diff --git a/.github/workflows/portage-stable-packages-list b/.github/workflows/portage-stable-packages-list
index f55acd0a8d..56896e91d1 100644
--- a/.github/workflows/portage-stable-packages-list
+++ b/.github/workflows/portage-stable-packages-list
@@ -172,7 +172,7 @@ dev-python/cython
 dev-python/distro
 dev-python/docutils
 dev-python/fasteners
-dev-python/flit_core
+dev-python/flit-core
 dev-python/gentoo-common
 dev-python/gpep517
 dev-python/inflect
@@ -361,6 +361,7 @@ sys-apps/i2c-tools
 sys-apps/iucode_tool
 sys-apps/less
 sys-apps/portage
+sys-apps/sed
 sys-apps/texinfo
 
 sys-devel/autoconf
diff --git a/bootstrap_sdk b/bootstrap_sdk
index 54ab9e8979..278430d08c 100755
--- a/bootstrap_sdk
+++ b/bootstrap_sdk
@@ -201,11 +201,7 @@ build_stage1() {
     sed -i "s:^portdir.*:portdir=\"$stage1_repos/gentoo\":" \
          "$TEMPDIR/catalyst-stage1.conf"
     # take the "portage directory" (portage-stable copy) snapshot
-    catalyst \
-        "${DEBUG[@]}" \
-        --verbose \
-        --config "$TEMPDIR/catalyst-stage1.conf" \
-        --snapshot "$FLAGS_version-stage1"
+    build_snapshot "${TEMPDIR}/catalyst-stage1.conf" "${FLAGS_version}-stage1"
 
     # Update the stage 1 spec to use the "known-good" portage-stable snapshot
     #  and coreos-overlay copy repository versions from above.
diff --git a/build_library/catalyst.sh b/build_library/catalyst.sh
index 43626bcf43..ea1f6a9765 100644
--- a/build_library/catalyst.sh
+++ b/build_library/catalyst.sh
@@ -157,6 +157,8 @@ catalyst_init() {
     switch_to_strict_mode
     eval set -- "${FLAGS_ARGV}"
 
+    local stage
+
     if [[ -n "${FORCE_STAGES}" ]]; then
         STAGES="${FORCE_STAGES}"
     elif [[ $# -eq 0 ]]; then
@@ -248,6 +250,8 @@ write_configs() {
 }
 
 build_stage() {
+    local stage srcpath catalyst_conf target_tarball
+
     stage="$1"
     srcpath="$2"
     catalyst_conf="$3"
@@ -268,7 +272,7 @@ build_stage() {
         --config "$TEMPDIR/catalyst.conf" \
         --file "$TEMPDIR/${stage}.spec" \
         --cli "source_subpath=$srcpath"
-    # Catalyst doesn't clean up after itself...
+    # Catalyst does not clean up after itself...
     rm -rf "$TEMPDIR/$stage-${ARCH}-${FLAGS_version}"
     ln -sf "$stage-${ARCH}-${FLAGS_version}.tar.bz2" \
         "$BUILDS/$stage-${ARCH}-latest.tar.bz2"
@@ -276,8 +280,13 @@ build_stage() {
 }
 
 build_snapshot() {
-    local snapshot="portage-${FLAGS_version}.tar.bz2"
-    local snapshot_path="$CATALYST_ROOT/snapshots/${snapshot}"
+    local catalyst_conf snapshot snapshots_dir snapshot_base snapshot_path
+
+    catalyst_conf=${1:-"${TEMPDIR}/catalyst.conf"}
+    snapshot=${2:-"${FLAGS_version}"}
+    snapshots_dir="${CATALYST_ROOT}/snapshots"
+    snapshot_base="${snapshots_dir}/gentoo-${snapshot}"
+    snapshot_path="${snapshot_base}.tar.bz2"
     if [[ -f "${snapshot_path}" && $FLAGS_rebuild == $FLAGS_FALSE ]]
     then
         info "Skipping snapshot, ${snapshot_path} exists"
@@ -286,8 +295,31 @@ build_snapshot() {
         catalyst \
             "${DEBUG[@]}" \
             --verbose \
-            --config "$TEMPDIR/catalyst.conf" \
-            --snapshot "$FLAGS_version"
+            --config "${catalyst_conf}" \
+            --snapshot "${snapshot}"
+    fi
+    local f
+    local to_remove=()
+    # This will expand to at least our just built snapshot tarball, so
+    # no nullglob is needed here.
+    for f in "${snapshot_base}".*; do
+        case "${f}" in
+            "${snapshot_path}")
+                # Our snapshot, keep it as is.
+                :
+                ;;
+            *.CONTENTS|*.CONTENTS.gz|*.DIGESTS)
+                # These can stay, catalyst is not bothered by those.
+                :
+                ;;
+            *)
+                to_remove+=("${f}")
+                ;;
+        esac
+    done
+    if [[ ${#to_remove[@]} -gt 0 ]]; then
+        info "$(printf '%s\n' 'Found spurious files in snapshots directory that may confuse Catalyst, removing them:' "${to_remove[@]}")"
+        rm -rf "${to_remove[@]}"
     fi
 }
 
