.tar.xz 2768160 BLAKE2B 2b3e3d91041881c0951ad470736266105d3b9720440b808fe382baa493a30075aba52eb1d329fb1f148e27cd76290d82e121e7f4abf695f215456a10e26ade3e SHA512 88915468fa1bb7256e3dd6c9d058ada6894faa1e3e7800c7d9bfee3e8be4081ae57e7f2bf260c5342b709499fc4302ddc2d7864e25bfa3300fa07f118a3de603
 DIST curl-8.12.1.tar.xz.asc 488 BLAKE2B 2a6563609c9f7ada84ca2c7048ad9406809eef4cc958760d2ab3d1b7be58d26247e579bd025870609e80ebb00295026aae30614b84e3a81bdf3ed3dbd0f5ed70 SHA512 41fc5582935090d13940d86974fdea3ea901dd5dab156c16029a87f811d2535172c59dc8dc366f2ffc37bcf85accbecb5aa765bc7b83c2991a3ef402bf25af69
-DIST curl-8.13.0-rc3.tar.xz 2792136 BLAKE2B af18c877ca6e9fb3e75265f86b3f3416e12b4160b71de00dfb82d687f11f457faf2f7dddde557474631ac7148cada1add189ac4ed002c41745bd546309093312 SHA512 72c0e0b8b0bc9117ab911b97bab6b1502d877f5a72a34091b68e48c046e45dfd188f24f270c0200f4df3f1a70933ada00f3a73a0aa078ec2b125fa5a9294d33f
-DIST curl-8.13.0-rc3.tar.xz.asc 488 BLAKE2B 8778af342578bace6ddea93c719fb74b8a9b85ffb53938f46888c48cb9eef53bd018b4df421c2ceaecae5a8058a32b3b058e7965ba8b092eb17fef69168ab3f4 SHA512 a2d94a898824fabc1c4834f9e5719fb65311d0f218f6170e80fe1a04c6f842f9fbf589d281767ab916f668ff7087bb318b819a1fb26790640df136f335ff3b99
+DIST curl-8.13.0.tar.xz 2773628 BLAKE2B 6869634ad50f015d5c7526699034d5a3f27d9588bc32eacc8080dbd6c690f63b1f25cee40d3fdf8fd9dd8535c305ea9c5edf1d5a02bc6d9ce60fd8c88230aca0 SHA512 d266e460f162ee455b56726e5b7247b2d1aa5265ae12081513fc0c5c79e785a594097bc71d505dc9bcd2c2f6f1ff6f4bab9dbd9d120bb76d06c5be8521a8ca7d
+DIST curl-8.13.0.tar.xz.asc 488 BLAKE2B bd568ec32a44ef7c14c38e4830bcc7711dac726e950325292f1e5de76e619839685300c5afac32330127324327e71ce0d6e574f6e95bcc4a48957345152bc86a SHA512 07f79c7fd7c305c96e10a5f52797254aed7d2a1f3577c8626b8d617855ceb82634ac6787bfa0b7130a4ed72c3a9945d3c9ba5b7be54df8bafa07ded1c62ef2be
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild
deleted file mode 100644
index cc333a91ca..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.11.1-r2.ebuild
+++ /dev/null
@@ -1,384 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Maintainers should subscribe to the 'curl-distros' ML for backports etc
-# https://daniel.haxx.se/blog/2024/03/25/curl-distro-report/
-# https://lists.haxx.se/listinfo/curl-distros
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/danielstenberg.asc
-inherit autotools multilib-minimal multiprocessing prefix toolchain-funcs verify-sig
-
-DESCRIPTION="A Client that groks URLs"
-HOMEPAGE="https://curl.se/"
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/curl/curl.git"
-else
-	SRC_URI="
-		https://curl.se/download/${P}.tar.xz
-		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
-	"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="BSD curl ISC test? ( BSD-4 )"
-SLOT="0"
-IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 +http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
-IUSE+=" +psl +progress-meter +quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp +websockets zstd"
-# These select the default tls implementation / which quic impl to use
-IUSE+=" +curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
-RESTRICT="!test? ( test )"
-
-# Only one default ssl / quic provider can be enabled
-# The default provider needs its USE satisfied
-# HTTP/3 and MultiSSL are mutually exclusive; it's not clear if MultiSSL offers any benefit at all in the modern day.
-# https://github.com/curl/curl/commit/65ece771f4602107d9cdd339dff4b420280a2c2e
-REQUIRED_USE="
-	quic? (
-		^^ (
-			curl_quic_openssl
-			curl_quic_ngtcp2
-		)
-		http3
-		ssl
-	)
-	ssl? (
-		^^ (
-			curl_ssl_gnutls
-			curl_ssl_mbedtls
-			curl_ssl_openssl
-			curl_ssl_rustls
-		)
-	)
-	curl_quic_openssl? (
-		curl_ssl_openssl
-		quic
-		!gnutls
-		!mbedtls
-		!rustls
-	)
-	curl_quic_ngtcp2? (
-		curl_ssl_gnutls
-		quic
-		!mbedtls
-		!openssl
-		!rustls
-	)
-	curl_ssl_gnutls? ( gnutls )
-	curl_ssl_mbedtls? ( mbedtls )
-	curl_ssl_openssl? ( openssl )
-	curl_ssl_rustls? ( rustls )
-	http3? ( alt-svc quic )
-"
-
-# cURL's docs and CI/CD are great resources for confirming supported versions
-# particulary for fast-moving targets like HTTP/2 and TCP/2 e.g.:
-# - https://github.com/curl/curl/blob/master/docs/INTERNALS.md (core dependencies + minimum versions)
-# - https://github.com/curl/curl/blob/master/docs/HTTP3.md (example of a feature that moves quickly)
-# - https://github.com/curl/curl/blob/master/.github/workflows/http3-linux.yml (CI/CD for TCP/2)
-# However 'supported' vs 'works' are two entirely different things; be sane but
-# don't be afraid to require a later version.
-# ngtcp2 = https://bugs.gentoo.org/912029 - can only build with one tls backend at a time.
-RDEPEND="
-	>=sys-libs/zlib-1.1.4[${MULTILIB_USEDEP}]
-	adns? ( >=net-dns/c-ares-1.16.0:=[${MULTILIB_USEDEP}] )
-	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
-	http2? ( >=net-libs/nghttp2-1.15.0:=[${MULTILIB_USEDEP}] )
-	http3? ( >=net-libs/nghttp3-1.1.0[${MULTILIB_USEDEP}] )
-	idn? ( >=net-dns/libidn2-2.0.0:=[static-libs?,${MULTILIB_USEDEP}] )
-	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
-	ldap? ( >=net-nds/openldap-2.0.0:=[static-libs?,${MULTILIB_USEDEP}] )
-	psl? ( net-libs/libpsl[${MULTILIB_USEDEP}] )
-	quic? (
-		curl_quic_openssl? ( >=dev-libs/openssl-3.3.0:=[quic,${MULTILIB_USEDEP}] )
-		curl_quic_ngtcp2? ( >=net-libs/ngtcp2-1.2.0[gnutls,ssl,-openssl,${MULTILIB_USEDEP}] )
-	)
-	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
-	ssh? ( >=net-libs/libssh2-1.0.0[${MULTILIB_USEDEP}] )
-	ssl? (
-		gnutls? (
-			app-misc/ca-certificates
-			>=net-libs/gnutls-3.1.10:=[static-libs?,${MULTILIB_USEDEP}]
-			dev-libs/nettle:=[${MULTILIB_USEDEP}]
-		)
-		mbedtls? (
-			app-misc/ca-certificates
-			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
-		)
-		openssl? (
-			>=dev-libs/openssl-0.9.7:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
-		)
-		rustls? (
-			>=net-libs/rustls-ffi-0.14.0:=[${MULTILIB_USEDEP}]
-		)
-	)
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
-"
-
-DEPEND="${RDEPEND}"
-
-BDEPEND="
-	dev-lang/perl
-	virtual/pkgconfig
-	test? (
-		sys-apps/diffutils
-		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
-		http3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
-	)
-	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
-"
-
-DOCS=( README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/curl/curlbuild.h
-)
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/curl-config
-)
-
-QA_CONFIG_IMPL_DECL_SKIP=(
-	__builtin_available
-	closesocket
-	CloseSocket
-	getpass_r
-	ioctlsocket
-	IoctlSocket
-	mach_absolute_time
-	setmode
-	_fseeki64
-	# custom AC_LINK_IFELSE code fails to link even without -Werror
-	OSSL_QUIC_client_method
-)
-
-PATCHES=(
-	"${FILESDIR}/${PN}-prefix-3.patch"
-	"${FILESDIR}/${PN}-respect-cflags-3.patch"
-	"${FILESDIR}/${P}-async-thread-close-eventfd.patch"
-)
-
-src_prepare() {
-	default
-
-	eprefixify curl-config.in
-	eautoreconf
-}
-
-multilib_src_configure() {
-	# We make use of the fact that later flags override earlier ones
-	# So start with all ssl providers off until proven otherwise
-	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
-	local myconf=()
-
-	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
-	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
-
-		if use gnutls; then
-			multilib_is_native_abi && einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls; then
-			multilib_is_native_abi && einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use openssl; then
-			multilib_is_native_abi && einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls; then
-			multilib_is_native_abi && einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_openssl; then
-			multilib_is_native_abi && einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			multilib_is_native_abi && einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
-		fi
-
-	else
-		myconf+=( --without-ssl )
-		einfo "SSL disabled"
-	fi
-
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
-
-	myconf+=(
-		$(use_enable alt-svc)
-		--enable-basic-auth
-		--enable-bearer-auth
-		--enable-digest-auth
-		--enable-kerberos-auth
-		--enable-negotiate-auth
-		--enable-aws
-		--enable-dict
-		--disable-ech
-		--enable-file
-		$(use_enable ftp)
-		$(use_enable gopher)
-		$(use_enable hsts)
-		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
-		$(use_enable ldap ldaps)
-		--enable-ntlm
-		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
-		$(use_enable samba smb)
-		$(use_with ssh libssh2)
-		$(use_enable smtp)
-		$(use_enable telnet)
-		$(use_enable tftp)
-		--enable-tls-srp
-		$(use_enable adns ares)
-		--enable-cookies
-		--enable-dateparse
-		--enable-dnsshuffle
-		--enable-doh
-		--enable-symbol-hiding
-		--enable-http-auth
-		--enable-ipv6
-		--enable-largefile
-		--enable-manual
-		--enable-mime
-		--enable-netrc
-		$(use_enable progress-meter)
-		--enable-proxy
-		--enable-socketpair
-		--disable-sspi
-		$(use_enable static-libs static)
-		--enable-pthreads
-		--enable-threaded-resolver
-		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
-		$(use_with brotli)
-		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
-		$(use_with http2 nghttp2)
-		--without-hyper
-		$(use_with idn libidn2)
-		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
-		$(use_with psl libpsl)
-		--without-msh3
-		$(use_with http3 nghttp3)
-		$(use_with curl_quic_ngtcp2 ngtcp2)
-		$(use_with curl_quic_openssl openssl-quic)
-		--without-quiche
-		$(use_with rtmp librtmp)
-		--without-schannel
-		--without-secure-transport
-		--without-test-caddy
-		--without-test-httpd
-		--without-test-nghttpx
-		$(use_enable websockets)
-		--without-winidn
-		--without-wolfssl
-		--with-zlib
-		$(use_with zstd)
-		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
-	)
-
-	if use debug; then
-		myconf+=(
-			--enable-debug
-		)
-	fi
-
-	if use test && multilib_is_native_abi && ( use http2 || use http3 ); then
-		myconf+=(
-			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
-		)
-	fi
-
-	if [[ ${CHOST} == *mingw* ]] ; then
-		myconf+=(
-			--disable-pthreads
-		)
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	if ! multilib_is_native_abi; then
-		# Avoid building the client (we just want libcurl for multilib)
-		sed -i -e '/SUBDIRS/s:src::' Makefile || die
-		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
-	fi
-
-}
-
-multilib_src_compile() {
-	default
-
-	if multilib_is_native_abi; then
-		# Shell completions
-		! tc-is-cross-compiler && emake -C scripts
-	fi
-}
-
-# There is also a pytest harness that tests for bugs in some very specific
-# situations; we can rely on upstream for this rather than adding additional test deps.
-multilib_src_test() {
-	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
-	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
-	# -v: verbose
-	# -a: keep going on failure (so we see everything that breaks, not just 1st test)
-	# -k: keep test files after completion
-	# -am: automake style TAP output
-	# -p: print logs if test fails
-	# Note: if needed, we can skip specific tests. See e.g. Fedora's packaging
-	# or just read https://github.com/curl/curl/tree/master/tests#run.
-	# Note: we don't run the testsuite for cross-compilation.
-	# Upstream recommend 7*nproc as a starting point for parallel tests, but
-	# this ends up breaking when nproc is huge (like -j80).
-	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
-	# as most gentoo users don't have an 'ip6-localhost'
-	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p -j$((2*$(makeopts_jobs))) !241 !1083"
-}
-
-multilib_src_install() {
-	emake DESTDIR="${D}" install
-
-	if multilib_is_native_abi; then
-		# Shell completions
-		! tc-is-cross-compiler && emake -C scripts DESTDIR="${D}" install
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-	rm -rf "${ED}"/etc/ || die
-}
-
-pkg_postinst() {
-	if use debug; then
-		ewarn "USE=debug has been selected, enabling debug codepaths and making cURL extra verbose."
-		ewarn "Use this _only_ for testing. Debug builds should _not_ be used in anger."
-		ewarn "hic sunt dracones; you have been warned."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0_rc3.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0.ebuild
similarity index 72%
rename from sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0_rc3.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0.ebuild
index 5af80a37e9..bdceb348fc 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0_rc3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.13.0.ebuild
@@ -32,17 +32,29 @@ fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
-IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 +http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
-IUSE+=" +psl +progress-meter +quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp +websockets zstd"
+IUSE="+adns +alt-svc brotli debug ech +ftp gnutls gopher +hsts +http2 +http3 +httpsrr idn +imap kerberos ldap"
+IUSE+=" mbedtls +openssl +pop3 +psl +quic rtmp rustls samba sasl-scram +smtp ssh ssl static-libs test"
+IUSE+=" telnet +tftp +websockets zstd"
 # These select the default tls implementation / which quic impl to use
 IUSE+=" +curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
 RESTRICT="!test? ( test )"
 
+# HTTPS RR is technically usable with the threaded resolver, but it still uses c-ares to
+# ask for the HTTPS RR record type; if DoH is in use the HTTPS record will be requested
+# in addition to A and AAAA records.
+
+# To simplify dependency management in the ebuild we'll require c-ares for HTTPS RR (for now?).
+# HTTPS RR in cURL is a dependency for:
+# - ECH (requires patched openssl or gnutls currently, enabled with rustls)
+# - Fetching the ALPN list which should provide a better HTTP/3 experience.
+
 # Only one default ssl / quic provider can be enabled
 # The default provider needs its USE satisfied
 # HTTP/3 and MultiSSL are mutually exclusive; it's not clear if MultiSSL offers any benefit at all in the modern day.
 # https://github.com/curl/curl/commit/65ece771f4602107d9cdd339dff4b420280a2c2e
 REQUIRED_USE="
+	ech? ( rustls )
+	httpsrr? ( adns )
 	quic? (
 		^^ (
 			curl_quic_openssl
@@ -77,7 +89,7 @@ REQUIRED_USE="
 	curl_ssl_mbedtls? ( mbedtls )
 	curl_ssl_openssl? ( openssl )
 	curl_ssl_rustls? ( rustls )
-	http3? ( alt-svc quic )
+	http3? ( alt-svc httpsrr quic )
 "
 
 # cURL's docs and CI/CD are great resources for confirming supported versions
@@ -104,6 +116,7 @@ RDEPEND="
 	)
 	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
 	ssh? ( >=net-libs/libssh2-1.2.8[${MULTILIB_USEDEP}] )
+	sasl-scram? ( >=net-misc/gsasl-2.2.0[static-libs?,${MULTILIB_USEDEP}] )
 	ssl? (
 		gnutls? (
 			app-misc/ca-certificates
@@ -115,10 +128,10 @@ RDEPEND="
 			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
 		)
 		openssl? (
-			>=dev-libs/openssl-1.0.2:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+			>=dev-libs/openssl-1.0.2:=[static-libs?,${MULTILIB_USEDEP}]
 		)
 		rustls? (
-			>=net-libs/rustls-ffi-0.14.0:=[${MULTILIB_USEDEP}]
+			>=net-libs/rustls-ffi-0.15.0:=[${MULTILIB_USEDEP}]
 		)
 	)
 	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
@@ -173,6 +186,57 @@ src_prepare() {
 	eautoreconf
 }
 
+# Generates TLS-related configure options based on USE flags.
+# Outputs options suitable for appending to a configure options array.
+_get_curl_tls_configure_opts() {
+	local tls_opts=()
+
+	local backend flag_name
+	for backend in gnutls mbedtls openssl rustls; do
+		if [[ "$backend" == "openssl" ]]; then
+			flag_name="ssl"
+			tls_opts+=( "--with-ca-path=${EPREFIX}/etc/ssl/certs")
+		else
+			flag_name="$backend"
+		fi
+
+		if use "$backend"; then
+			tls_opts+=( "--with-${flag_name}" )
+		else
+			# If a single backend is enabled, 'ssl' is required, openssl is the default / fallback
+			if ! [[ "$backend" == "openssl" ]]; then
+				tls_opts+=( "--without-${flag_name}" )
+			fi
+		fi
+	done
+
+	if use curl_ssl_gnutls; then
+		multilib_is_native_abi && einfo "Default TLS backend: gnutls"
+		tls_opts+=( "--with-default-ssl-backend=gnutls" )
+	elif use curl_ssl_mbedtls; then
+		multilib_is_native_abi && einfo "Default TLS backend: mbedtls"
+		tls_opts+=( "--with-default-ssl-backend=mbedtls" )
+	elif use curl_ssl_openssl; then
+		multilib_is_native_abi && einfo "Default TLS backend: openssl"
+		tls_opts+=( "--with-default-ssl-backend=openssl" )
+	elif use curl_ssl_rustls; then
+		multilib_is_native_abi && einfo "Default TLS backend: rustls"
+		tls_opts+=( "--with-default-ssl-backend=rustls" )
+	else
+		eerror "We can't be here because of REQUIRED_USE."
+		die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+	fi
+
+	# Explicitly Disable unimplemented b
+	tls_opts+=(
+		--without-amissl
+		--without-bearssl
+		--without-wolfssl
+	)
+
+	printf "%s\n" "${tls_opts[@]}"
+}
+
 multilib_src_configure() {
 	# We make use of the fact that later flags override earlier ones
 	# So start with all ssl providers off until proven otherwise
@@ -181,128 +245,107 @@ multilib_src_configure() {
 
 	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
 	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
-
-		if use gnutls; then
-			multilib_is_native_abi && einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls; then
-			multilib_is_native_abi && einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use openssl; then
-			multilib_is_native_abi && einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls; then
-			multilib_is_native_abi && einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_openssl; then
-			multilib_is_native_abi && einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			multilib_is_native_abi && einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
-		fi
-
+		local -a tls_backend_opts
+		readarray -t tls_backend_opts < <(_get_curl_tls_configure_opts)
+		myconf+=("${tls_backend_opts[@]}")
 	else
 		myconf+=( --without-ssl )
 		einfo "SSL disabled"
 	fi
 
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+	# These configuration options are organised alphabetically by category/type
 
+	# Protocols
+	# `grep SUPPORT_PROTOCOLS=\" configure.ac | awk '{ print substr($2, 1, length($2)-1)}' | sort`
+	# Assume that anything omitted (that is not new!) is enabled by default with no deps
 	myconf+=(
-		$(use_enable alt-svc)
-		--enable-basic-auth
-		--enable-bearer-auth
-		--enable-digest-auth
-		--enable-kerberos-auth
-		--enable-negotiate-auth
-		--enable-aws
-		--enable-dict
-		--disable-ech
 		--enable-file
 		$(use_enable ftp)
 		$(use_enable gopher)
-		$(use_enable hsts)
 		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
+		$(use_enable imap) # Automatic IMAPS if TLS is enabled
 		$(use_enable ldap ldaps)
-		--enable-ntlm
+		$(use_enable ldap)
 		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
 		$(use_enable samba smb)
-		$(use_with ssh libssh2)
+		$(use_with ssh libssh2) # enables scp/sftp
+		$(use_with rtmp librtmp)
+		--enable-rtsp
 		$(use_enable smtp)
 		$(use_enable telnet)
 		$(use_enable tftp)
-		--enable-tls-srp
-		$(use_enable adns ares)
-		--enable-cookies
-		--enable-dateparse
-		--enable-dnsshuffle
-		--enable-doh
-		--enable-symbol-hiding
-		--enable-http-auth
-		--enable-ipv6
-		--enable-largefile
-		--enable-manual
-		--enable-mime
-		--enable-netrc
-		$(use_enable progress-meter)
-		--enable-proxy
-		--enable-socketpair
-		--disable-sspi
-		$(use_enable static-libs static)
-		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
-		$(use_with brotli)
-		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_enable websockets)
+	)
+
+	# Keep various 'HTTP-flavoured' options together
+	myconf+=(
+		$(use_enable alt-svc)
+		$(use_enable hsts)
+		$(use_enable httpsrr)
 		$(use_with http2 nghttp2)
-		$(use_with idn libidn2)
-		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
-		$(use_with psl libpsl)
-		--without-msh3
 		$(use_with http3 nghttp3)
 		$(use_with curl_quic_ngtcp2 ngtcp2)
 		$(use_with curl_quic_openssl openssl-quic)
+	)
+
+	# --enable/disable options
+	# `grep -- --enable configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
+		$(use_enable adns ares)
+		--enable-aws
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-cookies
+		--enable-dateparse
+		--enable-dict
+		--enable-digest-auth
+		--enable-dnsshuffle
+		--enable-doh
+		$(use_enable ech)
+		--enable-http-auth
+		--enable-ipv6
+		--enable-kerberos-auth
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-negotiate-auth
+		--enable-netrc
+		--enable-ntlm
+		--enable-progress-meter
+		--enable-proxy
+		--enable-rt
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-symbol-hiding
+		--enable-tls-srp
+		--disable-versioned-symbols
+	)
+
+	# --with/without options
+	# `grep -- --with configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		$(use_with sasl-scram libgsasl)
+		$(use_with psl libpsl)
+		--without-msh3
 		--without-quiche
-		$(use_with rtmp librtmp)
 		--without-schannel
 		--without-secure-transport
+		--without-winidn
+		--with-zlib
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+		$(use_with zstd)
+	)
+
+	# Test deps (disabled)
+	myconf+=(
 		--without-test-caddy
 		--without-test-httpd
 		--without-test-nghttpx
-		$(use_enable websockets)
-		--without-winidn
-		--without-wolfssl
-		--with-zlib
-		$(use_with zstd)
-		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
 	)
 
 	if use debug; then
@@ -319,8 +362,7 @@ multilib_src_configure() {
 
 	# Since 8.12.0 adns/c-ares and the threaded resolver are mutually exclusive
 	# This is in support of some work to enable `httpsrr` to use adns and the rest
-	# of curl to use the threaded resolver; we'll just make `httpsrr` conditional on adns
-	# when the time comes.
+	# of curl to use the threaded resolver; for us `httpsrr` is conditional on adns.
 	if use adns; then
 		myconf+=(
 			--disable-threaded-resolver
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
index 5af80a37e9..bdceb348fc 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
@@ -32,17 +32,29 @@ fi
 
 LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
-IUSE="+adns +alt-svc brotli debug +ftp gnutls gopher +hsts +http2 +http3 idn +imap kerberos ldap mbedtls +openssl +pop3"
-IUSE+=" +psl +progress-meter +quic rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp +websockets zstd"
+IUSE="+adns +alt-svc brotli debug ech +ftp gnutls gopher +hsts +http2 +http3 +httpsrr idn +imap kerberos ldap"
+IUSE+=" mbedtls +openssl +pop3 +psl +quic rtmp rustls samba sasl-scram +smtp ssh ssl static-libs test"
+IUSE+=" telnet +tftp +websockets zstd"
 # These select the default tls implementation / which quic impl to use
 IUSE+=" +curl_quic_openssl curl_quic_ngtcp2 curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
 RESTRICT="!test? ( test )"
 
+# HTTPS RR is technically usable with the threaded resolver, but it still uses c-ares to
+# ask for the HTTPS RR record type; if DoH is in use the HTTPS record will be requested
+# in addition to A and AAAA records.
+
+# To simplify dependency management in the ebuild we'll require c-ares for HTTPS RR (for now?).
+# HTTPS RR in cURL is a dependency for:
+# - ECH (requires patched openssl or gnutls currently, enabled with rustls)
+# - Fetching the ALPN list which should provide a better HTTP/3 experience.
+
 # Only one default ssl / quic provider can be enabled
 # The default provider needs its USE satisfied
 # HTTP/3 and MultiSSL are mutually exclusive; it's not clear if MultiSSL offers any benefit at all in the modern day.
 # https://github.com/curl/curl/commit/65ece771f4602107d9cdd339dff4b420280a2c2e
 REQUIRED_USE="
+	ech? ( rustls )
+	httpsrr? ( adns )
 	quic? (
 		^^ (
 			curl_quic_openssl
@@ -77,7 +89,7 @@ REQUIRED_USE="
 	curl_ssl_mbedtls? ( mbedtls )
 	curl_ssl_openssl? ( openssl )
 	curl_ssl_rustls? ( rustls )
-	http3? ( alt-svc quic )
+	http3? ( alt-svc httpsrr quic )
 "
 
 # cURL's docs and CI/CD are great resources for confirming supported versions
@@ -104,6 +116,7 @@ RDEPEND="
 	)
 	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
 	ssh? ( >=net-libs/libssh2-1.2.8[${MULTILIB_USEDEP}] )
+	sasl-scram? ( >=net-misc/gsasl-2.2.0[static-libs?,${MULTILIB_USEDEP}] )
 	ssl? (
 		gnutls? (
 			app-misc/ca-certificates
@@ -115,10 +128,10 @@ RDEPEND="
 			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
 		)
 		openssl? (
-			>=dev-libs/openssl-1.0.2:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+			>=dev-libs/openssl-1.0.2:=[static-libs?,${MULTILIB_USEDEP}]
 		)
 		rustls? (
-			>=net-libs/rustls-ffi-0.14.0:=[${MULTILIB_USEDEP}]
+			>=net-libs/rustls-ffi-0.15.0:=[${MULTILIB_USEDEP}]
 		)
 	)
 	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
@@ -173,6 +186,57 @@ src_prepare() {
 	eautoreconf
 }
 
+# Generates TLS-related configure options based on USE flags.
+# Outputs options suitable for appending to a configure options array.
+_get_curl_tls_configure_opts() {
+	local tls_opts=()
+
+	local backend flag_name
+	for backend in gnutls mbedtls openssl rustls; do
+		if [[ "$backend" == "openssl" ]]; then
+			flag_name="ssl"
+			tls_opts+=( "--with-ca-path=${EPREFIX}/etc/ssl/certs")
+		else
+			flag_name="$backend"
+		fi
+
+		if use "$backend"; then
+			tls_opts+=( "--with-${flag_name}" )
+		else
+			# If a single backend is enabled, 'ssl' is required, openssl is the default / fallback
+			if ! [[ "$backend" == "openssl" ]]; then
+				tls_opts+=( "--without-${flag_name}" )
+			fi
+		fi
+	done
+
+	if use curl_ssl_gnutls; then
+		multilib_is_native_abi && einfo "Default TLS backend: gnutls"
+		tls_opts+=( "--with-default-ssl-backend=gnutls" )
+	elif use curl_ssl_mbedtls; then
+		multilib_is_native_abi && einfo "Default TLS backend: mbedtls"
+		tls_opts+=( "--with-default-ssl-backend=mbedtls" )
+	elif use curl_ssl_openssl; then
+		multilib_is_native_abi && einfo "Default TLS backend: openssl"
+		tls_opts+=( "--with-default-ssl-backend=openssl" )
+	elif use curl_ssl_rustls; then
+		multilib_is_native_abi && einfo "Default TLS backend: rustls"
+		tls_opts+=( "--with-default-ssl-backend=rustls" )
+	else
+		eerror "We can't be here because of REQUIRED_USE."
+		die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+	fi
+
+	# Explicitly Disable unimplemented b
+	tls_opts+=(
+		--without-amissl
+		--without-bearssl
+		--without-wolfssl
+	)
+
+	printf "%s\n" "${tls_opts[@]}"
+}
+
 multilib_src_configure() {
 	# We make use of the fact that later flags override earlier ones
 	# So start with all ssl providers off until proven otherwise
@@ -181,128 +245,107 @@ multilib_src_configure() {
 
 	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
 	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
-
-		if use gnutls; then
-			multilib_is_native_abi && einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls; then
-			multilib_is_native_abi && einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use openssl; then
-			multilib_is_native_abi && einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls; then
-			multilib_is_native_abi && einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_openssl; then
-			multilib_is_native_abi && einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			multilib_is_native_abi && einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
-		fi
-
+		local -a tls_backend_opts
+		readarray -t tls_backend_opts < <(_get_curl_tls_configure_opts)
+		myconf+=("${tls_backend_opts[@]}")
 	else
 		myconf+=( --without-ssl )
 		einfo "SSL disabled"
 	fi
 
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+	# These configuration options are organised alphabetically by category/type
 
+	# Protocols
+	# `grep SUPPORT_PROTOCOLS=\" configure.ac | awk '{ print substr($2, 1, length($2)-1)}' | sort`
+	# Assume that anything omitted (that is not new!) is enabled by default with no deps
 	myconf+=(
-		$(use_enable alt-svc)
-		--enable-basic-auth
-		--enable-bearer-auth
-		--enable-digest-auth
-		--enable-kerberos-auth
-		--enable-negotiate-auth
-		--enable-aws
-		--enable-dict
-		--disable-ech
 		--enable-file
 		$(use_enable ftp)
 		$(use_enable gopher)
-		$(use_enable hsts)
 		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
+		$(use_enable imap) # Automatic IMAPS if TLS is enabled
 		$(use_enable ldap ldaps)
-		--enable-ntlm
+		$(use_enable ldap)
 		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
 		$(use_enable samba smb)
-		$(use_with ssh libssh2)
+		$(use_with ssh libssh2) # enables scp/sftp
+		$(use_with rtmp librtmp)
+		--enable-rtsp
 		$(use_enable smtp)
 		$(use_enable telnet)
 		$(use_enable tftp)
-		--enable-tls-srp
-		$(use_enable adns ares)
-		--enable-cookies
-		--enable-dateparse
-		--enable-dnsshuffle
-		--enable-doh
-		--enable-symbol-hiding
-		--enable-http-auth
-		--enable-ipv6
-		--enable-largefile
-		--enable-manual
-		--enable-mime
-		--enable-netrc
-		$(use_enable progress-meter)
-		--enable-proxy
-		--enable-socketpair
-		--disable-sspi
-		$(use_enable static-libs static)
-		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
-		$(use_with brotli)
-		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_enable websockets)
+	)
+
+	# Keep various 'HTTP-flavoured' options together
+	myconf+=(
+		$(use_enable alt-svc)
+		$(use_enable hsts)
+		$(use_enable httpsrr)
 		$(use_with http2 nghttp2)
-		$(use_with idn libidn2)
-		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
-		$(use_with psl libpsl)
-		--without-msh3
 		$(use_with http3 nghttp3)
 		$(use_with curl_quic_ngtcp2 ngtcp2)
 		$(use_with curl_quic_openssl openssl-quic)
+	)
+
+	# --enable/disable options
+	# `grep -- --enable configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
+		$(use_enable adns ares)
+		--enable-aws
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-cookies
+		--enable-dateparse
+		--enable-dict
+		--enable-digest-auth
+		--enable-dnsshuffle
+		--enable-doh
+		$(use_enable ech)
+		--enable-http-auth
+		--enable-ipv6
+		--enable-kerberos-auth
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-negotiate-auth
+		--enable-netrc
+		--enable-ntlm
+		--enable-progress-meter
+		--enable-proxy
+		--enable-rt
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-symbol-hiding
+		--enable-tls-srp
+		--disable-versioned-symbols
+	)
+
+	# --with/without options
+	# `grep -- --with configure | grep Check | awk '{ print $4 }' | sort`
+	myconf+=(
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		$(use_with sasl-scram libgsasl)
+		$(use_with psl libpsl)
+		--without-msh3
 		--without-quiche
-		$(use_with rtmp librtmp)
 		--without-schannel
 		--without-secure-transport
+		--without-winidn
+		--with-zlib
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+		$(use_with zstd)
+	)
+
+	# Test deps (disabled)
+	myconf+=(
 		--without-test-caddy
 		--without-test-httpd
 		--without-test-nghttpx
-		$(use_enable websockets)
-		--without-winidn
-		--without-wolfssl
-		--with-zlib
-		$(use_with zstd)
-		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
 	)
 
 	if use debug; then
@@ -319,8 +362,7 @@ multilib_src_configure() {
 
 	# Since 8.12.0 adns/c-ares and the threaded resolver are mutually exclusive
 	# This is in support of some work to enable `httpsrr` to use adns and the rest
-	# of curl to use the threaded resolver; we'll just make `httpsrr` conditional on adns
-	# when the time comes.
+	# of curl to use the threaded resolver; for us `httpsrr` is conditional on adns.
 	if use adns; then
 		myconf+=(
 			--disable-threaded-resolver
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
index b3581ad828..497d1d0d69 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
@@ -11,6 +11,7 @@
 	</maintainer>
 	<use>
 		<flag name="alt-svc">Enable alt-svc support</flag>
+		<flag name="ech">Enable Encrypted Client Hello support</flag>
 		<flag name="ftp">Enable FTP support</flag>
 		<flag name="gnutls">Enable gnutls ssl backend</flag>
 		<flag name="gopher">Enable Gopher protocol support</flag>
@@ -18,6 +19,7 @@
 		<flag name="imap">Enable Internet Message Access Protocol support</flag>
 		<flag name="mbedtls">Enable mbedtls ssl backend</flag>
 		<flag name="http3">Enable HTTP/3 support</flag>
+		<flag name="httpsrr">Enable HTTPS Resource Record support</flag>
 		<flag name="openssl">Enable openssl ssl backend</flag>
 		<flag name="pop3">Enable Post Office Protocol 3 support</flag>
 		<flag name="progress-meter">Enable the progress meter</flag>
@@ -25,6 +27,7 @@
 		<flag name="quic">Enable support for QUIC (RFC 9000); a UDP-based protocol intended to replace TCP</flag>
 		<flag name="rtmp">Enable RTMP Streaming Media support</flag>
 		<flag name="rustls">Enable Rustls ssl backend</flag>
+		<flag name="sasl-scram">Enable snupport for additional SASL SCRAM-SHA authentication methods via <pkg>net-misc/gsasl</pkg></flag>
 		<flag name="smtp">Enable Simple Mail Transfer Protocol support</flag>
 		<flag name="ssh">Enable SSH urls in curl using libssh2</flag>
 		<flag name="ssl">Enable crypto engine support (via openssl if USE='-gnutls -nss')</flag>
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
index a442eaf61a..eb2e762312 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
@@ -1,2 +1,3 @@
 DIST iperf-2.0.13.tar.gz 326148 BLAKE2B 2a40aea9e2d7fdc935b91be5e4e586bf68dd27604375d2570570145e5db1ea5837469a4989f47586986932bef33cba05ed19ed3a9ce40c0a5531581c6d3ba982 SHA512 40fcfb8f4d27887f53a743ac07396511fb2a7ac59f4b300fe36896bd0241e191945fa253705990711772ee776d5e4227ed62760fc92abebdfebcedd11c27c0ea
 DIST iperf-3.17.1.tar.gz 670547 BLAKE2B 90afa47ba2de2f789b118ea42d7eabe3a7ec202116d51915b05350932231788a95ae142bdf2cff041f5504e67ae5ac1da2c66f408bc302c4e230ef4b7e496e15 SHA512 99c731e2e060d2b241d3137742bf92a975f2b7a94c6c723c9c1625f69c294fd7fe15b7dbf085a6120038fc1dd7628c83d2c7d16b059849fdbecbc88e48fb0974
+DIST iperf-3.18.tar.gz 688037 BLAKE2B 64272ab8288cb217603d4fa438bc547967baa964bc518c91f9f1f1c85d9a0a9a7ca5b4c558b3e2c68507c1cb76b40592fd9a80f0bb4cc8a1716e029b32289276 SHA512 a458292c34c29a60cce60eb6be4afd15220d4cf29f225a1c1be9ec8ef86baa85fa4e174e747cacfa5711c6957ad16d448c2d3d4029b6bfd58db9c39269f30caa
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.18-unbundle-cJSON.patch b/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.18-unbundle-cJSON.patch
new file mode 100644
index 0000000000..56db6c6b6a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/files/iperf-3.18-unbundle-cJSON.patch
@@ -0,0 +1,103 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -61,6 +61,8 @@ AC_ARG_ENABLE([profiling],
+     AS_HELP_STRING([--enable-profiling], [Enable iperf3 profiling binary]))
+ AM_CONDITIONAL([ENABLE_PROFILING], [test x$enable_profiling = xyes])
+ 
++PKG_CHECK_MODULES([libcjson], [libcjson >= 1.7.15])
++
+ # Check for the math library (needed by cjson on some platforms)
+ AC_SEARCH_LIBS(floor, [m], [], [
+ echo "floor()"
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -10,8 +10,6 @@ include_HEADERS         = iperf_api.h                                   # Define
+ 
+ # Specify the source files and flags for the iperf library
+ libiperf_la_SOURCES     = \
+-                        cjson.c \
+-                        cjson.h \
+                         flowlabel.h \
+                         iperf.h \
+                         iperf_api.c \
+@@ -46,10 +44,13 @@ libiperf_la_SOURCES     = \
+                         units.c \
+                         units.h \
+                         version.h
++libiperf_la_CPPFLAGS    = $(CPPFLAGS) @libcjson_CFLAGS@
++libiperf_la_LIBADD      = @libcjson_LIBS@
+ 
+ # Specify the sources and various flags for the iperf binary
+ iperf3_SOURCES          = main.c
+-iperf3_LDADD            = libiperf.la
++iperf3_CPPFLAGS         = $(CPPFLAGS) @libcjson_CFLAGS@
++iperf3_LDADD            = libiperf.la @libcjson_LIBS@
+ 
+ if ENABLE_PROFILING
+ # If the iperf-profiled-binary is enabled
+--- a/src/iperf.h
++++ b/src/iperf.h
+@@ -52,7 +52,7 @@
+ 
+ #include "timer.h"
+ #include "queue.h"
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ #include "iperf_time.h"
+ #include "portable_endian.h"
+ 
+--- a/src/iperf_api.c
++++ b/src/iperf_api.c
+@@ -79,7 +79,7 @@
+ #endif /* HAVE_SCTP_H */
+ #include "timer.h"
+ 
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ #include "units.h"
+ #include "iperf_util.h"
+ #include "iperf_locale.h"
+--- a/src/iperf_tcp.c
++++ b/src/iperf_tcp.c
+@@ -43,7 +43,7 @@
+ #include "iperf_tcp.h"
+ #include "iperf_util.h"
+ #include "net.h"
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ 
+ #if defined(HAVE_FLOWLABEL)
+ #include "flowlabel.h"
+--- a/src/iperf_udp.c
++++ b/src/iperf_udp.c
+@@ -45,7 +45,7 @@
+ #include "iperf_udp.h"
+ #include "timer.h"
+ #include "net.h"
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ 
+ /* iperf_udp_recv
+  *
+--- a/src/iperf_util.c
++++ b/src/iperf_util.c
+@@ -46,7 +46,7 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ 
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ #include "iperf.h"
+ #include "iperf_api.h"
+ 
+--- a/src/iperf_util.h
++++ b/src/iperf_util.h
+@@ -28,7 +28,7 @@
+ #define __IPERF_UTIL_H
+ 
+ #include "iperf_config.h"
+-#include "cjson.h"
++#include <cjson/cJSON.h>
+ #include <sys/select.h>
+ #include <stddef.h>
+ 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
new file mode 100644
index 0000000000..302b37c9ef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.18.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools systemd
+
+DESCRIPTION="A TCP, UDP, and SCTP network bandwidth measurement tool"
+HOMEPAGE="https://github.com/esnet/iperf"
+SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="sctp"
+
+DEPEND="
+	>=dev-libs/cJSON-1.7.15
+	dev-libs/openssl:=
+	sctp? ( net-misc/lksctp-tools )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( README.md RELNOTES.md )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.10.1-drop-forced-debugging-symbols.patch
+	"${FILESDIR}"/${PN}-3.18-unbundle-cJSON.patch
+	"${FILESDIR}"/${PN}-3.17.1-c23.patch
+)
+
+src_prepare() {
+	default
+
+	# Drop bundled cjson
+	rm src/cjson.{c,h} || die
+
+	eautoreconf
+}
+
+src_configure() {
+	econf $(use_with sctp)
+}
+
+src_install() {
+	default
+
+	newconfd "${FILESDIR}"/iperf.confd iperf3
+	newinitd "${FILESDIR}"/iperf3.initd iperf3
+	systemd_dounit contrib/iperf3.service
+
+	find "${ED}" -name '*.la' -type f -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
index 1b34d10467..15d81449d5 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r3.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${PARCH}"
 