@@ -299,6 +331,8 @@ catalyst_build() {
     write_configs
     build_snapshot
 
+    local used_seed
+
     used_seed=0
     if [[ "$STAGES" =~ stage1 ]]; then
         build_stage stage1 "$SEED"
@@ -330,5 +364,5 @@ catalyst_build() {
     fi
 
     # Cleanup snapshots, we don't use them
-    rm -rf "$CATALYST_ROOT/snapshots/portage-${FLAGS_version}.tar.bz2"*
+    rm -rf "$CATALYST_ROOT/snapshots/gentoo-${FLAGS_version}.tar.bz2"*
 }
diff --git a/changelog/security/2023-05-25-weekly-updates.md b/changelog/security/2023-05-25-weekly-updates.md
new file mode 100644
index 0000000000..5edde34039
--- /dev/null
+++ b/changelog/security/2023-05-25-weekly-updates.md
@@ -0,0 +1,3 @@
+- git ([CVE-2023-25652](https://nvd.nist.gov/vuln/detail/CVE-2023-25652), [CVE-2023-25815](https://nvd.nist.gov/vuln/detail/CVE-2023-25815), [CVE-2023-29007](https://nvd.nist.gov/vuln/detail/CVE-2023-29007))
+- curl ([CVE-2023-28319](https://nvd.nist.gov/vuln/detail/CVE-2023-28319), [CVE-2023-28320](https://nvd.nist.gov/vuln/detail/CVE-2023-28320), [CVE-2023-28321](https://nvd.nist.gov/vuln/detail/CVE-2023-28321), [CVE-2023-28322](https://nvd.nist.gov/vuln/detail/CVE-2023-28322))
+- libcap ([CVE-2023-2602](https://nvd.nist.gov/vuln/detail/CVE-2023-2602), [CVE-2023-2603](https://nvd.nist.gov/vuln/detail/CVE-2023-2603))
diff --git a/changelog/updates/2023-05-25-weekly-updates.md b/changelog/updates/2023-05-25-weekly-updates.md
new file mode 100644
index 0000000000..556d62d47b
--- /dev/null
+++ b/changelog/updates/2023-05-25-weekly-updates.md
@@ -0,0 +1,8 @@
+- zstandard ([1.5.5](https://github.com/facebook/zstd/releases/tag/v1.5.5))
+- qemu guest agent ([8.0.0](https://wiki.qemu.org/ChangeLog/8.0#Guest_agent))
+- SDK: python ([3.10.11](https://www.python.org/downloads/release/python-31011/))
+- glib ([2.76.2](https://gitlab.gnome.org/GNOME/glib/-/releases/2.76.2))
+- git ([2.39.3](https://github.com/git/git/blob/v2.39.3/Documentation/RelNotes/2.39.3.txt))
+- curl ([8.1.0](https://curl.se/changes.html#8_1_0))
+- sed ([4.9](https://lists.gnu.org/archive/html/info-gnu/2022-11/msg00001.html))
+- libcap ([2.69](https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.iuvg7sbjg8pe))
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r208.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r207.ebuild
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1-r208.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 95e47322a0..bc2cd7df3e 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -50,7 +50,7 @@ RDEPEND="${RDEPEND}
 	dev-libs/libyaml
 	dev-libs/nspr
 	dev-libs/protobuf
-	dev-python/flit_core
+	dev-python/flit-core
 	dev-python/gpep517
 	dev-python/setuptools
 	dev-python/wheel
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index d2fe2687cc..dfa5abe405 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -2,14 +2,6 @@
 # Copyright (c) 2013 The CoreOS Authors. All rights reserved.
 # Distributed under the terms of the GNU General Public License v2
 