 LICENSE="BSD GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 # Probably want to drop ssl defaulting to on in a future version.
 IUSE="abi_mips_n32 audit debug kerberos ldns legacy-ciphers libedit livecd pam +pie security-key selinux +ssl static test xmss"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/passt/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/passt/Manifest
index 3b3aad55a9..b5e590924d 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/passt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/passt/Manifest
@@ -1,3 +1,3 @@
-DIST passt-2024.09.06.tar.xz 210976 BLAKE2B 7c59d715a80bc9df2f0c85aef3f2cb2c2517941326cfecfe683770ebebc7815422db9f76e9ffbe17850441f0ffdcdfaa0602bd69af9dd8046cddb0dce131f255 SHA512 a9e7c0c7945759a65859c7cdaa0603f9805ff1efbe82496f1e638b3ce387b4ecc3828c2b1f100ed49332a1456a62a87ac9f8b4c62ce0599da423875f026da243
 DIST passt-2025.01.21.tar.xz 237504 BLAKE2B 80aafe2fbf5ba8d4065fe99a892102e2c8d18ce82ef4cee3970deeb6d07cb89d40084cf4b90c7747dbb69e3895ad254872faad394b311950412cc89b9eae819d SHA512 e2e23040f05b65e666a7ccbbaa54621a575bdc22e21e518aa17dcfdebd82e95af49feadd20d58536f99b990428d404d6d2c64c34433353a4ac1656bf76bab6c6
 DIST passt-2025.02.17.tar.xz 254640 BLAKE2B 09a505a84e8555a1c4a010f9db6189b638ae3a3a6c1202d42e73d710bfc47f75b99defc372e8ecd44ec78ab196cd3619ecbb7eb171c9606bb4d425548a08159c SHA512 9eca3d9e20121f6b40b590f50e593d7a4ab3302b30d8da705aca5bcd40e2bbb686396830b5083c24fb088d5893a538dd92f2efed7d940bc1969f85f838560504
+DIST passt-2025.03.20.tar.xz 258228 BLAKE2B b0ddc3a24ee3b5988c79d57bdea893e6cba93b09d3ff6ab49f8e0cda3e93b97b044dcf6a873d65194766cf73fc21525133a33ac76c51cb4277e98438693ee98a SHA512 469593af3ee692363ee3814ec5dbaabe91acaff930c9e1665a6fa9b5b4475e261ccbc95972d7170134ced6e56c41a7733e570b1f3f1b20333364dad674a73da4
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2024.09.06.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2025.03.20.ebuild
similarity index 68%
rename from sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2024.09.06.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2025.03.20.ebuild
index fbff0b5258..22db227b28 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2024.09.06.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-2025.03.20.ebuild
@@ -8,16 +8,15 @@ inherit toolchain-funcs
 DESCRIPTION="User-mode networking daemons for VMs and namespaces, replacement for Slirp"
 HOMEPAGE="https://passt.top/"
 
-RELEASE_COMMIT="6b38f07"
-MY_PV="${PV//./_}.${RELEASE_COMMIT}"
+RELEASE_COMMIT="32f6212"
 
 if [[ ${PV} == 9999* ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://passt.top/passt"
 else
-	SRC_URI="https://passt.top/passt/snapshot/passt-${MY_PV}.tar.xz -> ${PF}.tar.xz"
-	S="${WORKDIR}/${PN}-${MY_PV}"
-	KEYWORDS="amd64 arm64 ~loong ~riscv"
+	SRC_URI="https://passt.top/passt/snapshot/passt-${RELEASE_COMMIT}.tar.xz -> ${P}.tar.xz"
+	S="${WORKDIR}/${PN}-${RELEASE_COMMIT}"
+	KEYWORDS="~amd64 ~arm64 ~loong ~riscv"
 fi
 
 LICENSE="BSD GPL-2+"
@@ -27,11 +26,13 @@ IUSE="static"
 src_prepare() {
 	default
 	tc-export CC
+	# Do not install doc/demo.sh
+	sed -i -e "/demo/d" Makefile || die
 }
 
 src_compile() {
 	[[ ${PV} != 9999* ]] && export VERSION="${PV}"
-	export prefix="${EPREFIX}/usr" docdir="${EPREFIX}/usr/share/doc/${PF}"
+	export prefix="${EPREFIX}/usr" docdir="${EPREFIX}/usr/share/doc/${P}"
 
 	emake $(usev static)
 }
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-9999.ebuild
index 46b6b649d2..22db227b28 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/passt/passt-9999.ebuild
@@ -8,7 +8,7 @@ inherit toolchain-funcs
 DESCRIPTION="User-mode networking daemons for VMs and namespaces, replacement for Slirp"
 HOMEPAGE="https://passt.top/"
 
-RELEASE_COMMIT="a1e48a0"
+RELEASE_COMMIT="32f6212"
 
 if [[ ${PV} == 9999* ]]; then
 	inherit git-r3
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index eeeb6a4250..def0fd9708 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -72,7 +72,7 @@ llvm-runtimes/openmp llvm_targets_AMDGPU
 
 # Sam James <sam@gentoo.org> (2022-12-11)
 # net-libs/rustls-ffi is not yet marked stable
-net-misc/curl rustls curl_ssl_rustls
+net-misc/curl rustls curl_ssl_rustls ech
 
 # Sam James <sam@gentoo.org> (2022-12-07)
 # Needs unstable media-libs/libvpl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index 854dc1c1c2..8d541963d3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2025-04-04)
+# Requires dev-qt/qtwebengine
+dev-util/nsight-compute
+dev-util/nsight-graphics
+
 # Z. Liu <zhixu.liu@gmail.com> (2025-01-23)
 # Requires dev-qt/qtwebengine
 net-misc/seafile-client
@@ -91,6 +96,7 @@ app-text/calibre
 app-text/cb2bib
 app-text/kchmviewer
 app-text/sigil
+app-text/uchmviewer
 dev-python/spyder
 dev-python/spyder-terminal
 dev-python/spyder-unittest
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/parent b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/parent
index f3229c5b98..154b8158dc 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/23.0-armv7a_sf/parent
@@ -1 +1,2 @@
 ..
+../../../features/wd40
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 074b55c517..8b3fe6d7e5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-02)
+# Needs kde-frameworks/breeze-icons which is not keyworded here.
+net-irc/quassel system-icons
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
new file mode 100644
index 0000000000..a0d604e7b0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/big-endian/package.mask
@@ -0,0 +1,9 @@
+# Copyright 2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License, v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-03-31)
+# gcc-14 fails to build (no idea about gcc-15 but upstream says
+# 14/15 regression)
+# https://bugs.gentoo.org/948045
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118891
+>=sys-devel/gcc-14
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index 62acfe613e..d431cb68e4 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Matt Jolly <kangie@gentoo.org> (2025-04-02)
+# Requires net-misc/gsasl which is not keyworded here
+net-misc/curl sasl-scram
+
 # Sam James <sam@gentoo.org> (2025-03-19)
 # media-libs/libebur128 not keyworded here
 media-video/pipewire loudness
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index bef6a6fe1e..5de2ab42c9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Conrad Kostecki <conikost@gentoo.org> (2025-04-02)
+# media-libs/libsdl3 is not keyworded
+app-emulation/faudio sdl3
+
 # NRK <nrk@disroot.org> (2025-03-17)
 # media-libs/libyuv is not keyworded
 media-libs/libavif libyuv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
index 98b9cee3e1..c66fee8f68 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
@@ -149,7 +149,7 @@ TWISTED_DISABLE_WRITING_OF_PLUGIN_CACHE="1"
 
 # Aaron W. Swenson <titanofold@gentoo.org> (2017-07-09)
 # Default target(s) for postgres{,-multi}.eclass
-POSTGRES_TARGETS="postgres16"
+POSTGRES_TARGETS="postgres17"
 
 # Michael Orlitzky <mjo@gentoo.org> (2017-11-17)
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 1b5b62934d..e5f1d455a6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -35,8 +35,8 @@ llvm-runtimes/libcxxabi clang
 #    echo "dev-lang/rust:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 #    echo "dev-lang/rust-bin:${slot} llvm_slot_${_RUST_LLVM_MAP[${slot}]}"
 # done
-dev-lang/rust:1.86.0 llvm_slot_19
-dev-lang/rust-bin:1.86.0 llvm_slot_19
+dev-lang/rust:1.86 llvm_slot_19
+dev-lang/rust-bin:1.86 llvm_slot_19
 dev-lang/rust:1.85.1 llvm_slot_19
 dev-lang/rust-bin:1.85.1 llvm_slot_19
 dev-lang/rust:1.85.0 llvm_slot_19
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
index ce763eba0a..e73e7f48e5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
@@ -66,6 +66,7 @@ kde-apps/eventviews
 kde-apps/calendarsupport
 kde-apps/calendarjanitor
 net-im/telegram-desktop
+dev-util/nsight-compute
 
 # matoro <matoro_gentoo@matoro.tk> (2023-11-16)
 # Test failures on BE (#700902)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index feb4f302e7..75a9c73dfa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -442,6 +442,9 @@ net-misc/netkit-rsh
 dev-libs/cudnn
 dev-libs/cudnn-frontend
 dev-python/pycuda
+dev-util/nsight-compute
+dev-util/nsight-graphics
+dev-util/nsight-systems
 dev-util/nvidia-cuda-toolkit
 dev-libs/optix
 media-libs/nvidia-vaapi-driver
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 8c0ebeb5ea..dfd7b15a2d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -345,7 +345,9 @@ gnome-extra/gnome-browser-connector
 gnome-extra/gnome-tweaks
 gnome-extra/sushi
 >=media-gfx/libimagequant-4
+media-gfx/gimp
 >=media-libs/libopenraw-0.3.2
+media-plugins/gimp-lqr
 media-video/rav1e
 net-analyzer/wtfis
 net-dns/pdns-recursor
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/use.mask
index cd95248c0a..024177163a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/use.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2025-04-03)
+# Needs Rustified librsvg.
+gimp
+
 # matoro <matoro_gentoo@matoro.tk> (2024-07-27)
 # media-video/rav1e requires Rust.
 rav1e
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 2469cb4780..3dba5a0521 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,10 +33,140 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2025-04-05)
+# New abseil/protobuf breaks too much:
+# * net-libs/grpc (bug #953141)
+# * media-libs/opencv (bug #953138)
+# * dev-libs/protobuf (bug #953140)
+=dev-cpp/abseil-cpp-20250127.0*
+=dev-cpp/abseil-cpp-20240722.1*
+=dev-cpp/abseil-cpp-20240116.3*
+=dev-cpp/abseil-cpp-20230802.3*
+=dev-libs/protobuf-30*
+=dev-ruby/google-protobuf-4.30*
+=dev-java/protobuf-java-4.30*
+=dev-python/protobuf-6.30*
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2025-04-04)
+# Temporary mask until handled the usage of shorter SLOT.
+# Bugs #953127, #953103.
+dev-lang/rust:1.86
+dev-lang/rust-bin:1.86
+
+# Matt Turner <mattst88@gentoo.org> (2025-04-04)
+# Package is dead (last release in 1999).
+# Not relevant today: purpose is to not overload a very slow system with
+# multiple X11 clients starting at the same time. SRC_URI is long dead.
+# Removal on 2025-05-04.  Bug #953120.
+x11-misc/xtoolwait
+
+# Matt Turner <mattst88@gentoo.org> (2025-04-04)
+# Package is dead and has a pile of patches to make it compile.
+# SRC_URI is long gone. Many alternative image viewers.
+# Removal on 2025-05-04.  Bug #953119.
+media-gfx/xloadimage
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-02)
+# Depends on Qt5WebEngine, and upstream seem to be having a hard time
+# porting to Qt6 with an unknown ETA likely well beyond the time we want
+# to keep dev-qt/qtwebengine:5 in ::gentoo.
+# Removal on 2025-04-30. Bug #926666
+media-video/jellyfin-media-player
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-02)
+# No release since 2021, no commit in 3 years, depends on Qt5WebEngine.
+# Use app-text/uchmviewer instead. Removal on 2025-04-30. Bug #823008
+app-text/kchmviewer
+
+# Ionen Wolkens <ionen@gentoo.org> (2025-04-02)
+# Masked for testing the new .0 version and leave time for packages
+# to catch up on support if needed. May or may keep masked until 6.9.1
+# depending on issues. If wanted, feel free to add `dev-qt/*:6/6.9.0`
+# to package.unmask and report issues.
+=dev-python/pyside-6.9.0*
+=dev-qt/qt-docs-6.9.0*
+=dev-qt/qt3d-6.9.0*
+=dev-qt/qt5compat-6.9.0*
+=dev-qt/qtbase-6.9.0*
+=dev-qt/qtcharts-6.9.0*
+=dev-qt/qtconnectivity-6.9.0*
+=dev-qt/qtdeclarative-6.9.0*
+=dev-qt/qthttpserver-6.9.0*
+=dev-qt/qtimageformats-6.9.0*
+=dev-qt/qtlanguageserver-6.9.0*
+=dev-qt/qtlocation-6.9.0*
+=dev-qt/qtmultimedia-6.9.0*
+=dev-qt/qtnetworkauth-6.9.0*
+=dev-qt/qtpositioning-6.9.0*
+=dev-qt/qtquick3d-6.9.0*
+=dev-qt/qtquicktimeline-6.9.0*
+=dev-qt/qtremoteobjects-6.9.0*
+=dev-qt/qtscxml-6.9.0*
+=dev-qt/qtsensors-6.9.0*
+=dev-qt/qtserialbus-6.9.0*
+=dev-qt/qtserialport-6.9.0*
+=dev-qt/qtshadertools-6.9.0*
+=dev-qt/qtspeech-6.9.0*
+=dev-qt/qtsvg-6.9.0*
+=dev-qt/qttools-6.9.0*
+=dev-qt/qttranslations-6.9.0*
+=dev-qt/qtvirtualkeyboard-6.9.0*
+=dev-qt/qtwayland-6.9.0*
+=dev-qt/qtwebchannel-6.9.0*
+=dev-qt/qtwebengine-6.9.0*
+=dev-qt/qtwebsockets-6.9.0*
+=dev-qt/qtwebview-6.9.0*
+
+# Matt Turner <mattst88@gentoo.org> (2025-04-01)
+# Very dead. Last release in 2007. Many open bugs (#712894, #882169, #894620,
+# #907400, #920478, #932284, #943891).
+# Removal on 2025-05-01.  Bug #949960.
+x11-terms/aterm
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-02)
+# Package destabilisation mask: Depends on Qt5WebEngine with no Qt6-based
+# release in sight. Snapshot is from a Qt6 work branch, so nowhere near
+# stabilisation material. Bug #926676
+~sci-geosciences/qmapshack-1.17.1
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-01)
+# Package destabilisation mask: No KF6-based- or ffmpeg-7 compatible
+# release in sight, needs xcb platform workaround, providing a snapshot
+# is the best we can do.
+~media-video/subtitlecomposer-0.8.1
+
+# Andreas Sturmlechner <asturm@gentoo.org> (2025-04-01)
+# Package destabilisation mask: No KF6-based release in sight, runtime-
+# defunct in Wayland sessions, providing a snapshot is the best we can do.
+~kde-misc/rsibreak-0.12.15
+
+# Norbert Norbiros <norbiros@protonmail.com> (2025-04-01)
+# Screen v5.0.0 has a lot of regressions
+# https://lists.gnu.org/archive/html/screen-devel/2024-10/msg00007.html
+# Unmask it after it is properly tested & fixed
+=app-misc/screen-5*
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2025-03-31)
+# Depends on broken dev-java/rxtx, bugs #761103, #867409, #874444, #898170
+# #927898.
+# Depends on dev-java/jgoodies-{common,looks} which are no longer available
+# "at no charge". https://www.jgoodies.com/downloads/libraries/#post-63
+# Removal on 2025-04-30.
+sci-geosciences/bt747
+dev-java/rxtx
+dev-java/swingx
+dev-java/swingx-beaninfo
+dev-java/swingx-ws
+dev-java/jchart2d
+dev-java/jcalendar
+dev-java/jgoodies-looks
+dev-java/jgoodies-common
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-03-30)
-# Depends on dev-python/python-poppler-qt5, stuck on py3.12, painful to
-# package. Use media-gfx/inkscape or app-text/pdfarranger alternatively.
-# Removal on 2025-04-29. Bugs #947726, #952250
+# Depends on dev-python/python-poppler-qt5, stuck on py3.12, new 0.7.0
+# release available w/ PyQt6 support would require packaging new pymupdf
+# dependency (bug #949686). Use media-gfx/inkscape or app-text/pdfarranger
+# alternatively. Removal on 2025-04-29. Bugs #947726, #952250
 app-text/krop
 
 # Conrad Kostecki <conikost@gentoo.org> (2025-03-28)
@@ -57,6 +187,8 @@ net-im/yowsup
 =app-emulation/virtualbox-7.1.6a
 =app-emulation/virtualbox-extpack-oracle-7.1.6
 =app-emulation/virtualbox-additions-7.1.6
+=app-emulation/virtualbox-modules-7.1.6
+=app-emulation/virtualbox-guest-additions-7.1.6-r1
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-03-25)
 # Package destabilisation mask after prolongued time w/o maintainer.
@@ -194,13 +326,6 @@ dev-python/bitvector
 sys-cluster/crmsh
 sys-cluster/pacemaker
 
-# Michał Górny <mgorny@gentoo.org> (2025-03-17)
-# The package has not been touched by the author since it's re-import
-# in 2022.  It uses legacy distutils-r1 build and still requires Python
-# 3.10.  It has no reverse dependencies.
-# Removal on 2025-04-16.  Bug #897196.
-sci-chemistry/ParmEd
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2025-03-17)
 # Database migration issues on upgrade, bug #951486
 ~app-office/kmymoney-5.1.92_p20250306
@@ -291,12 +416,6 @@ virtual/perl-Time-Piece
 # Mask experimental software
 =mail-mta/postfix-3.11*
 
-# Michał Górny <mgorny@gentoo.org> (2025-02-24)
-# Bad package with frequent release issues.  No reverse dependencies
-# left.  Use dev-python/zstandard instead (admittedly, also far
-# from perfect).  Removal on 2025-03-26.  Bug #950214.
-dev-python/zstd
-
 # Sam James <sam@gentoo.org> (2025-02-22)
 # (Only) needed for no-yet-released LibreOffice. Mask for now to avoid
 # unnecessary conflicts/backtracking for LO users.
@@ -311,25 +430,6 @@ dev-python/zstd
 dev-python/shiboken6
 dev-python/pyside6-tools
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2025-02-16)
-# Discontinued, please use xournal++ instead.
-# Removal on 2025-03-16. Bug 948200.
-app-text/xournal
-
-# Ionen Wolkens <ionen@gentoo.org> (2025-02-14)
-# No revdeps left, and serves no purpose on its own.  Formerly used
-# by <=app-emulation/wine-*-7 but <=7.x has been dropped and newer
-# versions of it cross-build their own .dll (PE) version of it
-# leaving the system's .so (ELF) copy unused.
-#
-# In other words, *can* use vkd3d with wine without this package.
-#
-# Not to be confused with app-emulation/vkd3d-proton which builds a
-# .dll usable as an alternative to wine's own.
-#
-# Removal on 2025-03-16.
-app-emulation/vkd3d
-
 # Maciej Barć <xgqt@gentoo.org> (2025-02-12)
 # Masked for testing. Fails to update from previous version. See bug #949626.
 >=x11-themes/fluent-icon-theme-2025.02.10
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
index 709360d865..7b793caf48 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
@@ -1,6 +1,15 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2025-04-05)
+# Fails to compile, implicit decl _NSGetExecutablePath
+=sys-apps/gawk-5.3.2
+
+# Sam James <sam@gentoo.org> (2025-04-01)
+# Fails to build w/ `error: implicit declaration of function 'clock_nanosleep'`
+# See bug #951918.
+=sys-libs/gdbm-1.25
+
 # Benda Xu <heroxbd@gentoo.org> (2023-08-20)
 # Does not play well with linkers under macOS.
 # Undefined symbols for architecture x86_64:
@@ -17,11 +26,6 @@ dev-libs/libbsd
 # embrace guile-3. (bug #825334)
 media-sound/lilypond
 
-# Fabian Groffen <grobian@gentoo.org> (2023-06-24)
-# Fails to link due to missing libintl, already fixed upstream:
-# https://git.savannah.gnu.org/cgit/tar.git/commit/?id=8632df398b2f548465ebe68b8f494c0d6f8d913d
-=app-arch/tar-1.35
-
 # Benda Xu <heroxbd@gentoo.org> (2023-07-09)
 # Requires Glibc <sys/xattr.h> to work properly.
 # For example, 'lgetxattr' is not available on macOS or gnulib.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
index 655447e9d1..fe45577b6b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/sunos/solaris/package.mask
@@ -1,11 +1,6 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Fabian Groffen <grobian@gentoo.org> (2023-06-23)
-# Fails to link due to missing libintl, already fixed upstream:
-# https://git.savannah.gnu.org/cgit/tar.git/commit/?id=8632df398b2f548465ebe68b8f494c0d6f8d913d
-=app-arch/tar-1.35
-
 # Benda Xu <heroxbd@gentoo.org> (2023-07-09)
 # Requires Glibc <sys/xattr.h> to work properly.
 # For example, 'lgetxattr' is not available on Solaris or gnulib.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025 b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025
new file mode 100644
index 0000000000..8cd13e2d86
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2025
@@ -0,0 +1 @@
+move kde-apps/spectacle kde-plasma/spectacle
diff --git a/sdk_container/src/third_party/portage-stable/profiles/use.desc b/sdk_container/src/third_party/portage-stable/profiles/use.desc
index 36468b321d..77398b7696 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/use.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/use.desc
@@ -163,7 +163,7 @@ kde - Add support for software made by KDE, a free software community
 kerberos - Add kerberos support
 keyring - Enable support for freedesktop.org Secret Service API password store
 ladspa - Enable the ability to support ladspa plugins
-lame - Prefer using LAME libraries for MP3 encoding support
+lame - Add support for MP3 encoding using LAME
 lapack - Add support for the virtual/lapack numerical library
 lash - Add LASH Audio Session Handler support
 latex - Add support for LaTeX (typesetting package)
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
index d0791550bd..846518eebf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1+ GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="nls static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
index 11435b471e..87c9ffc987 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/Manifest
@@ -7,3 +7,5 @@ DIST coreutils-9.5.tar.xz.sig 833 BLAKE2B 37c29984bceee0ff3bffde76712f71dbb118c2
 DIST coreutils-9.6-patches.tar.xz 5904 BLAKE2B 1abe214914007804362b9d7c1a7c39f07d74c51857e84484179f11bb8fa512356ee97c811ef62469aaa52db5cc90f2f7587c2dc57ed130ebbfdacc59755dcb90 SHA512 5a609b21da7c78e41184e5d7bca87da4f868975635b6e8aa4bd8f4d18c98a2fabd5b7e8ad6bf7780ca77f6d532bfa5cb1ed618e4bc32617ba2977d4b8a885b9f
 DIST coreutils-9.6.tar.xz 6134764 BLAKE2B 4070d3d272851d3e9c326df9c05ce67797d86852e7f5c26e545f987f444295f2cfca24e8569514d7b5edf8fd50318d07cb20dea4a4ce8c65b34bea0c5a9177be SHA512 398391d7f9d77e6117b750abb8711eebdd9cd2549e7846cab26884fb2dd522b6bcfb8bf7fef35a12683e213ada7f89b817bf615628628d42aee3fa3102647b28
 DIST coreutils-9.6.tar.xz.sig 833 BLAKE2B a9ea9773746d21b526e69ca2ff7637f3dcef4a921da943f281c4d16fed2d8f9eff92353e1ceafbbc8cfe4b9b23bf123bf64dcd79ff598759373c50739a5046c6 SHA512 a8e578b5e1d053b49e3e2c5dc94431d17c6a14662f459b2174cea23865ccca32e5ae5c13fedb0a8345d25269a9b98cb7f463a897c9663f9f9bcaf61e5c781378
+DIST coreutils-9.6_p20250406.tar.xz 6153440 BLAKE2B 39a7008ce18f88a67188b7d687cb5a7e6ec973c6894c55b8968a1ba48660354f754ff0a8a1887cfc991ac1bd7bc74ad4a2ed457420ca427baabea6686599c66f SHA512 833ed305150c80469d9e8d8c21841d6ff08571b42b067a6f3e3f2c23395051389a62632dd16f752508fb8ca9c095f0c783cf87d6e12c1fc63093d4f5aade5984
+DIST coreutils-9.6_p20250406.tar.xz.sig 833 BLAKE2B 87a3626126ec4e34d874630fccf5785cb38a60457100f0ebade9a5a07163d77788425814c683a61d6661e67f7ce0e3f1e5309342c7d5280fdcc66cdb82c5f224 SHA512 fa39eeb7bf0cbe140346ef9280ee43aea7ac6c2f9e440c27d9f27f04e35dbcea8648ce03d9a29589aa10af08ea55e6821b8b1870cd9260dc20a73a8b3af4dddf
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6_p20250406.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6_p20250406.ebuild
new file mode 100644
index 0000000000..e5e3c773c3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9.6_p20250406.ebuild
@@ -0,0 +1,302 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Try to keep an eye on Fedora's packaging: https://src.fedoraproject.org/rpms/coreutils
+# The upstream coreutils maintainers also maintain the package in Fedora and may
+# backport fixes which we want to pick up.
+#
+# Also recommend subscribing to the coreutils and bug-coreutils MLs.
+
+PYTHON_COMPAT=( python3_{10..13} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/coreutils.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+MY_PATCH="${PN}-9.6-patches"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/coreutils.git"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).53-14af8"
+	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+fi
+
+SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="acl caps gmp hostname kill multicall nls +openssl selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="
+	acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	openssl? ( dev-libs/openssl:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	test? (
+		dev-debug/strace
+		dev-lang/perl
+		dev-perl/Expect
+		${PYTHON_DEPS}
+	)
+	verify-sig? ( sec-keys/openpgp-keys-coreutils )
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs (bug #898370)
+	unreachable MIN alignof static_assert
+)
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+
+		sed -i -e "s:submodule-checks ?= no-submodule-changes public-submodule-commit:submodule-checks ?= no-submodule-changes:" gnulib/top/maint.mk || die
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# TODO: past 2025, we may need to add our own hack for bug #907474.
+	local PATCHES=(
+		# Upstream patches
+	)
+
+	if ! use vanilla && [[ -d "${WORKDIR}"/${MY_PATCH} ]] ; then
+		PATCHES+=( "${WORKDIR}"/${MY_PATCH} )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1} || die
+
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
+	fi
+}
+
+src_configure() {
+	# TODO: in future (>9.4?), we may want to wire up USE=systemd:
+	# still experimental at the moment, but:
+	# https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=85edb4afbd119fb69a0d53e1beb71f46c9525dd0
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		$(usev !caps --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp libgmp)
+		$(use_with openssl)
+	)
+
+	if use gmp ; then
+		myconf+=( --with-libgmp-prefix="${ESYSROOT}"/usr )
+	fi
+
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
+
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}" || die
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+
+	#local -x RUN_EXPENSIVE_TESTS="yes"
+	#local -x COREUTILS_GROUPS="portage wheel"
+	local -x PATH="${T}/mount-wrappers:${PATH}"
+	local -x gl_public_submodule_commit=
+
+	local xfail_tests=()
+
+	if [[ -n ${SANDBOX_ACTIVE} ]]; then
+		xfail_tests+=(
+			# bug #629660
+			# Commented out again in 9.6 as it XPASSes on linux-6.12.10
+			# with sandbox-2.43 on tmpfs. Let's see if it lasts..
+			#tests/dd/no-allocate.sh
+
+			# bug #675802
+			tests/env/env-S
+			tests/env/env-S.pl
+
+			# We have a patch which fixes this (bug #259876)
+			#tests/touch/not-owner
+			#tests/touch/not-owner.sh
+		)
+	fi
+
+	# This test is flaky (bug #910640).
+	cat > tests/tty/tty-eof.pl <<-EOF || die
+	#!/usr/bin/perl
+	exit 77;
+	EOF
+
+	# We set DISABLE_HARD_ERRORS because some of the tests hard error-out
+	# because of sandbox. They're skipped above but DISABLE_HARD_ERRORS is needed
+	# to downgrade them to FAIL.
+	emake -k check \
+		VERBOSE=yes \
+		DISABLE_HARD_ERRORS=yes \
+		XFAIL_TESTS="${xfail_tests[*]}"
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+
+		# Move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
+			mv hostname ../../bin/ || die
+		fi
+
+		if use kill ; then
+			mv kill ../../bin/ || die
+		fi
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place...)
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9999.ebuild
index 1354868018..e5e3c773c3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/coreutils/coreutils-9999.ebuild
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 elif [[ ${PV} == *_p* ]] ; then
 	# Note: could put this in devspace, but if it's gone, we don't want
 	# it in tree anyway. It's just for testing.
-	MY_SNAPSHOT="$(ver_cut 1-2).185-541b02"
+	MY_SNAPSHOT="$(ver_cut 1-2).53-14af8"
 	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
 	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
@@ -234,15 +234,6 @@ src_test() {
 			tests/env/env-S
 			tests/env/env-S.pl
 
-			# bug #413621 and bug #548250
-			tests/du/long-from-unreadable.sh
-			tests/ls/removed-directory
-			tests/ls/removed-directory.sh
-			tests/ls/stat-free-symlinks
-			tests/ls/stat-free-symlinks.sh
-			tests/rm/deep-2
-			tests/rm/deep-2.sh
-
 			# We have a patch which fixes this (bug #259876)
 			#tests/touch/not-owner
 			#tests/touch/not-owner.sh
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
index 0d012a91e8..f36947282a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
@@ -1,4 +1,6 @@
 DIST diffutils-3.10.tar.xz 1624240 BLAKE2B 24a90162b3d876e6378243f19a85a1f1bb4cdfe98d130dee684740a902f2987509d5830dd32df4e26678b468b96960f6f9785ffb922e828cb8b4acce0d8587f6 SHA512 219d2c815a120690c6589846271e43aee5c96c61a7ee4abbef97dfcdb3d6416652ed494b417de0ab6688c4322540d48be63b5e617beb6d20530b5d55d723ccbb
 DIST diffutils-3.10.tar.xz.sig 833 BLAKE2B 06650838d6a3327fda6b2ab09693170ec18b730b1f5981c8f3e2180b2c8a553307ae93199e4be0532a534a8a3f95e4a7b4fccbbd9e5f8d1b1cedd0816b0aac90 SHA512 91aa1fcfca224454e292540ea7813f4a0eb348f06a4374017326d524949775359fc833de597cc201c97f357eb6c675800828a6e3332572376f3554f1f2e1aca1
+DIST diffutils-3.11.11-7e53.tar.xz 1937668 BLAKE2B 16ac12d27c68efeb2b01e35e7ff8a98d081f1d67f72688c20d65067730eca6f8d3759bff3dd5fde04c8994ac9e93e685ffb4da4419b7a29f03c778fcb0cb607f SHA512 a99b6105e8d856626cb7f03847a5340b5cccfa951bc332af39f470f1cf75ed73b6bd8da035905f83add0c054a6d8232c1098673a8087974e6aa4acfc1cf669a1
+DIST diffutils-3.11.11-7e53.tar.xz.sig 833 BLAKE2B 9bbc84b91cd89335891bd522a036820f602a43bb268944c899944ecb67288c84938f71598d0b2ffb43cab3fce11c96f70b72bfab0617845f367b01c608e24152 SHA512 6a4ac048828e5bd2ca58d251b2fa8c502540aa08fb04dce2b77f3a4b99388312816c9925e976118cd5bd5d6d3cac12a92c89dd17d709d48a39c30aefe84e824d
 DIST diffutils-3.11.tar.xz 1926052 BLAKE2B e3d78548d1fbee060a9e0a7ee93f4aebaa80a9ff15867f13e2f1d09672e2b1e8dcf01f264d5184c441bc81b0b1a797210cbf4a1f9b8ba061994066e710e79fc1 SHA512 a381ee6bcbbead155ab6ea1aecc167ab1077c6d95133a876e26284b60bcaae26f01c62eaee400c86302b74fa8ab0c5239b7860ea86478b739ddc304367a35960
 DIST diffutils-3.11.tar.xz.sig 833 BLAKE2B 5b7f8d8b0ec2f1443270f9291acfd6ec7833268c5287d98225fb997efcfbbbec2e27f565226ae7d350576765689d7efd352b83c5a3ffca113963d9ec86b6a467 SHA512 81ac0cff6b9015758182e41688df70244f1ceac77835e0b06cb2c6c8ca89d93d1567010fed9b216bd65ebde8fcb89f162cc3112aa01f05b5b05f4a26f6fe69d7
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.11_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.11_p20250405.ebuild
new file mode 100644
index 0000000000..c589db9156
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.11_p20250405.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/diffutils.asc
+inherit verify-sig
+
+DESCRIPTION="Tools to make diffs and compare files"
+HOMEPAGE="https://www.gnu.org/software/diffutils/"
+
+if [[ ${PV} == *_p* ]] ; then
+	# Subscribe to the 'platform-testers' ML to find these.
+	# Useful to test on our especially more niche arches and report issues upstream.
+	MY_COMMIT="11-7e53"
+	MY_P=${PN}-$(ver_cut 1-2).${MY_COMMIT}
+	SRC_URI="https://meyering.net/diff/${MY_P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://meyering.net/diff/${MY_P}.tar.xz.sig )"
+	S="${WORKDIR}"/${MY_P}
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="nls"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-diffutils )
+"
+RDEPEND="
+	nls? ( app-i18n/gnulib-l10n )
+"
+
+src_prepare() {
+	default
+
+	# Needed because of patches to avoid perl BDEPEND (affects Prefix too)
+	#touch man/diff.1 || die
+}
+
+src_configure() {
+	# Disable automagic dependency over libsigsegv; see bug #312351.
+	export ac_cv_libsigsegv=no
+
+	# required for >=glibc-2.26, bug #653914
+	use elibc_glibc && export gl_cv_func_getopt_gnu=yes
+
+	local myeconfargs=(
+		# Interferes with F_S (sets F_S=2)
+		--disable-gcc-warnings
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR}"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		$(use_enable nls)
+	)
+	econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
index d84acc4be1..bffa23d001 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
@@ -15,8 +15,8 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/file.asc
 	inherit autotools verify-sig
-	SRC_URI="http://ftp.astron.com/pub/file/${P}.tar.gz"
-	SRC_URI+=" verify-sig? ( http://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
 