-# Necessary to fix CVE-2022-48303.
-=app-arch/tar-1.34-r3 ~amd64 ~arm64
-
-# Necessary to fix CVE-2023-0288, CVE-2023-0433, CVE-2023-1127,
-# CVE-2023-1175 and CVE-2023-1170.
-=app-editors/vim-9.0.1403 ~arm64
-=app-editors/vim-core-9.0.1403 ~arm64
-
 # Required for addressing CVE-2022-3715.
 =app-shells/bash-5.2_p15-r2 ~amd64 ~arm64
 
@@ -23,26 +15,14 @@
 =dev-libs/libbsd-0.11.7-r2 ~arm64
 =dev-libs/libgcrypt-1.10.1-r3 ~arm64
 
-# Required for CVE-2023-28484 and CVE-2023-29469
-=dev-libs/libxml2-2.10.4 ~amd64 ~arm64
-
 # To keep the same version on both arches
 =dev-util/bpftool-6.2.1 ~arm64
 
 # Required for addressing CVE-2023-0361.
 =net-libs/gnutls-3.8.0 ~amd64 ~arm64
 
-# Required for addressing CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27537 and CVE-2023-27538
-=net-misc/curl-8.0.1 ~amd64 ~arm64
-
-# Required for addressing CVE-2022-29154
-# Also to keep the same version on both arches
-=net-misc/rsync-3.2.7-r2 ~amd64
-
-# To keep the same version on both arches
-=sys-devel/binutils-2.39-r5 ~arm64
-=sys-devel/gcc-12.2.1_p20230340 ~arm64
-=sys-libs/binutils-libs-2.39-r5 ~arm64
+# Required for addressing CVE-2023-28319, CVE-2023-28320, CVE-2023-28321 and CVE-2023-28322
+=net-misc/curl-8.1.0 ~amd64 ~arm64
 
 =sys-fs/cryptsetup-2.4.1-r1 ~amd64 ~arm64
 
@@ -55,6 +35,9 @@
 # FIPS support is still being tested
 =sys-fs/cryptsetup-2.4.3-r1 ~amd64 ~arm64
 
+# Needed to address CVE-2023-2602 and CVE-2023-2603
+=sys-libs/libcap-2.69 ~amd64 ~arm64
+
 =sys-power/acpid-2.0.33 ~amd64 ~arm64
 
 # A dependency of app-shells/bash version that we need for security
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/cpio/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/cpio/Manifest
index 1bc147148d..dfe669870d 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/cpio/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/cpio/Manifest
@@ -1,2 +1,3 @@
 DIST cpio-2.13-CVE-2021-38185.patch.xz 7844 BLAKE2B e338950e03c3eed3b4288435c9c75af8f0c3497b43680be4ee347e628db7cfac616b437a848094bf82cfc2c7f29d59b388bf0f6368b3b99770022e3f9533be11 SHA512 4d2cafefcd1ae9d86cb5171de2896799713490dfd9ed27d3dce0886fa4588c8df2b16ad8508a5dbb9155c9de6e40b6d1083bdb4774d967193a270a1dcbe37a33
 DIST cpio-2.13.tar.bz2 1354559 BLAKE2B 45d77723acb55f15c8574ab5a2fdff6fb1767629d177dd3416b0268e9f82ee6bdd11b4fa591ef020efccbdc3f4918cf77263169da1a0f6422dfe1a9712295778 SHA512 459398e69f7f48201c04d1080218c50f75edcf114ffcbb236644ff6fcade5fcc566929bdab2ebe9be5314828d6902e43b348a8adf28351df978c8989590e93a3
+DIST cpio-2.14.tar.bz2 1521004 BLAKE2B f2fa9f5bc39cd91f4755fdf27f43cff4d1c1f098639502689a01314762ad686bf357a1eda7f92e4c802e6e8335548ca31fc789cea056ef685c558892ddcbebd1 SHA512 2dc93a81e31b6fb7ff9976243d22ca7a84bb396c7ad09e0abfb5d5efae1164ebb319fb89be45045797f8c604b3e3d2ea0746e3cfe559aa86282ea4ec9a17da28
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/cpio/cpio-2.14.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/cpio/cpio-2.14.ebuild
new file mode 100644
index 0000000000..1d3937b4bb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/cpio/cpio-2.14.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A file archival tool which can also read and write tar files"
+HOMEPAGE="https://www.gnu.org/software/cpio/cpio.html"
+SRC_URI="mirror://gnu/cpio/${P}.tar.bz2"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="nls"
+
+PDEPEND="
+	app-alternatives/cpio
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.12-non-gnu-compilers.patch #275295
+	"${FILESDIR}"/${PN}-2.14-sysmacros-glibc-2.26.patch
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable nls)
+		--bindir="${EPREFIX}"/bin
+		--with-rmt="${EPREFIX}"/usr/sbin/rmt
+		# install as gcpio for better compatibility with non-GNU userland
+		--program-prefix=g
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+pkg_postinst() {
+	# ensure to preserve the symlink before app-alternatives/cpio
+	# is installed
+	if [[ ! -h ${EROOT}/bin/cpio ]]; then
+		ln -s gcpio "${EROOT}/bin/cpio" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/cpio/files/cpio-2.14-sysmacros-glibc-2.26.patch b/sdk_container/src/third_party/portage-stable/app-arch/cpio/files/cpio-2.14-sysmacros-glibc-2.26.patch
new file mode 100644
index 0000000000..e6b187c8f5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/cpio/files/cpio-2.14-sysmacros-glibc-2.26.patch
@@ -0,0 +1,42 @@
+--- a/am/ax_compile_check_rettype.m4
++++ b/am/ax_compile_check_rettype.m4
+@@ -70,6 +70,9 @@ AC_CACHE_VAL(AC_CV_NAME,
+ [for ac_type in char short int long "long long" $4
+  do 
+   AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
++#ifdef HAVE_SYS_SYSMACROS_H
++#include <sys/sysmacros.h>
++#endif
+ #include <sys/types.h>
+ $3
+ ]], [[switch (0) case 0: case (sizeof ($1($2)) == sizeof ($ac_type)):;]])], [AC_CV_NAME=$ac_type])
+--- a/configure.ac
++++ b/configure.ac
+@@ -37,14 +37,11 @@ gl_EARLY
+ AC_C_PROTOTYPES
+ 
+ AC_SYS_LARGEFILE
+-AC_HEADER_MAJOR
+ AC_C_CONST
+ AC_TYPE_UID_T
+ AC_CHECK_TYPE(gid_t, int)
+ 
+ AC_HEADER_DIRENT
+-AX_COMPILE_CHECK_RETTYPE([major], [0])
+-AX_COMPILE_CHECK_RETTYPE([minor], [0])
+ 
+ AC_CHECK_FUNCS([fchmod fchown])
+ # This is needed for mingw build
+@@ -65,7 +62,11 @@ AC_ARG_ENABLE(mt,
+ 
+ AM_CONDITIONAL([CPIO_MT_COND], [test "$enable_mt" = yes])
+ 
+-AC_CHECK_HEADERS([unistd.h stdlib.h string.h fcntl.h pwd.h grp.h sys/io/trioctl.h utmp.h getopt.h locale.h libintl.h sys/wait.h utime.h locale.h process.h sys/ioctl.h])
++AC_CHECK_HEADERS([unistd.h stdlib.h string.h fcntl.h pwd.h grp.h sys/io/trioctl.h utmp.h getopt.h locale.h libintl.h sys/wait.h utime.h locale.h process.h sys/ioctl.h sys/sysmacros.h])
++
++AC_HEADER_MAJOR
++AC_COMPILE_CHECK_RETTYPE([major], [0])
++AC_COMPILE_CHECK_RETTYPE([minor], [0])
+ 
+ AC_CHECK_DECLS([errno, getpwnam, getgrnam, getgrgid, strdup, strerror, getenv, atoi, exit], , , [
+ #include <stdio.h>
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.34-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.34-r3.ebuild
index da958a8447..9ded78207c 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.34-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.34-r3.ebuild
@@ -18,7 +18,7 @@ SRC_URI+=" verify-sig? (
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ -z "$(ver_cut 3)" ]] || [[ "$(ver_cut 3)" -lt 90 ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 IUSE="acl minimal nls selinux xattr"
 