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
index ae069ac59e..bf8ef8f09f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.46-r2.ebuild
@@ -15,8 +15,8 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/file.asc
 	inherit libtool verify-sig
-	SRC_URI="http://ftp.astron.com/pub/file/${P}.tar.gz"
-	SRC_URI+=" verify-sig? ( http://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
index 235a8c9910..12182441c5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-9999.ebuild
@@ -15,8 +15,8 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/file.asc
 	inherit libtool verify-sig
-	SRC_URI="http://ftp.astron.com/pub/file/${P}.tar.gz"
-	SRC_URI+=" verify-sig? ( http://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
+	SRC_URI="https://astron.com/pub/file/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://astron.com/pub/file/${P}.tar.gz.asc )"
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
index 279ee1c97f..2221c8ff94 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
@@ -1,2 +1,4 @@
 DIST gawk-5.3.1.tar.xz 3510032 BLAKE2B be9132324344c0b052e954e004a942ff7c6b14b86b73cda491d7a33485f60341be4d8da1a06d1d7a27445b9b39a528bcce3eee9c2a3f8756de21bdc57a33f54d SHA512 c6b4c50ce565e6355ca162955072471e37541c51855c0011e834243a7390db8811344b0c974335844770e408e1f63d72d0d81459a081c392e0245c726019eaff
 DIST gawk-5.3.1.tar.xz.sig 488 BLAKE2B 2abafbb965912a194d047bed3ac1ef33a2b44dce0bc4b1a83a6ca3e2ecf676da0ad8333bb3817f0f32c7d67ab8662dc6086c9e1d6f2185a93d786390197fc643 SHA512 3e13b1bd598b7d4c715c802dcc9db298aeab12721620692f9dd76d3941fdfd87381f660c93be5cc04b6cd7378a6464b9033c93419dfcb514dcc33da8d0d9f502
+DIST gawk-5.3.2.tar.xz 3749260 BLAKE2B 8536777bb45c63d737ef08b3f1b98285cb29ec54400e35b2139c2bc66b464e3ec4950274614d95d94dc7eae18c57333b7c30a44d993855258155fc82b749042a SHA512 2268150fa35ae049a6ff3d0d0fa110db10477014c25f50e2ab4e3ee5fd60133369d2a994f59db4eb718020a0af5c4003ae7278c63e7fffa72f431ff4a1429e48
+DIST gawk-5.3.2.tar.xz.sig 488 BLAKE2B ea843fce8ca2b93a8006260e8022f3426daccc18b93bd75ef1fb18e391ce110a10682e75509d771ba9c419d1e22a584f66ff9a436512b76b039a85afed6c7596 SHA512 490f29271d06f374e25e13724f5944215734d0c6da465da5b2a723e83fa31a03c7a16e5c8853465561bc0676139588b1046c598554ccde4ae24563455ee28b65
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
new file mode 100644
index 0000000000..9972bde7f7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.3.2.ebuild
@@ -0,0 +1,111 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+#GAWK_IS_BETA=yes
+
+DESCRIPTION="GNU awk pattern-matching language"
+HOMEPAGE="https://www.gnu.org/software/gawk/gawk.html"
+
+if [[ ${GAWK_IS_BETA} == yes || ${PV} == *_beta* ]] ; then
+	if [[ ${PV} == *_beta* ]] ; then
+		# Beta versioning is sometimes for the release prior, e.g.
+		# 5.2.1_beta is labelled upstream as 5.2.0b.
+		MY_PV=${PV/_beta/b}
+		MY_PV=$(ver_cut 1-2 ${MY_PV}).$(($(ver_cut 3 ${MY_PV}) - 1))$(ver_cut 4- ${MY_PV})
+		MY_P=${PN}-${MY_PV}
+
+		S="${WORKDIR}"/${MY_P}
+	else
+		MY_P=${P}
+	fi
+
+	SRC_URI="https://www.skeeve.com/gawk/${MY_P}.tar.gz"
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gawk.asc
+	inherit verify-sig flag-o-matic
+
+	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+# While tempting to enable mpfr by default as e.g. Fedora do, as of 5.2.x,
+# MPFR support is "on parole" and may be removed:
+# https://www.gnu.org/software/gawk/manual/html_node/MPFR-On-Parole.html.
+IUSE="mpfr pma nls readline"
+
+RDEPEND="
+	mpfr? (
+		dev-libs/gmp:=
+		dev-libs/mpfr:=
+	)
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=sys-apps/texinfo-7.1
+	>=sys-devel/bison-3.5.4
+	nls? ( sys-devel/gettext )
+"
+
+if [[ ${GAWK_IS_BETA} != yes ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-gawk )"
+fi
+
+src_prepare() {
+	default
+
+	use elibc_musl && append-cppflags -D__GNU_LIBRARY__
+
+	# Use symlinks rather than hardlinks, and disable version links
+	sed -i \
+		-e '/^LN =/s:=.*:= $(LN_S):' \
+		-e '/install-exec-hook:/s|$|\nfoo:|' \
+		Makefile.in doc/Makefile.in || die
+
+	# bug #413327
+	sed -i '/^pty1:$/s|$|\n_pty1:|' test/Makefile.in || die
+
+	# Fix standards conflict on Solaris
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i \
+			-e '/\<_XOPEN_SOURCE\>/s/1$/600/' \
+			-e '/\<_XOPEN_SOURCE_EXTENDED\>/s/1//' \
+			extension/inplace.c || die
+	fi
+}
+
+src_configure() {
+	# README says gawk may not work properly if built with non-Bison.
+	# We already BDEPEND on Bison, so just unset YACC rather than
+	# guessing if we need to do yacc.bison or bison -y.
+	unset YACC
+
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		--libexec='$(libdir)/misc'
+		$(use_with mpfr)
+		$(use_enable nls)
+		$(use_enable pma)
+		$(use_with readline)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	# Automatic dodocs barfs
+	rm -rf README_d || die
+
+	default
+
+	# Install headers
+	insinto /usr/include/awk
+	doins *.h
+	rm "${ED}"/usr/include/awk/config.h || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
index 0f0873e8b5..7ba806bc61 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/grep/Manifest
@@ -1,2 +1,6 @@
+DIST grep-3.11.68-05f8.tar.xz 1917200 BLAKE2B 9e2f71c716410afa66d94e90dd2efc0a0666495b0bd4c0e0e29f7ef13aaf815e24901d74d9608b8fae3cba8487121946d2aec36a37513e65dc66080951a2855f SHA512 c449cd9ecf2fd35ede9521d707bfb9be13bad8368244c277dde9ae1ad39205eb4445e726b0775d60d9c56ad3d0af2d3136869d6199a71aec7486c40df34f30e6
+DIST grep-3.11.68-05f8.tar.xz.sig 833 BLAKE2B 75ac09556bfbf3d102c648331f2b2ec9854df6ffc4dbb677856d2b915db2357039ee13bc9fdd5e330183148695e4a3f20ef92c1712308861af189d281268be64 SHA512 fa6773f4088c6523fd697fdfa001c47e0b8d3b4d3f1ba23a8213cf15b9aa9aa928c09755aa6269bc8121c567f57fe9f6d823714f479b99882c0e7075b479ef18
+DIST grep-3.11.69-a4628.tar.xz 1917544 BLAKE2B 575ea74c3a84f75c17b5dd39e0ada56cd559ca09f566c3d5163aec31d5b70720569b739251c8b7ce5b813819893b4bfb170dc70a93b7abab7a4c5648e179cff9 SHA512 280804275b4aacf72a6d50894d0024d1455375d2bb0550ce20211f9d66da6b0e942ea6186447e38b27fc5861e177b86f657c24477fce4a4a797e2b0dcf34e9f9
+DIST grep-3.11.69-a4628.tar.xz.sig 833 BLAKE2B f9fe9425ea8d5e304678618d3d9668ee21f5ef159714e4b35b486d2420b33480b55bdae779504bd3103f27957ffceaa0e8f109f5c779608ab59da57c68a8f6dd SHA512 45db55b8f172d672513d8703ad5ff777818ba71e216ce018aa86aa4059aaf2450cb26ae8144039c39e3fa41563d7b0707a77a3344feadf369d648f244c048ca2
 DIST grep-3.11.tar.xz 1703776 BLAKE2B e21785bca20b5a090d32bb5dc525fb298af30165106ed4c289b1518ea3d2acdcacfd6309b12f13be29a4b958f19588546119c695deb2b7500d49dcff86357bdc SHA512 f254a1905a08c8173e12fbdd4fd8baed9a200217fba9d7641f0d78e4e002c1f2a621152d67027d9b25f0bb2430898f5233dc70909d8464fd13d7dd9298e65c42
 DIST grep-3.11.tar.xz.sig 833 BLAKE2B 5edfba20e3a9f54d25ae63cf04985382bf6afb0ca643979561321090614e68b5d234767b07e48211888722c52c441233093735e183ff69432d5ee2e6a4f53aea SHA512 487aba063373ca0594c519991f19b2a6a33b3da0d74735c890f3828fd0880e7e6f64495d2c8f9efa5da53d1eb2d446609bab2399a4b89dcb4510a632e31ffb54
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild
new file mode 100644
index 0000000000..27efce25ff
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250405.ebuild
@@ -0,0 +1,118 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/grep.asc
+inherit flag-o-matic verify-sig
+
+DESCRIPTION="GNU regular expression matcher"
+HOMEPAGE="https://www.gnu.org/software/grep/"
+
+if [[ ${PV} == *_p* ]] ; then
+	# Subscribe to the 'platform-testers' ML to find these.
+	# Useful to test on our especially more niche arches and report issues upstream.
+	MY_COMMIT="68-05f8"
+	MY_P=${PN}-$(ver_cut 1-2).${MY_COMMIT}
+	SRC_URI="https://meyering.net/${PN}/${MY_P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://meyering.net/${PN}/${MY_P}.tar.xz.sig )"
+	S="${WORKDIR}"/${MY_P}
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="+egrep-fgrep nls pcre static"
+
+# We lack dev-libs/libsigsegv[static-libs] for now
+REQUIRED_USE="static? ( !sparc )"
+
+LIB_DEPEND="
+	pcre? ( >=dev-libs/libpcre2-10.42-r1[static-libs(+)] )
+	sparc? ( dev-libs/libsigsegv )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	nls? ( virtual/libintl )
+	virtual/libiconv
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-grep )
+"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# Either gnulib FPs or fixed in newer autoconf, not worth autoreconf here for now?
+	MIN
+	alignof
+	static_assert
+)
+
+src_prepare() {
+	default
+
+	# bug #523898
+	sed -i \
+		-e "s:@SHELL@:${EPREFIX}/bin/sh:g" \
+		-e "s:@grep@:${EPREFIX}/bin/grep:" \
+		src/egrep.sh || die
+
+	# Drop when grep-3.11-100k-files-dir.patch is gone
+	#touch aclocal.m4 config.hin configure {,doc/,gnulib-tests/,lib/,src/,tests/}Makefile.in || die
+}
+
+src_configure() {
+	use static && append-ldflags -static
+
+	# We used to turn this off unconditionally (bug #673524) but we now
+	# allow it for cases where libsigsegv is better for userspace handling
+	# of stack overflows.
+	# In particular, it's necessary for sparc: bug #768135
+	export ac_cv_libsigsegv=$(usex sparc)
+
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/bin
+		$(use_enable nls)
+		$(use_enable pcre perl-regexp)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	if use egrep-fgrep ; then
+		# Delete the upstream wrapper variants which warn on egrep+fgrep use
+		rm "${ED}"/bin/{egrep,fgrep} || die
+
+		into /
+		# Install egrep, fgrep which don't warn.
+		#
+		# We do this by default to avoid breakage in old scripts
+		# and such which don't expect unexpected output on stderr,
+		# we've had examples of builds failing because foo-config
+		# starts returning a warning.
+		#
+		# https://lists.gnu.org/archive/html/bug-grep/2022-10/msg00000.html
+		newbin - egrep <<-EOF
+		#!/usr/bin/env sh
+		exec "${EPREFIX}/bin/grep" -E "\$@"
+		EOF
+
+		newbin - fgrep <<-EOF
+		#!/usr/bin/env sh
+		exec "${EPREFIX}/bin/grep" -F "\$@"
+		EOF
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250407.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250407.ebuild
new file mode 100644
index 0000000000..38c64f263a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/grep/grep-3.11_p20250407.ebuild
@@ -0,0 +1,118 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/grep.asc
+inherit flag-o-matic verify-sig
+
+DESCRIPTION="GNU regular expression matcher"
+HOMEPAGE="https://www.gnu.org/software/grep/"
+
+if [[ ${PV} == *_p* ]] ; then
+	# Subscribe to the 'platform-testers' ML to find these.
+	# Useful to test on our especially more niche arches and report issues upstream.
+	MY_COMMIT="69-a4628"
+	MY_P=${PN}-$(ver_cut 1-2).${MY_COMMIT}
+	SRC_URI="https://meyering.net/${PN}/${MY_P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://meyering.net/${PN}/${MY_P}.tar.xz.sig )"
+	S="${WORKDIR}"/${MY_P}
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="+egrep-fgrep nls pcre static"
+
+# We lack dev-libs/libsigsegv[static-libs] for now
+REQUIRED_USE="static? ( !sparc )"
+
+LIB_DEPEND="
+	pcre? ( >=dev-libs/libpcre2-10.42-r1[static-libs(+)] )
+	sparc? ( dev-libs/libsigsegv )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	nls? ( virtual/libintl )
+	virtual/libiconv
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-grep )
+"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# Either gnulib FPs or fixed in newer autoconf, not worth autoreconf here for now?
+	MIN
+	alignof
+	static_assert
+)
+
+src_prepare() {
+	default
+
+	# bug #523898
+	sed -i \
+		-e "s:@SHELL@:${EPREFIX}/bin/sh:g" \
+		-e "s:@grep@:${EPREFIX}/bin/grep:" \
+		src/egrep.sh || die
+
+	# Drop when grep-3.11-100k-files-dir.patch is gone
+	#touch aclocal.m4 config.hin configure {,doc/,gnulib-tests/,lib/,src/,tests/}Makefile.in || die
+}
+
+src_configure() {
+	use static && append-ldflags -static
+
+	# We used to turn this off unconditionally (bug #673524) but we now
+	# allow it for cases where libsigsegv is better for userspace handling
+	# of stack overflows.
+	# In particular, it's necessary for sparc: bug #768135
+	export ac_cv_libsigsegv=$(usex sparc)
+
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/bin
+		$(use_enable nls)
+		$(use_enable pcre perl-regexp)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	if use egrep-fgrep ; then
+		# Delete the upstream wrapper variants which warn on egrep+fgrep use
+		rm "${ED}"/bin/{egrep,fgrep} || die
+
+		into /
+		# Install egrep, fgrep which don't warn.
+		#
+		# We do this by default to avoid breakage in old scripts
+		# and such which don't expect unexpected output on stderr,
+		# we've had examples of builds failing because foo-config
+		# starts returning a warning.
+		#
+		# https://lists.gnu.org/archive/html/bug-grep/2022-10/msg00000.html
+		newbin - egrep <<-EOF
+		#!/usr/bin/env sh
+		exec "${EPREFIX}/bin/grep" -E "\$@"
+		EOF
+
+		newbin - fgrep <<-EOF
+		#!/usr/bin/env sh
+		exec "${EPREFIX}/bin/grep" -F "\$@"
+		EOF
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-1.1.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-1.1.0-r3.ebuild
index 2b3147f389..0574572cf0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-1.1.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-1.1.0-r3.ebuild
@@ -163,7 +163,7 @@ else
 		https://github.com/jthornber/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
 		${CARGO_CRATE_URIS}
 	"
-	KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="amd64 arm arm64 ~loong ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="GPL-3"
diff --git a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.0.ebuild
index 746849679d..36a058e28b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-boot/gnu-efi/gnu-efi-4.0.0.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://github.com/ncroxon/gnu-efi/archive/${PV}.tar.gz -> ${P}.tar.gz"
 # - GPL-2+ : setjmp_ia32.S
 LICENSE="GPL-2+ BSD BSD-2"
 SLOT="0"
-KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
+KEYWORDS="-* amd64 arm arm64 ~loong ~riscv x86"
 IUSE="abi_x86_32 abi_x86_64 custom-cflags"
 REQUIRED_USE="
 	amd64? ( || ( abi_x86_32 abi_x86_64 ) )
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index d7f3714af6..5dc9b00c73 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -8,14 +8,17 @@ DIST gcc-12-20241219.tar.xz 79920016 BLAKE2B 71044352515f33eaf0bcc64cc6eacdecb8b
 DIST gcc-12-20250227.tar.xz 79915940 BLAKE2B 0adb19847cb3f317316549f657434654b9923806366a4b95e496effea9c07995b7d3de65c40cc2f62ba1e87cfb0f8cd8a1a833284042fdc5e6fce2bd7e7e9543 SHA512 d01cad1771762f5b56c783d6a3b39415be1c7619229b5ff056fe40ef0bf821c67a2d1a2272c2227a44f92825582579625352d19e2342d11f76a079556dae0ae8
 DIST gcc-12-20250320.tar.xz 79921688 BLAKE2B cafdd710d1bf04083f8db4cce873667caded67961b701760f95e95f76ad98924582b51752061fe404e2e7f6dbab4215e0fe5c4436826ac320d9bd224ae7a061c SHA512 1dc331f1a942c4a10ae56fc234bcc37c72dd720df1cb9e1aa1802092307378abffd83b887b718a8f8d11c16296c0a7aa53011a7358aea86c8e60522d8f50e76d
 DIST gcc-12-20250327.tar.xz 79923680 BLAKE2B 7bbe5a736f42ad9e04740b6c8adcb06ae8bd405e32b4f45897c76c15eb24428a55827f2ba715456c48a906d02693b42b280f8b73e61926d05c4c99316de4a4b3 SHA512 8cf3aced94a42635b68f7a0f57e831d09718d1674272ee9134c1419a81a2b6f7d056f156ff3b0c5565c098eb62334d318a1320a268e6713a3c64ac59c5ad910a
+DIST gcc-12-20250403.tar.xz 79905284 BLAKE2B 768f10e1dd000f0f409552ad73198df6eb9c8f7f5950b9e0995700e76a71dfc7732d2ae176807f1410d48191bc457bca895bc3142ba8166c3225b264e204c2bc SHA512 c2df1232658a7a58def2ebdb991f09487b5badf8ab1fbd265308fabf54e329acd7307971861ac143271fef5a6ce93791ea4278faad7e960419072abe5f4a9984
 DIST gcc-12.4.0-musl-patches-1.tar.xz 3068 BLAKE2B e5e39c24934072ea89e4467d0dc5196f3dadfb5ffba0c856d051648a2fbf57d434a57e95227cdf2b8cea45f0f5555aec2bc372d2f6cb0b69efd87831d248d364 SHA512 b9db204845a25be043d76cae826d42eebeeb4f9be7c3049af6fe7601a552bedfd24731156a6a36b4b5e2e2af656a589a5c556d2b0b3ded33ba290a773ee87c62
 DIST gcc-12.4.0-patches-1.tar.xz 15576 BLAKE2B 98c29888de7701b365be7ac9062f0cee3340d58c85485e26f0d02f1483ec64cc9c10651488a4fd937551afe30f4e19777e6766871a724ae3ba6c290c16f4fdf1 SHA512 3f7c5d36e56e07ea9dd143a5d13342a6c1ccbf0643abd1c0bcbfb46bb7c7b1308aef6e3e882031c9c191610f01af906b19be5aa2b139cf617614f46e97463aec
 DIST gcc-12.4.0-patches-2.tar.xz 14876 BLAKE2B 6bf5abbb2abba4b9fe9fa153ac4112fe5f563e97cd4e1b885ccd0d88abf1124fa91f20d6be972e2242410447be73bca60014785f8551b8087ed0d4cc3e868225 SHA512 dfd5f02d4c1076fad4ee998b2f620171dd3eb65a1160312def9dae89b18327a06db853f569e0e3c049e5ab06c61488bb6faecec52bafe737fddeb43628c54a1f
+DIST gcc-12.4.0-patches-3.tar.xz 14140 BLAKE2B cc73805b2c1f9f6a8d96b2a31d79ce0034ebc3ef1976e78e8ec4f2649c33cef48acee943773de5e03b891128f37e4d72c07d7f4c0bd6d473e484a4b6a9df9f25 SHA512 a93c6bc7d2bd1d7b80bfc6b16c042ac6d3cb6e15cada16041baa48b8023d857b4a1557f4620c46646136daece6566655523010366411aa9fad671398efb03b6f
 DIST gcc-12.4.0.tar.xz 83377372 BLAKE2B 0d5aa9995bf53fa2dc976a846240cfb8fafd125ad6c54f45dc9d770215eae3e9ea0db82a9a4f79c51b4d5f8461a1d730c17db6841bc31bd96dba11d9ed7544ae SHA512 5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853
 DIST gcc-13-20241220.tar.xz 84504500 BLAKE2B 60d6dcdcafa36399a0c0de7fef3a4eb4ca8e0b6780cd31c9eace2965c53115205bf64e8247b833a4375c1e3ad2d94820b5bdc97a4689be95d8ab55a676afa689 SHA512 10fe009dc3b8872b24350e4fb999f71b848bd5a03e48e8292f76e6eca3dbdef8383a3b13b813aada983ebdbe3ecab1642961b3210cd1e0063a86655a44493017
 DIST gcc-13-20250301.tar.xz 84525780 BLAKE2B c366f4de63b7956abb1bf2d1039acdf90c7a801adbb2793e4c199b0f743d143327aac9c2b078991f802da758ed4326dd913d9f60aec4fc471eff9af72f781a8e SHA512 075bfb3c5aeaf1c9bf7ab69ef117fcc1fd3ce1042edc9442d95df717e622c2ea9cfabbabf8be5eda32b3cf115d7d3e73907fd577a69f0beb6895f7ec2c5fc813
 DIST gcc-13-20250321.tar.xz 84515248 BLAKE2B b07d6f518bf2d32ad17b3c169ddb782dfe4de5efb157e2d4b8b2eb00f68f50b9250ba9e873b4dee269506740330176d98b1160d754ca6c714e1d6c76358c6493 SHA512 16a2acce5b2900749b7100a445ae387b03504a6e2319f76cd0a8a1d67eae8c04493f845f63e4e040d8fecba9123105d8b9fed433220e1fa6abc87448180dccd8
 DIST gcc-13-20250328.tar.xz 84532580 BLAKE2B e518053fd44461632560334c536ca29a3510493147bffba3906c3a9f2f08f4a124bd50132a0f2b82eb8a783fa3de58c5a41507c4558fd701d0cb9e2667526ad5 SHA512 277348fff14e1c44d32ffa717c9b2496fbf2975b95a237256a2c8585bbdba6b833b7212b0d9c59c3b430ebc98fe2866fe07e6acc429b09c0087e72da631f5ad3
+DIST gcc-13-20250404.tar.xz 84527280 BLAKE2B 1cd4592ccd2f0e6a712f74f5e7aa57f4b7cece92eb02cbb6049a11567a345589ee7993b81d2d9dc7b5cc1af8fe1d4350e3969377f4f389878d19eca7bf9520bc SHA512 7511736852972cae3578973ad11941cb9f758aea10e0b49cf4d67302bf0e4ad2c7b7ed4663e3d4c17ad6e350742b182652f8bfeb502134bf2e2b0d758037f0a9
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
 DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
@@ -24,14 +27,13 @@ DIST gcc-14-20241221.tar.xz 88198252 BLAKE2B 7491c2e1c8885e201859143bdf5cae95af4
 DIST gcc-14-20250301.tar.xz 88230928 BLAKE2B 2b65e7cccbf431a74df73adac53995873e78240d7abd97e9c9c576806c389b3c1abb6d47710a25a26f2ee399de750a07c3fb7916a580875d08a3a83354d89c1c SHA512 6b2afe19ce95a595307ae10b89054927116d33b499f1ef8233936d719271c04cb8f66890068ef2252c59ab0276dd0e6210990cb88abdfb4965818c25949f431e
 DIST gcc-14-20250322.tar.xz 88221060 BLAKE2B c8ec3dcbaaed1ee9a8d35f866a21879192a10707600a9ffa10c9a958de84e0fec3f8bd93950a5cdd53f2e4d9fcc74b45c4416a357eb271e70b314bd339da4818 SHA512 860049792547bfc21c4f61f1648056510495f16e97ea47444d02a740e60bfea1870d3ff437548854681e94fb2e7099a186526a6acecb02df7753e0f5661f6d30
 DIST gcc-14-20250329.tar.xz 88223376 BLAKE2B 024343e0307d8cc18efe326a137f599c25304346e23ba2a501e7a414c7c96891cd339ac5f82c9b6b1f8bfa0101734aafc3580d8577405d8f18d0c809f5d1b2d2 SHA512 ae86076dee09826ef3bed6ae927c757205ea48c9fcef59c61a74a3ca31117797a958ba2307cdee785f2c2bbccd87dd93316a0e3415f0e81bf2712d6abebcdef3
+DIST gcc-14-20250405.tar.xz 88235744 BLAKE2B 8de5bb1e182391c20b887b84da2ef04aab01bfd8f50d0a0fdca107fde89059f492d2920604ce7680be66f0aca319ed3fbb79f671e3d89b8fda0d33f447074210 SHA512 ba12a47dd3c2f3af4def7d582241b450e1e6ca9e8585839089401bf00dedfb93020bfd8a05ecb1a120491d664208c319f7ae2f763fb49c764492efe6a109cf92
 DIST gcc-14.1.0-musl-patches-1.tar.xz 3600 BLAKE2B 4cd920b7ca1f122cae806707564d8e45bfd48e78c88788a12a301f6068b5a5f335d8885e67479ac536c66aeaa81f2ecb7240ae56e9fc821a7246ab66b453711f SHA512 61c48d90a55dfc2129d96aee69d939d6a89f6407f69f7bd12c1a619f28989f471fd219d731958f8e62b0fd650c32300f0ad8dc06d5df23d9fc8c1a77fe210c25
 DIST gcc-14.2.0-patches-7.tar.xz 14244 BLAKE2B 11236e91e1fe83fec8ffaa40ec0cdd4b52a00a951e9aa9a7a0a932b234b8f1a9603333a7ccf55859f4ef53dd4d8ad1fd5c1d2514b6e45fce5b86bb58622a0ecc SHA512 5a4d86d943e31fa068b5a784c0132bd83c23243dcb3cf972557a42e004469a415e1b3185f31b1bb36f916594d475f266a2fda031a414e4a15e0bbfe471269eee
 DIST gcc-14.2.0-patches-8.tar.xz 14540 BLAKE2B 09f66035343d4cab694b8ab382170f8e2d546ddffedf3477f26edbd6a798ddf94294f569c2661729d40088d590bc17a4eb651710d8d9f66f33703734a1a82b67 SHA512 7a9a2724ef8db3c57b033d90751192969c16e5eaa8f4777b7f16470222ff3a18771b461bd89feaad701e7f0d573b883b487981588129933c732fb76117728b86
-DIST gcc-15-20250323.tar.xz 91685912 BLAKE2B cd56bfe95b80358cbc44ae27a15d297d60630495f452e5d8158f5dfb7be457cdbb144226ef3bc8bdac6eec7f9e20185240a7a4ddc229ab96b7a9ef5c502c308a SHA512 45e44a9136c466ef1ace86129cc5e4629f4cbeefd896967ef9701711a09f806ac0505232f5eb840823aeaca82c8e6107b6cbb3ea7b912264402b4faf5cd19788
-DIST gcc-15-20250330.tar.xz 91772420 BLAKE2B 164a4db7f83d40a010edbed11ecf949e459a5f0c866425812299d55ed96965fcc537bb40190dc78a16f66dfaa8da110b74fb612d8e76fe29ce4031d6196ef0b3 SHA512 719f5b1d79cd8ba4462d6916b1ddb401ca7ee9a9596610e6be00085fdf0d20c7ccbdc88983a22cfea73a0b21b28e1edb8dfd095ca95696362d1d9d62fe6551c2
+DIST gcc-15-20250406.tar.xz 91871244 BLAKE2B d9b4f8b382c5755f62e5f8b89deac74fdbe177e3961c205bba1d887c2157486908b85e80e0171e4d1ed6233d0cd8704af89850a3d2f6dcf0c6e703aa27b23fd9 SHA512 3a4b135833660107b6d3129570a24b3977e7da0f85296d663cfa8949eb8b2bd97237086535b1ff3eaf6423afcf799d18f21aaadc4fcc35835dca2f10cc154c7c
 DIST gcc-15.0.0-musl-patches-2.tar.xz 3076 BLAKE2B 0073248fe4f7dd827980559017b5aa1fb5c4c46acc9ad5c410dc152fd1e44966d3066bf7152338573cb45b1c36027de5f0c519abd414d97a37bccef07f6a5281 SHA512 295f1a669020bbe2874e9b03afd46b5d083073b276fca3543f3767a2d74f35df81cf0a67abad50c200cf7a3af36ec98ff9977cb7d5c19f334af7d3bb1926a3de
-DIST gcc-15.0.0-patches-48.tar.xz 18120 BLAKE2B bfb1e7330c1c0499d2d0a0046506961cccaac1df8e5779f9de599e8b6d89e9014b512072159ed18fb58243e95716b79aaa0d7665e7742ceda117d40a867cf34f SHA512 1cc61250e943e2cae543a5336fdc9ad04851186f8f45e4b82cb9be287a804374e84066cec0efd55662211107cecde92f78b6d3c745e421bc83b3d60101be9ebd
-DIST gcc-15.0.0-patches-50.tar.xz 25208 BLAKE2B 09e98c3dcdd3c60ede26c6e322d513b3df09efddfa21ea95b2cb7c3ee57b4c054f41fc60668706e33e56f022ef4b7cb96f7cc01b4a25d62d9777ef8b3b0d1ade SHA512 3b69d97a08c894a387fbcc4934bf0c519af8f66aff394c2a2565ed545fcb93f0bd70526cc74f5d952047d8d6782847c6d8e4aa7a408f0f89b1666c747ada8b4d
+DIST gcc-15.0.0-patches-53.tar.xz 27892 BLAKE2B 0c1455cae4aee49051fb5a8c31b8f82765da8ad9509ef17cb8c9f96d2c53a73fe1c8cfc0a2708e3bce0f8deb6f5e16807d8739bfd06cc6c08788331a719ded73 SHA512 c8f375f4de882ba99872f649f2cbbcc1b9f89d3dc9b355c1d11abfb6daf3ae7e89b82e002497215b641175d42d9f9a94749add2af2a5b6bcc1f3f5b41320df5b
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
 DIST gcc-8.5.0.tar.xz 63841008 BLAKE2B aa81a1a730fd7371360f6abed6ba78b5843fd18c58d5de5687acc320741b9e430e85df3535a1ef7a26051409be8d2f0945f503e5968480d919103123a99d4b12 SHA512 92f599680e6b7fbce88bcdda810f468777d541e5fddfbb287f7977d51093de2a5178bd0e6a08dfe37090ea10a0508a43ccd00220041abbbec33f1179bfc174d8
 DIST gcc-9.5.0-patches-2.tar.xz 14324 BLAKE2B 1d3bf3e673108ad2fcdcb86daefb4603d1c9f6aa815e34d1591054d466b76d6f50cce124ab4760528c4951ea16eb00888a3e6485417f81ebf250548732df4a8e SHA512 a6d6f650aaf0bd193a17ac279649f0544a282cea295824384c59341c3000eac4b574b60e00dd427585d928f9768166abf85168b47772132790ad98854acacbbf
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-disable-musttail.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-disable-musttail.patch
deleted file mode 100644
index 537496f9a2..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-disable-musttail.patch
+++ /dev/null
@@ -1,199 +0,0 @@
-https://inbox.sourceware.org/gcc-patches/20250320013102.1336516-1-andi@firstfloor.org/
-
-From 592f60bef27cb60ea6405ca8603449fc4d92e640 Mon Sep 17 00:00:00 2001
-Message-ID: <592f60bef27cb60ea6405ca8603449fc4d92e640.1742435883.git.sam@gentoo.org>
-From: Andi Kleen <ak@gcc.gnu.org>
-Date: Wed, 19 Mar 2025 18:31:02 -0700
-Subject: [PATCH] PR119376: Disable clang musttail
-
-There are multiple reports (see PR 119376) now where semantic differences
-in the gcc musttail implementation break existing programs written for the clang
-variant.
-
-Even though that can be all hopefully fixed eventually,
-for the gcc 15 release it seems safer to disable clang::musttail,
-and only keep gnu::musttail.
-
-That means that programs that use __has_c_attribute to check for
-clang::musttail must opt-in explicitly.
-
-Reported-by: Sam James
-
-gcc/c/ChangeLog:
-
-	PR ipa/119376
-	* c-parser.cc (c_parser_handle_musttail): Drop clang namespace
-	check.
-
-gcc/cp/ChangeLog:
-
-	PR ipa/119376
-	* parser.cc (cp_parser_jump_statement): Drop clang namespace
-	check.
-
-gcc/ChangeLog:
-
-	PR ipa/119376
-	* doc/extend.texi: Drop clang::musttail reference.
-
-gcc/testsuite/ChangeLog:
-
-PR ipa/119376
-	* c-c++-common/musttail23.c: Don't use clang::musttail
-	* c-c++-common/musttail24.c: Dito.
-	* c-c++-common/musttail3.c: Dito.
-	* g++.dg/musttail14.C: Dito.
----
- gcc/c/c-parser.cc                       |  5 -----
- gcc/cp/parser.cc                        |  6 ------
- gcc/doc/extend.texi                     |  2 +-
- gcc/testsuite/c-c++-common/musttail23.c | 10 +++++-----
- gcc/testsuite/c-c++-common/musttail24.c |  6 ------
- gcc/testsuite/c-c++-common/musttail3.c  |  6 +++---
- gcc/testsuite/g++.dg/musttail14.C       |  4 ++--
- 7 files changed, 11 insertions(+), 28 deletions(-)
-
-diff --git a/gcc/c/c-parser.cc b/gcc/c/c-parser.cc
-index d49d5c58659f..79654448acaa 100644
---- a/gcc/c/c-parser.cc
-+++ b/gcc/c/c-parser.cc
-@@ -7409,11 +7409,6 @@ c_parser_handle_musttail (c_parser *parser, tree std_attrs, attr_state &attr)
- 	  std_attrs = remove_attribute ("gnu", "musttail", std_attrs);
- 	  attr.musttail_p = true;
- 	}
--      if (lookup_attribute ("clang", "musttail", std_attrs))
--	{
--	  std_attrs = remove_attribute ("clang", "musttail", std_attrs);
--	  attr.musttail_p = true;
--	}
-     }
-   return std_attrs;
- }
-diff --git a/gcc/cp/parser.cc b/gcc/cp/parser.cc
-index 2fb1dc5992d4..da7700b55c64 100644
---- a/gcc/cp/parser.cc
-+++ b/gcc/cp/parser.cc
-@@ -15342,12 +15342,6 @@ cp_parser_jump_statement (cp_parser* parser, tree &std_attrs)
- 		musttail_p = true;
- 		std_attrs = remove_attribute ("gnu", "musttail", std_attrs);
- 	      }
--	    /* Support this for compatibility.  */
--	    if (lookup_attribute ("clang", "musttail", std_attrs))
--	      {
--		musttail_p = true;
--		std_attrs = remove_attribute ("clang", "musttail", std_attrs);
--	      }
- 
- 	    tree ret_expr = expr;
- 	    if (ret_expr && TREE_CODE (ret_expr) == TARGET_EXPR)
-diff --git a/gcc/doc/extend.texi b/gcc/doc/extend.texi
-index b919df914648..50f95e968ff9 100644
---- a/gcc/doc/extend.texi
-+++ b/gcc/doc/extend.texi
-@@ -10241,7 +10241,7 @@ have to optimize it to just @code{return 42 + 42;}.
- @cindex @code{musttail} statement attribute
- @item musttail
- 
--The @code{gnu::musttail} or @code{clang::musttail} standard attribute
-+The @code{gnu::musttail} standard attribute
- or @code{musttail} GNU attribute can be applied to a @code{return} statement
- with a return-value expression that is a function call.  It asserts that the
- call must be a tail call that does not allocate extra stack space, so it is
-diff --git a/gcc/testsuite/c-c++-common/musttail23.c b/gcc/testsuite/c-c++-common/musttail23.c
-index d2ba70b03250..1ceab1165129 100644
---- a/gcc/testsuite/c-c++-common/musttail23.c
-+++ b/gcc/testsuite/c-c++-common/musttail23.c
-@@ -19,10 +19,10 @@ foo (int x)
-     [[gnu::musttail (1, "", 3)]] return bar ();		/* { dg-error "'musttail' attribute does not take any arguments" } */
- 							/* { dg-error "expected" "" { target c } .-1 } */
-   if (x == 3)
--    [[clang::musttail (1)]] return bar ();		/* { dg-error "'musttail' attribute does not take any arguments" } */
-+    [[gnu::musttail (1)]] return bar ();		/* { dg-error "'musttail' attribute does not take any arguments" } */
- 							/* { dg-error "expected" "" { target c } .-1 } */
-   if (x == 4)
--    [[clang::musttail (1, "", 3)]] return bar ();	/* { dg-error "'musttail' attribute does not take any arguments" } */
-+    [[gnu::musttail (1, "", 3)]] return bar ();	/* { dg-error "'musttail' attribute does not take any arguments" } */
- 							/* { dg-error "expected" "" { target c } .-1 } */
-   if (x == 5)
-     __attribute__((fallthrough, musttail)) return bar (); /* { dg-warning "attribute 'musttail' mixed with other attributes on 'return' statement" "" { target c } } */
-@@ -32,14 +32,14 @@ foo (int x)
-     [[fallthrough]] [[gnu::musttail]] return bar ();	/* { dg-warning "'fallthrough' attribute ignored" "" { target c } } */
- 							/* { dg-warning "attributes at the beginning of statement are ignored" "" { target c++ } .-1 } */
-   if (x == 7)
--    [[clang::musttail, fallthrough]] return bar ();	/* { dg-warning "'fallthrough' attribute ignored" "" { target c } } */
-+    [[gnu::musttail, fallthrough]] return bar ();	/* { dg-warning "'fallthrough' attribute ignored" "" { target c } } */
- 							/* { dg-warning "attributes at the beginning of statement are ignored" "" { target c++ } .-1 } */
-   if (x == 8)
-     __attribute__((musttail, musttail)) return bar ();
-   if (x == 9)
-     [[gnu::musttail, gnu::musttail]] return bar ();
-   if (x == 10)
--    [[clang::musttail]] [[clang::musttail]] return bar ();
-+    [[gnu::musttail]] [[gnu::musttail]] return bar ();
-   if (x == 11)
--    [[clang::musttail]] [[gnu::musttail]] return bar ();
-+    [[gnu::musttail]] [[gnu::musttail]] return bar ();
- }
-diff --git a/gcc/testsuite/c-c++-common/musttail24.c b/gcc/testsuite/c-c++-common/musttail24.c
-index 10c2d3f188d8..26b8dbfb4c8e 100644
---- a/gcc/testsuite/c-c++-common/musttail24.c
-+++ b/gcc/testsuite/c-c++-common/musttail24.c
-@@ -8,14 +8,8 @@
- #if !__has_cpp_attribute (gnu::musttail)
- #error missing gnu::musttail attribute
- #endif
--#if !__has_cpp_attribute (clang::musttail)
--#error missing clang::musttail attribute
--#endif
- #else
- #if !__has_c_attribute (gnu::musttail)
- #error missing gnu::musttail attribute
- #endif
--#if !__has_c_attribute (clang::musttail)
--#error missing clang::musttail attribute
--#endif
- #endif
-diff --git a/gcc/testsuite/c-c++-common/musttail3.c b/gcc/testsuite/c-c++-common/musttail3.c
-index 7499fd6460b4..daedca28852a 100644
---- a/gcc/testsuite/c-c++-common/musttail3.c
-+++ b/gcc/testsuite/c-c++-common/musttail3.c
-@@ -11,7 +11,7 @@ struct str
- cstruct (int x)
- {
-   if (x < 10)
--    [[clang::musttail]] return cstruct (x + 1);
-+    [[gnu::musttail]] return cstruct (x + 1);
-   return ((struct str){ x, 0 });
- }
- 
-@@ -19,11 +19,11 @@ int
- foo (int x)
- {
-   if (x < 10)
--    [[clang::musttail]] return foo2 (x, 29);
-+    [[gnu::musttail]] return foo2 (x, 29);
-   if (x < 100)
-     {
-       int k = foo (x + 1);
--      [[clang::musttail]] return k;	/* { dg-error "cannot tail-call: " } */
-+      [[gnu::musttail]] return k;	/* { dg-error "cannot tail-call: " } */
-     }
-   return x;
- }
-diff --git a/gcc/testsuite/g++.dg/musttail14.C b/gcc/testsuite/g++.dg/musttail14.C
-index 810b45546d61..e4764a3bc03b 100644
---- a/gcc/testsuite/g++.dg/musttail14.C
-+++ b/gcc/testsuite/g++.dg/musttail14.C
-@@ -58,8 +58,8 @@ garply (int x)
-     case 3:
-       __attribute__(()) [[gnu::musttail]] __attribute__(()) [[]] __attribute__(()) return qux (45);
-     case 4:
--      [[]] __attribute__(()) [[clang::musttail]] __attribute__(()) [[]] return corge (46);
-+      [[]] __attribute__(()) [[gnu::musttail]] __attribute__(()) [[]] return corge (46);
-     default:
--      __attribute__(()) [[clang::musttail]] __attribute__(()) [[]] __attribute__(()) return freddy (47);
-+      __attribute__(()) [[gnu::musttail]] __attribute__(()) [[]] __attribute__(()) return freddy (47);
-     }
- }
--- 
-2.49.0
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-e2fsprogs.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-e2fsprogs.patch
deleted file mode 100644
index 5619bd5ef5..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-15.0.1_pre20250323-e2fsprogs.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-https://gcc.gnu.org/git/?p=gcc.git;a=patch;h=584b346a4c7a6e6e77da6dc80968401a3c08161d
-
-From 584b346a4c7a6e6e77da6dc80968401a3c08161d Mon Sep 17 00:00:00 2001
-From: Jakub Jelinek <jakub@redhat.com>
-Date: Tue, 25 Mar 2025 16:55:24 +0100
-Subject: [PATCH] i386: Fix up combination of -2 r<<= (x & 7) into btr
- [PR119428]
-
-The following patch is miscompiled from r15-8478 but latently already
-since my r11-5756 and r11-6631 changes.
-The r11-5756 change was
-https://gcc.gnu.org/pipermail/gcc-patches/2020-December/561164.html
-which changed the splitters to immediately throw away the masking.
-And the r11-6631 change was an optimization to recognize
-(set (zero_extract:HI (...) (const_int 1) (...)) (const_int 1)
-as btr.
-
-The problem is their interaction.  x86 is not a SHIFT_COUNT_TRUNCATED
-target, so the masking needs to be explicit in the IL.
-And combine.cc (make_field_assignment) has since 1992 optimizations
-which try to optimize x &= (-2 r<< y) into zero_extract (x) = 0.
-Now, such an optimization is fine if y has not been masked or if the
-chosen zero_extract has the same mode as the rotate (or it recognizes
-something with a left shift too).  IMHO such optimization is invalid
-for SHIFT_COUNT_TRUNCATED targets because we explicitly say that
-the masking of the shift/rotate counts are redundant there and don't
-need to be part of the IL (I have a patch for that, but because it
-is just latent, I'm not sure it needs to be posted for gcc 15 (and
-also am not sure if it should punt or add operand masking just in case)).
-x86 is not SHIFT_COUNT_TRUNCATED though and so even fixing combine
-not to do that for SHIFT_COUNT_TRUNCATED targets doesn't help, and we don't
-have QImode insv, so it is optimized into HImode insertions.  Now,
-if the y in x &= (-2 r<< y) wasn't masked in any way, turning it into
-HImode btr is just fine, but if it was x &= (-2 r<< (y & 7)) and we just
-decided to throw away the masking, using btr changes the behavior on it
-and causes e2fsprogs and sqlite miscompilations.
-
-So IMHO on !SHIFT_COUNT_TRUNCATED targets, we need to keep the maskings
-explicit in the IL, either at least for the duration of the combine pass
-as does the following patch (where combine is the only known pass to have
-such transformation), or even keep it until final pass in case there are
-some later optimizations that would also need to know whether there was
-explicit masking or not and with what mask.  The latter change would be
-much larger.
-
-The following patch just reverts the r11-5756 change and adds a testcase.
-
-2025-03-25  Jakub Jelinek  <jakub@redhat.com>
-
-	PR target/96226
-	PR target/119428
-	* config/i386/i386.md (splitter after *<rotate_insn><mode>3_mask,
-	splitter after *<rotate_insn><mode>3_mask_1): Revert 2020-12-05
-	changes.
-
-	* gcc.c-torture/execute/pr119428.c: New test.
----
- gcc/config/i386/i386.md                        |  6 ++++--
- gcc/testsuite/gcc.c-torture/execute/pr119428.c | 18 ++++++++++++++++++
- 2 files changed, 22 insertions(+), 2 deletions(-)
- create mode 100644 gcc/testsuite/gcc.c-torture/execute/pr119428.c
-
-diff --git a/gcc/config/i386/i386.md b/gcc/config/i386/i386.md
-index 2b3cffc1f350..9d1b34e55959 100644
---- a/gcc/config/i386/i386.md
-+++ b/gcc/config/i386/i386.md
-@@ -18168,7 +18168,8 @@
-  [(set (match_dup 4) (match_dup 1))
-   (set (match_dup 0)
-        (any_rotate:SWI (match_dup 4)
--		       (subreg:QI (match_dup 2) 0)))]
-+		       (subreg:QI
-+			 (and:SI (match_dup 2) (match_dup 3)) 0)))]
-  "operands[4] = gen_reg_rtx (<MODE>mode);")
- 
- (define_insn_and_split "*<insn><mode>3_mask_1"
-@@ -18202,7 +18203,8 @@
-   == GET_MODE_BITSIZE (<MODE>mode) - 1"
-  [(set (match_dup 4) (match_dup 1))
-   (set (match_dup 0)
--       (any_rotate:SWI (match_dup 4) (match_dup 2)))]
-+       (any_rotate:SWI (match_dup 4)
-+		       (and:QI (match_dup 2) (match_dup 3))))]
-  "operands[4] = gen_reg_rtx (<MODE>mode);")
- 
- (define_insn_and_split "*<insn><mode>3_add"
-diff --git a/gcc/testsuite/gcc.c-torture/execute/pr119428.c b/gcc/testsuite/gcc.c-torture/execute/pr119428.c
-new file mode 100644
-index 000000000000..33a93f46b3bd
---- /dev/null
-+++ b/gcc/testsuite/gcc.c-torture/execute/pr119428.c
-@@ -0,0 +1,18 @@
-+/* PR target/119428 */
-+
-+__attribute__((noipa)) void
-+foo (unsigned int x, unsigned char *y)
-+{
-+  y += x >> 3;
-+  *y &= (unsigned char) ~(1 << (x & 0x07));
-+}
-+
-+int
-+main ()
-+{
-+  unsigned char buf[8];
-+  __builtin_memset (buf, 0xff, 8);
-+  foo (8, buf);
-+  if (buf[1] != 0xfe)
-+    __builtin_abort ();
-+}
--- 
-2.43.5
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
index 99bf372fe1..886019dca3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.5.0.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="10.5.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
index 5ba99978c4..477eb3fd96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.5.0.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="11.5.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
index 0be214e9c0..8198fc49db 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.0.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
index 95cfd10b5c..bc4c233455 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20241219.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
index fd30643c8d..abbfb04944 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250227.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250320.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250320.ebuild
index 76bdbb1760..1e4993aa40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250320.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250320.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250327.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250327.ebuild
index 76bdbb1760..1e4993aa40 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250327.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250327.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250403.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250403.ebuild
new file mode 100644
index 0000000000..fb61817994
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.1_p20250403.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="12.4.0"
+PATCH_VER="3"
+MUSL_VER="1"
+MUSL_GCC_VER="12.4.0"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
index d85e065cd1..8e7542f313 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.5.9999.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="12.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
index d72c2588ff..51f50a6419 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 PYTHON_COMPAT=( python3_{10..13} )
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
index edfef15506..716039677f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20241220.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
index 4029cad2d0..7969b89177 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250301.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250321.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250321.ebuild
index 38de5cbe64..bdc9b8c2e5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250321.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250321.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250328.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250328.ebuild
index 38de5cbe64..bdc9b8c2e5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250328.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250328.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250404.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250404.ebuild
new file mode 100644
index 0000000000..bdc9b8c2e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.3.1_p20250404.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
+TOOLCHAIN_PATCH_DEV="sam"
+TOOLCHAIN_HAS_TESTS=1
+PATCH_GCC_VER="13.3.0"
+MUSL_GCC_VER="13.2.0"
+PATCH_VER="2"
+MUSL_VER="2"
+PYTHON_COMPAT=( python3_{10..13} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
index 2c63f6165e..1de90381b6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.4.9999.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="13.3.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
index df1147fa0b..4e0e4421fa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20241221.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
index 47a10f1ede..a2ede76ffc 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250301.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250322.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250322.ebuild
index b5ae50b50a..d405a1386b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250322.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250322.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250329.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250329.ebuild
index b5ae50b50a..d405a1386b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250329.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250329.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250330.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250405.ebuild
similarity index 72%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250330.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250405.ebuild
index 9b27f5b51d..d405a1386b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250330.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.2.1_p20250405.ebuild
@@ -3,12 +3,15 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
-PATCH_GCC_VER="15.0.0"
-PATCH_VER="50"
-MUSL_VER="2"
-MUSL_GCC_VER="15.0.0"
+PATCH_GCC_VER="14.2.0"
+PATCH_VER="8"
+MUSL_VER="1"
+MUSL_GCC_VER="14.1.0"
 PYTHON_COMPAT=( python3_{10..13} )
 