@@ -97,7 +97,7 @@ pkg_postinst() {
 		if [[ -e ${EROOT}/usr/bin/tar ]] ; then
 			# bug #904887
 			ewarn "${EROOT}/usr/bin/tar exists but is not a symlink."
-			ewarn "This is expected during Prefix bootstrap and unsual otherwise."
+			ewarn "This is expected during Prefix bootstrap and unusual otherwise."
 			ewarn "Moving away unexpected ${EROOT}/usr/bin/tar to .bak."
 			mv "${EROOT}/usr/bin/tar" "${EROOT}/usr/bin/tar.bak" || die
 		fi
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
index 457b0d0a09..1bef075437 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/Manifest
@@ -1,8 +1,8 @@
-DIST xz-5.2.10.tar.gz 2123206 BLAKE2B fdd9e77e21ee65482401e0e43e0b291093a227d452991a9182562989b7a4388ceed30d5d54cd7f86320dcc073eb792032a49741880338a29043a8380507c4215 SHA512 c3814680fcad421efa71cf977217a62c34e3223900302a6fd7d505f310a7b338815feee2c8225b1232bd22b9e29c7dda3664e54dae2d80f816daec6adf560ca1
-DIST xz-5.2.10.tar.gz.sig 566 BLAKE2B ce72730816d03084dc0d1559d6f2890b3ebe25a5e6b0720d4775ba2364762b5d1934a3a53f2255f6e68a1cdf42778d85d8b02ab30396b2addab619e95855f733 SHA512 48a0864abee6639116678afab6e8319eb2de903b381362c611fb77f9b6fc21df5f7d9783a250810f7ecc08380fb371a3a791ab55f5a343b68b9d4f9e414da403
 DIST xz-5.2.11.tar.gz 2130684 BLAKE2B e513f99b2e28fa79f32747e21138cc13ab9340e95a302ac742bc6bda088465488173ea212704c4612f4059bbbc6c6a5b041332d84b999dc7df5b3fab1b1ac4e9 SHA512 8f75450380563229465420f4518fa7a60bbe6f0c9a3b580c2a9a7bf9bf380ad69209f792764115c346d89c49711478e8db42325ef9a46ccd3a6ec72292890ac8
 DIST xz-5.2.11.tar.gz.sig 566 BLAKE2B 34186ea22960f508dd796736107b99e1e3884ffae683f26671f455e46e4debf87400f2d7bb64b446fb142370a8bcebc6c05dce34dcc2678a761b9401b1e23860 SHA512 036ed0f663e179057a805a41052d3e437fbfb9dbbe173c5180fbb255f5a01ac4fa2561424228f4e568e63b22802b3a4ffd88dec2ba7c41a454998ebea30bea7c
-DIST xz-5.4.1.tar.gz 2528617 BLAKE2B f4dc8698fb97002aa0548107b448ab0dd8659cce506a83775930f95fd775601f7de1df44866310ac617853410a1915cd4e90ad4088b2fd56418e67b6f0fc4e98 SHA512 5cff8383a68fb88ecbb3770ec48af0ad5582e08de9dccd339e0b685aaa53447e59d6425caa3f63b54a674e5d78c20520876db547d156e6658ad4841660cba85b
-DIST xz-5.4.1.tar.gz.sig 566 BLAKE2B f384bcf7ea6bd7d3af65b6b17b379b48826257f403bca0bed1b42697f88edbc38f38eaac03c5564fc466df670f40e2e7ee49974232da4eb849718e89234c224b SHA512 2e6c3bf04ceb29c1bac8fdde7aa09c4d0f96442515d797e06ea860f365fd94777630b0034b98006cf844083efea8642a0bf87b1ff56de6a58446a644b1fd3c1c
+DIST xz-5.2.12.tar.gz 2190541 BLAKE2B 9ca5ecf753ae264f542ec53b4c9a1c85466bc2a932651aafb0ae2a3ebb7d3979a9384e9a81f16173c2d6d14ca8b86e4a820191817675a5e9fd214a64cf364c98 SHA512 1a67112eb1cfd70352c41a1cbb5e34eacd6da2ae816f5020385772a7698b835d059843c2c30461beb15b7514e95906b2033dac6abf09248b5837270420dfe732
+DIST xz-5.2.12.tar.gz.sig 566 BLAKE2B 93d0fb89186ccf018d17278823c2c6cc724798acfe425fd01ecf54338e53451d94b1ad951f2f1ec58171a3eb827fcd6b5d9dcb97da72c5d8545d57d9fba0597b SHA512 0734e1838dd9ab7ba06675af0f4ff5866c0e5c268f0c3e2ca6f12fa8f27b41830d11063244b0039f8d8ba184efc1c1b7b9a7311c378a02abc1290d7727357cb6
 DIST xz-5.4.2.tar.gz 2799022 BLAKE2B 3c622b0823f0cbb5fbc5eaa0372fc2f0fefe0950d131417f831bce47b6d9747d145429f0649de106819331f9ae6a289c497182c7b6d1e211513308dd083a9b72 SHA512 149f980338bea3d66de1ff5994b2b236ae1773135eda68b62b009df0c9dcdf5467f8cb2c06da95a71b6556d60bd3d21f475feced34d5dfdb80ee95416a2f9737
 DIST xz-5.4.2.tar.gz.sig 566 BLAKE2B 95c9c70fdd25b92095dd9691e4d9d4306a3f982becfe7bd42ca6132a76f29be2c2bc66f4fc2bda547058c18e227292f4185799eb905084fc3ab415ae867b4b1b SHA512 30e965c228ed3a8ecb804db8eb11703a765b7ee934030ea69bb3940b630811eb71bf74fd20371ef7759761904ece4f0144a0b00be4d843cf98299fd016f161aa
+DIST xz-5.4.3.tar.gz 2869347 BLAKE2B c4192a59ca751567ebab17e08e72aa1bf0f5ca14af0b59fded1c4dff02c1b76ab30119a4138932f78f69bd4b7827071c81d6ca1c56be65491466ea061786ed78 SHA512 aff0fe166af6df4491a6f5df2372cab100b081452461a0e8c6fd65b72af3f250f16c64d9fb8fd309141e9b9ae4e41649f48687cc29e63dd82f27f2eab19b4023
+DIST xz-5.4.3.tar.gz.sig 566 BLAKE2B 1e3f86a2de532e77cae4c31928d57edeac81ca207e03c71523210605dc6bab76a50793697a242b232f74911c6e1872a0339ed977e2dd0d201504bd859fd3b4f4 SHA512 b7c7eedf4d9604ee50ec97275e5ab57e22a567402815281440ca765210c75707bd2de20e7ebfb0842725690ae19557916fc41a9fbdace5fec8190632b038292e
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.11.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.11.ebuild
index f867fbc26f..ee655f3ae8 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.11.ebuild
@@ -28,7 +28,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.10.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.12.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.10.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.12.ebuild
index ee655f3ae8..52e2b5940b 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.2.12.ebuild
@@ -4,7 +4,7 @@
 # Remember: we cannot leverage autotools in this ebuild in order
 #           to avoid circular deps with autotools
 