 if [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
@@ -24,10 +27,10 @@ inherit toolchain
 
 if tc_is_live ; then
 	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	# m68k doesnt build (ICE, bug 932733)
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
@@ -48,5 +51,7 @@ src_prepare() {
 	done
 
 	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
 	eapply_user
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
index fb406bea1f..0465a3f8e6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.3.9999.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="14.2.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250323-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406.ebuild
similarity index 90%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250323-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406.ebuild
index ca63b7ee17..fd941e7a42 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250323-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.1_pre20250406.ebuild
@@ -3,10 +3,13 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
-PATCH_VER="48"
+PATCH_VER="53"
 MUSL_VER="2"
 MUSL_GCC_VER="15.0.0"
 PYTHON_COMPAT=( python3_{10..13} )
@@ -48,7 +51,5 @@ src_prepare() {
 	done
 
 	toolchain_src_prepare
-	eapply "${FILESDIR}"/${P}-e2fsprogs.patch
-	eapply "${FILESDIR}"/${P}-disable-musttail.patch
 	eapply_user
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
index 62a72284c2..a6edd9dc96 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-15.0.9999.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="15.0.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
index 9ea771d35d..650d49559b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-8.5.0-r2.ebuild
@@ -3,6 +3,9 @@
 
 EAPI="8"
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
index 2123f87727..a38688e620 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-9.5.0.ebuild
@@ -3,6 +3,9 @@
 