-EAPI=7
+EAPI=8
 
 inherit libtool multilib multilib-minimal preserve-libs usr-ldscript
 
@@ -15,7 +15,7 @@ if [[ ${PV} == 9999 ]] ; then
 	# bug #272880 and bug #286068
 	BDEPEND="sys-devel/gettext >=sys-devel/libtool-2"
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/lassecollin.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/jiatan.asc
 	inherit verify-sig
 
 	MY_P="${PN/-utils}-${PV/_}"
@@ -28,7 +28,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -43,7 +43,7 @@ SLOT="0"
 IUSE="+extra-filters nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20230213 )"
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-jiatan )"
 fi
 
 # Tests currently do not account for smaller feature set
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild
index d33859844c..c5051bd242 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.2.ebuild
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
similarity index 83%
rename from sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
index 7dd91d3d69..e30876d4e1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.3.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]] ; then
 	# bug #272880 and bug #286068
 	BDEPEND="sys-devel/gettext >=sys-devel/libtool-2"
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/lassecollin.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/jiatan.asc
 	inherit verify-sig
 
 	MY_P="${PN/-utils}-${PV/_}"
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -47,10 +47,10 @@ HOMEPAGE="https://tukaani.org/xz/"
 # See top-level COPYING file as it outlines the various pieces and their licenses.
 LICENSE="public-domain LGPL-2.1+ GPL-2+"
 SLOT="0"
-IUSE="+extra-filters nls static-libs"
+IUSE="doc +extra-filters nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20230213 )"
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-jiatan )"
 fi
 
 src_prepare() {
@@ -68,6 +68,7 @@ src_prepare() {
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
+		$(multilib_native_use_enable doc)
 		$(use_enable nls)
 		$(use_enable static-libs static)
 	)
@@ -110,7 +111,10 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	find "${ED}" -type f -name '*.la' -delete || die
-	rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
+
+	if use doc ; then
+		rm "${ED}"/usr/share/doc/${PF}/COPYING* || die
+	fi
 }
 
 pkg_preinst() {
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index a6b8dfa60f..e30876d4e1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == 9999 ]] ; then
 	# bug #272880 and bug #286068
 	BDEPEND="sys-devel/gettext >=sys-devel/libtool-2"
 else
-	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/lassecollin.asc
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/jiatan.asc
 	inherit verify-sig
 
 	MY_P="${PN/-utils}-${PV/_}"
@@ -50,7 +50,7 @@ SLOT="0"
 IUSE="doc +extra-filters nls static-libs"
 
 if [[ ${PV} != 9999 ]] ; then
-	BDEPEND+=" verify-sig? ( >=sec-keys/openpgp-keys-lassecollin-20230213 )"
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-jiatan )"
 fi
 
 src_prepare() {
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.5.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.5.ebuild
index 0faac9e309..384e7a767d 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.5.ebuild
@@ -12,7 +12,7 @@ S="${WORKDIR}"/${P}/build/meson
 
 LICENSE="|| ( BSD GPL-2 )"
 SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="+lzma lz4 static-libs test zlib"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.2.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.2.ebuild
index 3c224b561e..37fb304f40 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/adcli/adcli-0.9.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2021-2022 Gentoo Authors
+# Copyright 2021-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ SRC_URI="https://gitlab.freedesktop.org/realmd/adcli/-/archive/${PV}/${P}.tar.bz
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="~amd64 ~arm64 ~x86"
 IUSE="doc"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/files/pinentry-1.2.1-automagic-capslock.patch b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/files/pinentry-1.2.1-automagic-capslock.patch
new file mode 100644
index 0000000000..081fad60eb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/files/pinentry-1.2.1-automagic-capslock.patch
@@ -0,0 +1,99 @@
+https://dev.gnupg.org/T6161
+https://bugs.gentoo.org/819939
+https://bugs.gentoo.org/837719
+--- a/configure.ac
++++ b/configure.ac
+@@ -508,8 +508,12 @@ fi
+ dnl
+ dnl Check for libX11 library
+ dnl
++AC_ARG_WITH(x,
++        AS_HELP_STRING([--with-x],[use libX11]),
++        [want_x11=$withval], [want_x11=maybe])
++
+ have_x11=no
+-if test "$have_w32_system" != "yes"; then
++AS_IF([test "$have_w32_system" != "yes" && test "$want_x11" != "no"], [
+ 	PKG_CHECK_MODULES(
+ 		LIBX11,
+ 		[x11],
+@@ -519,18 +523,20 @@ if test "$have_w32_system" != "yes"; then
+ 			have_x11=no
+ 		]
+ 	)
++])
+ 
+-	if test "$have_x11" = "yes"; then
+-		AC_DEFINE(HAVE_X11, 1,
+-			[The pinentries can optionally use x11.])
+-	fi
+-fi
++AS_IF([test "$have_x11" = "yes"], [AC_DEFINE(HAVE_X11, 1, [The pinentries can optionally use x11.])])
+ 
+ dnl
+ dnl Check for KF5WaylandClient library
+ dnl
++
++AC_ARG_ENABLE(kf5-wayland,
++	AS_HELP_STRING([--enable-kf5-wayland],[use KF5WaylandClient for capslock indication on Wayland]),
++	[want_kf5_wayland=$enableval], [want_kf5_wayland=maybe])
++
+ have_kf5waylandclient=no
+-if test "$have_w32_system" != "yes"; then
++AS_IF([test "$have_w32_system" != "yes" && test "$want_kf5_wayland" != "no"], [
+ 	PKG_CHECK_MODULES(
+ 		KF5WAYLANDCLIENT,
+ 		[KF5WaylandClient >= 5.60],
+@@ -540,7 +546,7 @@ if test "$have_w32_system" != "yes"; then
+ 			have_kf5waylandclient=no
+ 		]
+ 	)
+-fi
++])
+ 
+ dnl
+ dnl Check for Qt5 pinentry program.
+--- a/m4/qt.m4
++++ b/m4/qt.m4
+@@ -33,6 +33,10 @@ AC_DEFUN([FIND_QT],
+                 enable_pinentry_qt5=$enableval,
+                 enable_pinentry_qt5="try")
+ 
++  AC_ARG_ENABLE(qtx11extras,
++                AS_HELP_STRING([--enable-qtx11extras],[use Qt5X11Extras for capslock indication on X11]),
++        [want_qtx11extras=$enableval], [want_qtx11extras=maybe])
++
+   have_qt5_libs="no";
+   require_qt_cpp11="no";
+ 
+@@ -63,20 +67,22 @@ AC_DEFUN([FIND_QT],
+       fi
+     fi
+ 
+-    if test "$have_x11" = "yes"; then
++    have_qt5_x11extras=no
++    AS_IF([test "$have_x11" = "yes" && test "$want_qtx11extras" != "no"], [
+       PKG_CHECK_MODULES(
+         PINENTRY_QT_X11_EXTRAS,
+         Qt5X11Extras >= 5.1.0,
+         [have_qt5_x11extras="yes"],
+-        [
+-          AC_MSG_WARN([pinentry-qt will be built without Caps Lock warning on X11])
+-          have_qt5_x11extras="no"
+-        ])
+-      if test "$have_qt5_x11extras" = "yes"; then
++        [have_qt5_x11extras="no"]
++     )
++    ])
++
++    AS_IF([test "$have_qt5_x11extras" = "yes"], [
+         PINENTRY_QT_CFLAGS="$LIBX11_CFLAGS $PINENTRY_QT_CFLAGS $PINENTRY_QT_X11_EXTRAS_CFLAGS"
+         PINENTRY_QT_LIBS="$LIBX11_LIBS $PINENTRY_QT_LIBS $PINENTRY_QT_X11_EXTRAS_LIBS"
+-      fi
+-    fi
++    ], [
++        AC_MSG_WARN([pinentry-qt will be built without Caps Lock warning on X11])
++    ])
+ 
+     AC_CHECK_TOOL(MOC, moc)
+     AC_MSG_CHECKING([moc version])
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r3.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r3.ebuild
index ee27968fb8..d4f9672639 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r3.ebuild
@@ -14,19 +14,24 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="caps efl emacs gnome-keyring gtk ncurses qt5"
+IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
 