 EAPI=8
 
+# Maintenance notes and explanations of GCC handling are on the wiki:
+# https://wiki.gentoo.org/wiki/Project:Toolchain/sys-devel/gcc
+
 TOOLCHAIN_PATCH_DEV="sam"
 TOOLCHAIN_HAS_TESTS=1
 PATCH_GCC_VER="9.5.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.48.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.48.ebuild
index 00ad3bb1d9..712eeed318 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.48.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/mtools/mtools-4.0.48.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://gnu/${PN}/${P}.tar.lz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86 ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ppc ppc64 ~riscv sparc x86 ~x64-macos ~x64-solaris"
 IUSE="gui"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
index 993c30347f..8e024da06f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
@@ -11,6 +11,7 @@ DIST gentoo-headers-6.10-1.tar.xz 1164 BLAKE2B 83c11fb4d7a2ecc3ca34dd271918da3ec
 DIST gentoo-headers-6.11-1.tar.xz 1164 BLAKE2B 381aef3f8f8dd3f5f2c6ffb162bc2e509df6a0b61e935c92319a7f0594551fb4c05d0b7c3dc88362f49c272b47626d5df2cffbb4c541672102f9f4e76d1abb09 SHA512 60fd8ae83bbb43f5215ffcea37ed3b9e71820d4e9cbc4a3f2e4016970791ae68adea677ef777e4ed931b88b586e2a5470f9a447cdf2b1e87a6252fd0fbc3a1be
 DIST gentoo-headers-6.12-1.tar.xz 1164 BLAKE2B 87b1f0e5bbc7e7a04dc05a12c8ac0e1a210bc88a8bcbfbe6c3cd905f803f21eaa15d847f673e1c778d807346e2cfa728df83d3f4ea2df1b61a5436971cf8d309 SHA512 2abdc467fefbbc498f9e2deeaa189f038ea9a2d28e27ee9b682dcbd48ce51103e3d3d6888127a4b5e88ea1ff16522c1fa20e39c90eff4831398782ae4d48e1ba
 DIST gentoo-headers-6.13-1.tar.xz 1164 BLAKE2B 92c2b223c597b1aa94be129932902253308ceb66a0f4b8f9d1a79582a241c5e50d75363c6ebfc8266141f5d576dacc42acb7f6c09fe2c374b98f70c2210f4a08 SHA512 6885e725f17e07e565512dfaeb248fba01822a8836e4d6a8d3f84436ffe9290df2d0450de282efb4a18af893111e4258f69a5c6581d1783aebaee999c7e6db02
+DIST gentoo-headers-6.14-1.tar.xz 1164 BLAKE2B 2c72d180953c450158690549fb2e852310bba07cb9e81646b841348eb9327d82b5a203760c7f5b50a1a82bcca21968926a085024b36ac75f077a2fc957fa0e51 SHA512 962b7670c563f886bddbd04b49652d3a6af282a162c00a27f5ec95ca2c6a55227cfbf2819b8b754a53fd54d5106a5ea72da8f34411cfc16c7fe2cf4b700d670a
 DIST gentoo-headers-6.6-1.tar.xz 1172 BLAKE2B 626bb33b42f48bceca2ba6a0a9c0b043a8607bb391d3b541e98d2af42eacfabeda3a5a3d48b7bee1fd0a2a8ad0b6173bde49d3827ea087e501eb0e91d18c4ab7 SHA512 09bcda97d9d17ee3f66ee46d9c00b8ac4fba5b9662fa24e4e2754bd9e4e7b3f097e5f2d52281eeb7a671dfe303aabe15c8fd66f117fddf29fb094e28d8c603b3
 DIST gentoo-headers-6.8-1.tar.xz 1164 BLAKE2B 43283b61fc35057c7f703108d6e4aead901329106e4c297cdfc261e8f9cb1f2ec9370b7367432b9eabe9fcc4358da745170b1f4ec6079d373f50de1fde148778 SHA512 c43e18ce1b39a60e163c2e0f824b1402bcbda84f20b2ae38d53681ff517713c42fd876954fab0ab8044b66e28e32f9ee93fc61ecbbc9c2bb5a9932a0616e570c
 DIST gentoo-headers-6.9-1.tar.xz 1164 BLAKE2B fd385a2c39e9528f60dee582f153485842e76a8a9ad87fd8a11179b8ad2558df23e3c7fb7476f3f1011536e26da50f625a660d2a8ae01954300085f8b3f1bb01 SHA512 3fad4602e453a9aae24cc640ee6c70b06f221c78262f5befe794ca5eb48c352aff335715b5033760ca690bdef55e6a6acb5d3d2351bae885f3023098b5c6ecb1
@@ -27,6 +28,7 @@ DIST linux-6.10.tar.xz 145142812 BLAKE2B bb243ea7493b9d63aa2df2050a3f1ae2b89ee84
 DIST linux-6.11.tar.xz 146900704 BLAKE2B e7750c0878d71a56a0ce52d4c4c912199dad5bf5e2e8f872585a6494afbb37cbd852e612a6858936d2dc9b7776a3933818f540db408d57e90d18ea5249bba7ab SHA512 329c1f94008742e3f0c2ce7e591a16316d1b2cb9ea4596d4f45604097e07b7aa2f64afa40630a07f321a858455c77aa32ba57b271932ddcf4dc27863f9081cea
 DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
 DIST linux-6.13.tar.xz 148523052 BLAKE2B 9f617ecb3f2393b57ba03c654fea62a7213f24c835989f333a1ef29492af551bfa7d9ad786d5ef1484854adc77c7c6af38fb09a72d994d305695f512c325e77f SHA512 1137e6440132b0958f89165440e99208f82b204e7245ae69dc9c808df97d13ce8f58136db92407e0e93394fa7f6283ec7a34597c6e92a5b6d9025e0960357957
+DIST linux-6.14.tar.xz 149408504 BLAKE2B 11835719804b406fe281ea1c276a84dc0cbaa808552ddcca9233d3eaeb1c001d0455c7205379b02de8e8db758c1bae6fe7ceb6697e63e3cf9ae7187dc7a9715e SHA512 71dcaa3772d8d9797c3ae30cae9c582b11a7047a3bbcb8dfd479a4dffb40ff0da74cf3d45175f50cc9992e338bcadd46c9c570f54054ca3bde6661768d3d22eb
 DIST linux-6.6.tar.xz 140064536 BLAKE2B 5f02fd8696d42f7ec8c5fbadec8e7270bdcfcb1f9844a6c4db3e1fd461c93ce1ccda650ca72dceb4890ebcbbf768ba8fba0bce91efc49fbd2c307b04e95665f2 SHA512 458b2c34d46206f9b4ccbac54cc57aeca1eaecaf831bc441e59701bac6eadffc17f6ce24af6eadd0454964e843186539ac0d63295ad2cc32d112b60360c39a35
 DIST linux-6.8.tar.xz 142502100 BLAKE2B c6f17f816cea16e629f63e9379b98888713f57b2c5173306926471f139a9d612a0c74e119341f8075390e55e203d787d9edeb4ad5a064b18870f6f0f7ffaafb2 SHA512 5c4eb4aa1d3f7d1ea01c0f7ddeadacdece6e144fd4bdfc16b2b925d3e10dc04de3a6db69320b79a96c3560052616f001d2c09e7a1bb4f7b731e2380a7ecce068
 DIST linux-6.9.tar.xz 144034416 BLAKE2B 4cf86c3cfe6e6534745d42dfaeca59b17ea1168c4e8b615c80e6d8aac735f11283cd85fa992b440b5d4452917e94b9f08397a64af0be5894e3df23c68892377e SHA512 fed3b4cd1fbfb4d94618587c1934273d2ecc8b6e42a3d586ff8a5f24980be930f2ef803aa2923ca3bfa5e4e619f967f3af315368f24fa76f610b10443624a579
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.14.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.14.ebuild
new file mode 100644
index 0000000000..2296d0506c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.14.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+ETYPE="headers"
+H_SUPPORTEDARCH="alpha amd64 arc arm arm64 csky hexagon hppa loong m68k microblaze mips nios2 openrisc ppc ppc64 riscv s390 sh sparc x86 xtensa"
+inherit kernel-2
+detect_version
+
+PATCH_PV=${PV} # to ease testing new versions against not existing patches
+PATCH_VER="1"
+PATCH_DEV="sam"
+SRC_URI="
+	${KERNEL_URI}
+	${PATCH_VER:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/sys-kernel/linux-headers/gentoo-headers-${PATCH_PV}-${PATCH_VER}.tar.xz}
+"
+S="${WORKDIR}/linux-${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+"
+
+src_unpack() {
+	# Avoid kernel-2_src_unpack
+	default
+}
+
+src_prepare() {
+	local PATCHES=()
+	[[ -n ${PATCH_VER} ]] && PATCHES+=( "${WORKDIR}"/${PATCH_PV} )
+
+	# TODO: May need forward porting to newer versions
+	use elibc_musl && PATCHES+=(
+		"${FILESDIR}"/${PN}-5.15-remove-inclusion-sysinfo.h.patch
+	)
+
+	# Avoid kernel-2_src_prepare
+	default
+}
+
+src_install() {
+	kernel-2_src_install
+
+	find "${ED}" \( -name '.install' -o -name '*.cmd' \) -delete || die
+	# Delete empty directories
+	find "${ED}" -empty -type d -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
index 3ef830a6a7..bb38abf7ba 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
@@ -225,6 +225,12 @@ DIST ncurses-6.5-20250301.patch.gz 68821 BLAKE2B 5425c87b29bd21109d725f84d9dd32d
 DIST ncurses-6.5-20250301.patch.gz.asc 729 BLAKE2B dc98383dff539f29e095b7815e4809352f717c0096bb006ac4b05065e947b16350cda03f2cbfadf13d9915c049e5b5b6b7c43ef369231525a5fa346d915a6cba SHA512 7290322560a9443b2259f4711d3349cafea3a67a04e80537f0d3f35b4d68c0dff217b004739fbba92e41e290deb866ba00520fd14a6d420a2052cad80eeff31b
 DIST ncurses-6.5-20250308.patch.gz 25507 BLAKE2B ce846a29f11a6026f3c2f470a591b364b98bf39b34ffdf45922234d4e5c3402519ee569fc76bb529afd816b26cb33f518a69dd590dab736719ddbc06f19cab9a SHA512 1ac6c11e364efc09769cc4742b3fe6315c882e17d4b7c5aba81cd10d9fe62d103003b60ed1edd3fc3ed3b003c8bb198b47d25506302bdec493c7dc115ccf1d54
 DIST ncurses-6.5-20250308.patch.gz.asc 729 BLAKE2B de715c834df717cd24a5c76a62ae64f8fdbad7ec456b1d8b0c80e404194fb9b5a098889d73e1509527062b82336d8e1c8c9c377c9c30830804918b1ce7c5db51 SHA512 41c3932f3fa6c1fa00213ff384bbb073119ecd3f7e16094d9b98b949e04c6444c5a96e7b747cc250e905a9f45cb2d484824401e0beb29ee65cc3874501216455
+DIST ncurses-6.5-20250315.patch.gz 24256 BLAKE2B 1cc1d49aa7fa6de72e3c29224e0c2b3cc52ac822a37ac6536cc0cebbeec58756957d30f14834c7db290bfc771bb1f5b904fbd23f4022d9d152f6a852101d95cc SHA512 6c25a2318f89bb462177d22b3718b251a0aa8253e4de386ba329ee6ad6d6096ed700373899ffb3789d6332f3fb5658b98f058904ac8ccc0880a6cec32304b876
+DIST ncurses-6.5-20250315.patch.gz.asc 729 BLAKE2B 9c5db62891ed844ea039ad0db6ec6bfabeb4955e2133ff09097dcdbde8bb27f973ca76440ad784d231331b421d3e40237ca84211d812c98924d4dc764d557ef8 SHA512 61327a0ff14c9af35aa89aeaf38280920cb0d53da7b764e956baf8d8f4ed34d517b93be6e64080ab43ffd4d375f75a0c5e2a379ea2530cb7b091f43c567c7dd4
+DIST ncurses-6.5-20250322.patch.gz 4987 BLAKE2B 708811bca043891e8c09ef137e0e2cff9a09b2a7d2e9ddcce5b0a1c8822e7e4d34c87d9963f8795b73394cc25b0b7681384d0cd9b8de8efc48e3017965e942b8 SHA512 5342d1571c82a492fc4ed9448c72303871709d37840a96d44be4b4a16254051b44cfb89272e29c1f0b283073ae82ff73e7ee9e2d75ade226957d1da838854456
+DIST ncurses-6.5-20250322.patch.gz.asc 729 BLAKE2B bd38bf5ed3c387f5b5726363e3ff58d7f0654a7fab6fa590a7965fd169ca0280832130a338d42692dee72da97afd63b5e738670df37a28f170339de6097e040c SHA512 649b46cbe129f48ac030e79d4f8ddeb3ee1da46af634022f4bf059e3ce31ce02a633f53eda776ac8c49d9ce0c4fdf8d8eabc1e1b22d9205c582d9b9485198e9a
+DIST ncurses-6.5-20250329.patch.gz 5288 BLAKE2B 2cb8cbff061fd22badf488db087855287f86fef50c79ca94bb81cf0152bbe266f2406ad62a1eba99ab7c090dd3b01df8964f2b5ae952c0c715da7947687ec00e SHA512 42e88dfe5c862ebb6effd6cf9e3bc79d5ad797b544a0f8891d165e97a4e1ab840efc3782e8fe78327cd030d3c1c9de3ba20a7c68b32ef9910b4530500f605694
+DIST ncurses-6.5-20250329.patch.gz.asc 729 BLAKE2B 96517ad803d2b91849119c890b6cf7e42f401c660e992f9b4564d5c6c4e2eab585c2dea85a41e4bd0d54b4434932cbd885d2a393063934e092712b043391c700 SHA512 24afa71c892737b4e0a557e6efa37f3ee65bd341c47ed2015322d8d0575efac0eaa9518e967a2c40e91a3f560d58ea553ed3d089d729dd53671db1abe271bd4d
 DIST ncurses-6.5.tar.gz 3688489 BLAKE2B d0a05c218b5f320ba9abe2f322787baef1d15d764e503c81d49772b54b2927d28ecbeb500c8e514996226b41f69445b4de44ff423cec25b61847307fe61682ec SHA512 fc5a13409d2a530a1325776dcce3a99127ddc2c03999cfeb0065d0eee2d68456274fb1c7b3cc99c1937bc657d0e7fca97016e147f93c7821b5a4a6837db821e8
 DIST ncurses-6.5.tar.gz.sig 438 BLAKE2B 5789b47932ec97d3863c7a65306369f0a36cb5b1a35c1e009b5174f50941edceafc22e6f07db3843a096773663a0ca602c0ecb9465e6042d9a78d76ae5008215 SHA512 96ce61a3d529e48e249acecbf4bb9eae2d9f2f67506e92ffa3182f5e98040c38babf0c2c15d92fc5d96e1181e72be1b29fdbff7bee859dfe2ae387f9b8883092
 DIST ncurses-6.5_p20241109-patches.tar.xz 63676 BLAKE2B 9981b740fcec18cc794074ccc93ae1dbe175e52449af2bddfd10a6fb1d5dfe9b545bd19fce5e601d2d85008425fd5cd6fc33042d7bcc854363b0642b9c880efe SHA512 076d2d39c46cf9236e5e65472e10182da2dffffa936c7567b11e23323d64f9739bb3818d4fdbdd75a14fd3f5b202dcdb7aaa6813afb5e303f81c094339824162
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250329.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250329.ebuild
new file mode 100644
index 0000000000..d4ba923b38
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.5_p20250329.ebuild
@@ -0,0 +1,484 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
+# provide a configure option for the ABI version.
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
+inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
+
+MY_PV="${PV:0:3}"
+MY_P="${PN}-${MY_PV}"
+DESCRIPTION="Console display library"
+HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
+# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
+SRC_URI="
+	mirror://gnu/ncurses/${MY_P}.tar.gz
+	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
+	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
+	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
+"
+
+GENTOO_PATCH_DEV=sam
+GENTOO_PATCH_PV=6.5_p20250301
+GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
+
+# Populated below in a loop. Do not add patches manually here.
+UPSTREAM_PATCHES=()
+
+if [[ ${PV} == *_p* ]] ; then
+	# Sometimes, after releases, there's no megapatch available yet.
+	#
+	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
+	#
+	#	"At times (generally to mark a relatively stable point), I create a rollup
+	#	patch, which consists of all changes from the release through the current date."
+	#
+	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
+	# the patches are considered to be acceptable to use after some testing. They
+	# are both for development but also bug fixes.
+	#
+	# This array should contain a list of all the snapshots since the last
+	# release if there's no megapatch available yet.
+	PATCH_DATES=(
+		20240504
+		20240511
+		20240518
+		20240519
+		20240525
+		20240601
+		20240608
+		20240615
+		20240622
+		20240629
+		20240706
+		20240713
+		20240720
+		20240727
+		20240810
+		20240817
+		20240824
+		20240831
+		20240914
+		20240922
+		20240928
+		20241006
+		20241019
+		20241026
+		20241102
+		20241109
+		20241123
+		20241130
+		20241207
+		20241214
+		20241221
+		20241228
+		20250104
+		20250111
+		20250118
+		20250125
+		20250201
+		20250208
+		20250215
+		20250216
+		20250222
+		20250301
+		20250308
+		20250315
+		20250322
+
+		# Latest patch is just _pN = $(ver_cut 4)
+		$(ver_cut 4)
+	)
+
+	if [[ -z ${PATCH_DATES[@]} ]] ; then
+		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
+		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
+
+		# If we have a rollup patch, use that instead of the individual ones.
+		UPSTREAM_PATCHES+=( patch.sh )
+	else
+		# We use a mirror as well because we've had reports of 403 forbidden for some users.
+		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+
+		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
+		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
+		# Suffix each with .patch.gz
+		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
+		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
+		# Repeat for .patch.gz.asc for verify-sig
+		SRC_URI+=" ${mangled_patches[@]}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
+
+		# For all of the URLs, chuck in invisible-island.net too:
+		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
+
+		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
+
+		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
+	fi
+fi
+
+SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="MIT"
+# The subslot reflects the SONAME.
+SLOT="0/6"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
+# In 6.5_p20250118, the C++ examples fail to link, but there's no automated
+# testsuite anyway. Controlling building examples isn't really what USE=test
+# is for. Just restrict them.
+RESTRICT="!test? ( test ) test"
+
+# TODO: ncurses allows (and we take advantage of this, even) passing
+# the SONAME for dlopen() use, so only the header is needed at build time.
+# Maybe we should bundle a copy of gpm.h so we can move gpm to PDEPEND
+# which would be far nicer UX-wise.
+DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
+# Block the older ncurses that installed all files w/SLOT=5, bug #557472
+RDEPEND="
+	${DEPEND}
+	!<=sys-libs/ncurses-5.9-r4:5
+	!<sys-libs/slang-2.3.2_pre23
+	!<x11-terms/rxvt-unicode-9.06-r3
+	!<x11-terms/st-0.6-r1
+	!minimal? ( !<x11-terms/ghostty-1.1.0 )
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
+
+PATCHES=(
+	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
+
+	# When rebasing Gentoo's patchset, please use git from a clean
+	# src_prepare with upstream patches already applied. git am --reject
+	# the existing patchset and rebase as required. This makes it easier
+	# to manage future rebasing & adding new patches.
+	#
+	# For the same reasons, please include the original configure.in changes,
+	# NOT just the generated results!
+	"${WORKDIR}"/${GENTOO_PATCH_NAME}
+)
+
+src_unpack() {
+	# Avoid trying to verify our own patchset tarball, there's no point
+	if use verify-sig ; then
+		local file
+		for file in ${A} ; do
+			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
+			else
+				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
+
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
+			fi
+		done
+	fi
+
+	default
+}
+
+src_configure() {
+	# bug #115036
+	unset TERMINFO
+
+	tc-export_build_env BUILD_{CC,CXX,CPP}
+
+	# bug #214642
+	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
+
+	# NCURSES_BOOL confusion, see https://lists.gnu.org/archive/html/bug-ncurses/2024-11/msg00010.html
+	append-cflags $(test-flags-CC -std=gnu17)
+
+	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
+	# Order matters here -- we want unicode/thread versions to come last so that the
+	# binaries in /usr/bin support both wide and narrow.
+	# The naming is also important as we use these directly with filenames and when
+	# checking configure flags.
+	NCURSES_TARGETS=(
+		ncurses
+		ncursesw
+		ncursest
+		ncursestw
+	)
+
+	# When installing ncurses, we have to use a compatible version of tic.
+	# This comes up when cross-compiling, doing multilib builds, upgrading,
+	# or installing for the first time.  Build a local copy of tic whenever
+	# the host version isn't available. bug #249363, bug #557598
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		local lbuildflags="-static"
+
+		# some toolchains don't quite support static linking
+		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
+		case ${CHOST} in
+			*-darwin*)  dbuildflags=     ;;
+			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
+		esac
+		echo "int main() {}" | \
+			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
+			|| lbuildflags="${dbuildflags}"
+
+		# We can't re-use the multilib BUILD_DIR because we run outside of it.
+		BUILD_DIR="${WORKDIR}" \
+		CC=${BUILD_CC} \
+		CXX=${BUILD_CXX} \
+		CPP=${BUILD_CPP} \
+		CHOST=${CBUILD} \
+		CFLAGS=${BUILD_CFLAGS} \
+		CXXFLAGS=${BUILD_CXXFLAGS} \
+		CPPFLAGS=${BUILD_CPPFLAGS} \
+		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
+		do_configure cross --without-shared --with-normal --with-progs --without-ada
+	fi
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${ABI} == x86 ]] ; then
+		# For compatibility with older binaries at slight performance cost.
+		# bug #616402
+		use stack-realign && append-flags -mstackrealign
+	fi
+
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_configure "${t}"
+	done
+}
+
+do_configure() {
+	local target=$1
+	shift
+
+	mkdir "${BUILD_DIR}/${target}" || die
+	cd "${BUILD_DIR}/${target}" || die
+
+	local conf=(
+		# We need the basic terminfo files in /etc, bug #37026.  We will
+		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
+		# src_install() ...
+		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
+
+		# Enable installation of .pc files.
+		--enable-pc-files
+		# This path is used to control where the .pc files are installed.
+		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
+
+		# Now the rest of the various standard flags.
+		--with-shared
+		--enable-fvisibility
+		# (Originally disabled until bug #245417 is sorted out, but now
+		# just keeping it off for good, given nobody needed it until now
+		# (2022) and we're trying to phase out bdb.)
+		--without-hashed-db
+		$(use_with ada)
+		$(use_with cxx)
+		$(use_with cxx cxx-binding)
+		--with-cxx-shared
+		$(use_with debug)
+		$(use_with profile)
+		# The configure script uses ldd to parse the linked output which
+		# is flaky for cross-compiling/multilib/ldd versions/etc...
+		$(use_with gpm gpm libgpm.so.1)
+
+		# bug #930806
+		--disable-setuid-environ
+		# TODO: Maybe do these for USE=hardened
+		#--disable-root-access
+		#--disable-root-environ
+
+		--disable-termcap
+		--enable-symlinks
+		--with-manpage-format=normal
+		--enable-const
+		--enable-colorfgbg
+		--enable-hard-tabs
+		--enable-echo
+		$(use_enable !ada warnings)
+		$(use_with debug assertions)
+		$(use_enable !debug leaks)
+		$(use_with debug expanded)
+		$(use_with !debug macros)
+		$(multilib_native_with progs)
+		$(use_with test tests)
+		$(use_with trace)
+		$(use_with tinfo termlib)
+		--disable-stripping
+		--disable-pkg-ldflags
+	)
+
+	case ${CHOST} in
+		*-mingw32*)
+			conf+=( --enable-term-driver )
+			;;
+		*)
+			conf+=( --disable-term-driver )
+			;;
+	esac
+
+	if [[ ${target} == ncurses*w ]] ; then
+		conf+=( --enable-widec )
+	else
+		conf+=( --disable-widec )
+	fi
+	if [[ ${target} == ncursest* ]] ; then
+		conf+=( --with-{pthread,reentrant} )
+	else
+		conf+=( --without-{pthread,reentrant} )
+	fi
+
+	# Make sure each variant goes in a unique location.
+	if [[ ${target} == "ncurses" ]] ; then
+		# "ncurses" variant goes into "${EPREFIX}"/usr/include
+		# It is needed on Prefix because the configure script appends
+		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
+		conf+=( --enable-overwrite )
+	else
+		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
+	fi
+	# See comments in src_configure.
+	if [[ ${target} != "cross" ]] ; then
+		local cross_path="${WORKDIR}/cross"
+		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
+	fi
+
+	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
+}
+
+src_compile() {
+	# See comments in src_configure.
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
+	fi
+
+	multilib-minimal_src_compile
+}
+
+multilib_src_compile() {
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_compile "${t}"
+	done
+}
+
+do_compile() {
+	local target=$1
+	shift
+
+	cd "${BUILD_DIR}/${target}" || die
+
+	# A little hack to fix parallel builds ... they break when
+	# generating sources so if we generate the sources first (in
+	# non-parallel), we can then build the rest of the package
+	# in parallel.  This is not really a perf hit since the source
+	# generation is quite small.
+	emake -j1 sources
+
+	# For some reason, sources depends on pc-files which depends on
+	# compiled libraries which depends on sources which ...
+	# Manually delete the pc-files file so the install step will
+	# create the .pc files we want.
+	rm -f misc/pc-files || die
+	emake "$@"
+}
+
+multilib_src_install() {
+	local target
+	for target in "${NCURSES_TARGETS[@]}" ; do
+		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
+	done
+
+	# Move main libraries into /.
+	if multilib_is_native_abi ; then
+		gen_usr_ldscript -a \
+			"${NCURSES_TARGETS[@]}" \
+			$(usex tinfo 'tinfow tinfo' '')
+	fi
+
+	# Don't delete '*.dll.a', needed for linking, bug #631468
+	if ! use static-libs; then
+		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
+	fi
+
+	# Build fails to create this ...
+	# -FIXME-
+	# Ugly hackaround for riscv having two parts libdir (bug #689240)
+	# Replace this hack with an official solution once we have one...
+	# -FIXME-
+	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
+		/usr/$(get_libdir)/terminfo
+
+	# Remove obsolete libcurses symlink that is created by the build
+	# system. Technically, this could be also achieved
+	# via --disable-overwrite but it also moves headers implicitly,
+	# and we do not want to do this yet.
+	# bug #836696
+	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
+}
+
+multilib_src_install_all() {
+	local terms=(
+		# Dumb/simple values that show up when using the in-kernel VT.
+		ansi console dumb linux
+		vt{52,100,102,200,220}
+		# [u]rxvt users used to be pretty common.  Probably should drop this
+		# since upstream is dead and people are moving away from it.
+		rxvt{,-unicode}{,-256color}
+		# xterm users are common, as is terminals re-using/spoofing it.
+		xterm xterm-{,256}color
+		# screen is common (and reused by tmux).
+		screen{,-256color}
+		screen.xterm-256color
+	)
+	if use split-usr ; then
+		local x
+		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
+		einfo "Installing basic terminfo files in /etc..."
+		for x in "${terms[@]}"; do
+			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
+			local basedir=$(basename "$(dirname "${termfile}")")
+
+			if [[ -n ${termfile} ]] ; then
+				dodir "/etc/terminfo/${basedir}"
+				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
+				dosym "../../../../etc/terminfo/${basedir}/${x}" \
+					"/usr/share/terminfo/${basedir}/${x}"
+			fi
+		done
+
+		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
+
+		use minimal && rm -r "${ED}"/usr/share/terminfo*
+		# Because ncurses5-config --terminfo returns the directory we keep it
+		# bug #245374
+		keepdir /usr/share/terminfo
+	elif use minimal ; then
+		# Keep only the basic terminfo files
+		find "${ED}"/usr/share/terminfo/ \
+			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
+			-type d -empty -delete || die
+	fi
+
+	cd "${S}" || die
+	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
+	if use doc ; then
+		docinto html
+		dodoc -r doc/html/
+	fi
+}
+
+pkg_preinst() {
+	preserve_old_lib /$(get_libdir)/libncurses.so.5
+	preserve_old_lib /$(get_libdir)/libncursesw.so.5
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
+	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
index f4e0b8fc29..c6c2c99e85 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/Manifest
@@ -6,6 +6,7 @@ DIST readline-8.2.tar.gz.sig 95 BLAKE2B dc510459c0c47782ca87364a6677b4d8f0b68a98
 DIST readline-8.3-beta.tar.gz 3412518 BLAKE2B 196812d49ad5a56d4163a50e603269e9d7a3e4b28acf0d09103bd64a12845c107ef03fd09812f93a3854cdf0dae201e780b9e71d51ed752233f1b38fef1d87dd SHA512 5a8727420917016ef1be2ec3dff1bff433a62b9e0732707f203a6ffbbaaff6134b3ab67d22a51ee86ed2c4d94b75e0fb2d41bca8018ce52cccb44d27320dfa1d
 DIST readline-8.3-beta.tar.gz.sig 95 BLAKE2B af715b9a5e4bcad38aec353c2501b82648544429acd0db6afc19c66c0f19d6b8215e1198b3d54e09a54edb94c8a5438fc07ba80df17fa2dab789ba2201355ac5 SHA512 1906eaf283f558a5401bdfe401081ed92c77bf36c5bee19c4460cf907e9578bff6ce29423577e58d9e920760dd3822424426637dce1346569bc3668c7fead104
 DIST readline-8.3_beta_p20250128-5bcabd92f35444fa87ed49bd180a2994fd9449ba.tar.gz 3475352 BLAKE2B 7ea7ee7706a4d815e7a60acf96fdb344ef2baeb362d13cd7f5b8e6021e117c18f801ad1788689745739f9c69de2b0da1a1d04078fc2610bbdf212e42583980a3 SHA512 7267f9b1a08479f13f721afe03c8a1453ec95404ce9bdcdb3a7d150faf96522542ae26ebbcd54d648855779b60b84fe2e8d14bf78afdb6d391ce9db5642cb90c
+DIST readline-8.3_beta_p20250404-10a0a06a6b51db5d6125ecd8f79c1c844dcfc845.tar.gz 3476495 BLAKE2B abb696284e77a596a7a7557de37cb76945ae0b83cf03484a9a26e1b3ad10e1950879e20cd61e6d67db890a09dcd517fd1f2401054fa6df571b01590be9c130df SHA512 988b4fbf2d99c14b59f42ba08720d154850065ff5760e9e204026a3634e91a4d134a3568203974b7e842dbe8767e97abba6d1be568a95dad710c3cc9482c92b5
 DIST readline81-001 2454 BLAKE2B 7ec4e5c39a224a70643b44b88bcfef5198e199c76f2a34f0b0ce24f1747dd46be49ddf93871c474cda64322b4358127fec4c2401d19422f84934546bbe1f3bf2 SHA512 cfbef10bdeb562a302ccf214878d02ebadf799343b3d2d7996a282f81bcfde83997ba6dcc9a8477af4dd7c73bca74105ca00a81e42ed13321672bd2930550e54
 DIST readline81-001.sig 95 BLAKE2B 7d523d0fc21772cb03aa4b5d66ea58c1a99a6c0e4a8625e89cad015cbff63cd68e08207ca5150819225300ac864806032888104bbbea64ca38ebf89e28c24b7e SHA512 7fa3747e388aecb26f2d4f8346b89b367710ea99a14618c625066b820901dc467bd156ec37340fde1f86f0fe0d6b33044c1ed5768cf8ed1a25386d32dc6419a6
 DIST readline81-002 1242 BLAKE2B 4ef0404561bd8fc5559e8e5f675ae3f12c467178a8954f54f3204c2d09b88ccec960e807c7af0ec3514b489b676e3be51f98351e377fb18e3d7a14d33d4da69d SHA512 e47c029b82cf3a4d44e85c4348f7e059c56726694c190d84186822e1c893e1c006e7ec75f33c36791112f81abd792a2e2fdae9a65cd128f3c89ff4ffd9a9a1ff
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250404.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250404.ebuild
new file mode 100644
index 0000000000..9747576319
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/readline/readline-8.3_beta_p20250404.ebuild
@@ -0,0 +1,265 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# There's no standard way of versioning the point releases upstream
+# make anyway, so while this was added for RC versions, it's fine
+# in general.
+QA_PKGCONFIG_VERSION=$(ver_cut 1-2)
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic multilib multilib-minimal preserve-libs toolchain-funcs verify-sig
+
+# Official patches
+# See ftp://ftp.cwru.edu/pub/bash/readline-8.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+# Determine the patchlevel.
+case ${PV} in
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	*)
+		PLEVEL=0
+esac
+
+DESCRIPTION="Another cute console display library"
+HOMEPAGE="https://tiswww.case.edu/php/chet/readline/rltop.html https://git.savannah.gnu.org/cgit/readline.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/readline.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+	# It can be useful to have snapshots in the pre-release period once
+	# the first alpha is out, as various bugs get reported and fixed from
+	# the alpha, and the next pre-release is usually quite far away.
+	#
+	# i.e. if it's worth packaging the alpha, it's worth packaging a followup.
+	READLINE_COMMIT="10a0a06a6b51db5d6125ecd8f79c1c844dcfc845"
+	SRC_URI="https://git.savannah.gnu.org/cgit/readline.git/snapshot/readline-${READLINE_COMMIT}.tar.gz -> ${P}-${READLINE_COMMIT}.tar.gz"
+	S=${WORKDIR}/${PN}-${READLINE_COMMIT}
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig )"
+	S="${WORKDIR}/${MY_P}"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/readline"
+		mirror_url_base="ftp://ftp.cwru.edu/pub/readline"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			# Add in the mirror URL too.
+			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
+			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}}.sig )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
+	fi
+fi
+
+LICENSE="GPL-3+"
+SLOT="0/8"  # subslot matches SONAME major
+if (( PLEVEL >= 0 )); then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="static-libs +unicode utils"
+
+RDEPEND=">=sys-libs/ncurses-5.9-r3:=[static-libs?,unicode(+)?,${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.0-no_rpath.patch
+	"${FILESDIR}"/${PN}-7.0-headers.patch
+	"${FILESDIR}"/${PN}-8.0-headers.patch
+
+	# TODO: rebase
+	#"${FILESDIR}"/${PN}-8.0-darwin-shlib-versioning.patch
+)
+
+src_unpack() {
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
+		git-r3_src_unpack
+	elif (( PLEVEL < 0 )) && [[ ${PV} == *_p* ]] ; then
+		default
+	else
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
+
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
+			done
+		fi
+
+		unpack "${MY_P}.tar.gz"
+
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+		fi
+	fi
+}
+
+src_prepare() {
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	default
+
+	#(( PLEVEL < 0 )) && eautoreconf
+
+	if use prefix && [[ ! -x "${BROOT}"/usr/bin/pkg-config ]] ; then
+		# If we're bootstrapping, make a guess. We don't have pkg-config
+		# around yet. bug #818103.
+		# Incorrectly populating this leads to underlinked libreadline.
+		local ncurses_libs
+		local ncurses_libs_suffix=$(usex unicode w '')
+
+		ncurses_libs="-lncurses${ncurses_libs_suffix}"
+
+		if has_version "sys-libs/ncurses[tinfo(+)]" ; then
+			ncurses_libs+=" -ltinfo${ncurses_libs_suffix}"
+		fi
+	else
+		# Force ncurses linking, bug #71420.
+		# Use pkg-config to get the right values, bug #457558.
+		local ncurses_libs=$($(tc-getPKG_CONFIG) ncurses$(usex unicode w '') --libs)
+	fi
+
+	sed -i \
+		-e "/^SHLIB_LIBS=/s:=.*:='${ncurses_libs}':" \
+		support/shobj-conf || die
+	sed -i \
+		-e "/^[[:space:]]*LIBS=.-lncurses/s:-lncurses:${ncurses_libs}:" \
+		examples/rlfe/configure || die
+
+	# Fix building under Gentoo/FreeBSD; upstream FreeBSD deprecated
+	# objformat for years, so we don't want to rely on that.
+	sed -i -e '/objformat/s:if .*; then:if true; then:' support/shobj-conf || die
+
+	# For local readline headers
+	ln -s ../.. examples/rlfe/readline || die
+}
+
+src_configure() {
+	# Fix implicit decls with widechar funcs
+	append-cppflags -D_GNU_SOURCE
+	# https://lists.gnu.org/archive/html/bug-readline/2010-07/msg00013.html
+	append-cppflags -Dxrealloc=_rl_realloc -Dxmalloc=_rl_malloc -Dxfree=_rl_free
+
+	# Make sure configure picks a better ar than `ar`, bug #484866
+	export ac_cv_prog_AR="$(tc-getAR)"
+
+	# Force the test since we used sed above to force it.
+	export bash_cv_termcap_lib=ncurses
+
+	# Control cross-compiling cases when we know the right answer.
+	# In cases where the C library doesn't support wide characters, readline
+	# itself won't work correctly, so forcing the answer below should be OK.
+	if tc-is-cross-compiler ; then
+		export bash_cv_func_sigsetjmp="present"
+		export bash_cv_func_ctype_nonascii="yes"
+		# bug #503312
+		export bash_cv_wcwidth_broken="no"
+	fi
+
+	# This is for rlfe, but we need to make sure LDFLAGS doesn't change
+	# so we can re-use the config cache file between the two.
+	append-ldflags -L.
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--cache-file="${BUILD_DIR}"/config.cache
+		--with-curses
+		$(use_enable static-libs static)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		mkdir -p examples/rlfe || die
+		cd examples/rlfe || die
+
+		ECONF_SOURCE="${S}"/examples/rlfe econf --cache-file="${BUILD_DIR}"/config.cache
+	fi
+}
+
+multilib_src_compile() {
+	emake
+
+	if use utils && multilib_is_native_abi && ! tc-is-cross-compiler ; then
+		# Code is full of AC_TRY_RUN()
+		cd examples/rlfe || die
+		local l
+		for l in readline history ; do
+			ln -s ../../shlib/lib${l}$(get_libname)* lib${l}$(get_libname) || die
+			ln -s ../../lib${l}.a lib${l}.a || die
+		done
+		emake
+	fi
+}
+
+multilib_src_install() {
+	default
+
+	if multilib_is_native_abi ; then
+		if use utils && ! tc-is-cross-compiler; then
+			dobin examples/rlfe/rlfe
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	HTML_DOCS="doc/history.html doc/readline.html doc/rluserman.html" einstalldocs
+
+	dodoc USAGE
+	docinto ps
+	dodoc doc/*.ps
+}
+pkg_preinst() {
+	# bug #29865
+	# Reappeared in bug #595324 with paludis so keeping this for now...
+	preserve_old_lib \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify \
+		/$(get_libdir)/lib{history,readline}$(get_libname 4) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 5) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 6) \
+		/$(get_libdir)/lib{history,readline}$(get_libname 7)
+}