 DEPEND="
 	>=dev-libs/libassuan-2.1
 	>=dev-libs/libgcrypt-1.6.3
 	>=dev-libs/libgpg-error-1.17
 	efl? ( dev-libs/efl[X] )
-	gnome-keyring? ( app-crypt/libsecret )
+	keyring? ( app-crypt/libsecret )
 	ncurses? ( sys-libs/ncurses:= )
 	qt5? (
 		dev-qt/qtcore:5
 		dev-qt/qtgui:5
 		dev-qt/qtwidgets:5
+		wayland? ( kde-frameworks/kwayland:5 )
+		X? (
+			dev-qt/qtx11extras:5
+			x11-libs/libX11
+		)
 	)
 "
 RDEPEND="
@@ -44,6 +49,7 @@ DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
 
 PATCHES=(
 	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+	"${FILESDIR}/${PN}-1.2.1-automagic-capslock.patch" # bug #819939, bug #837719
 )
 
 src_prepare() {
@@ -61,11 +67,14 @@ src_configure() {
 	local myeconfargs=(
 		$(use_enable efl pinentry-efl)
 		$(use_enable emacs pinentry-emacs)
-		$(use_enable gnome-keyring libsecret)
+		$(use_enable keyring libsecret)
 		$(use_enable gtk pinentry-gnome3)
 		$(use_enable ncurses fallback-curses)
 		$(use_enable ncurses pinentry-curses)
 		$(use_enable qt5 pinentry-qt)
+		$(use_enable wayland kf5-wayland)
+		$(use_enable X qtx11extras)
+		$(use_with X x)
 
 		--enable-pinentry-tty
 		--disable-pinentry-fltk
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
index 3ae9428c36..dbc1824706 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest
@@ -1,3 +1 @@
-DIST nano-6.4.tar.xz 1593804 BLAKE2B b59ff7a741ce4c8b31afdbbfaf1d704cccbceddcd7f1421f30a6dd40495ec456ca891aeb9777c070c6cce4e9c594f83798ff0cdacdfe06e81b0aa0b700033da3 SHA512 cff2d9d90f1a23ab8905320e651f8bbc9d38046153a4f64bbc21927687d9628135915468b00b28f88a0eb7d395d1bcb0b9b7abcf367e5a46a5f3da01d8d6e72b
-DIST nano-7.1.tar.xz 1605272 BLAKE2B cc606a04b34e723da01326d617b50f79711d0b35034b3e75f410fa7e277ba3eddbb1a408a80255533d2fa953f23fee745979363d5621b63a79bd89b29d8d528e SHA512 e3226df636d3ae1d94e2907ce8bbdb8de69eb45afd02fb1c83e275a1dcc288081809041adbfdade35a580bcb9f9632d21a45d764b43d22b3e4cfd87c7757c4e0
 DIST nano-7.2.tar.xz 1608444 BLAKE2B c7e3b18383e9f2f9db1f6059c875ddd164d730ea0e5b363e66fb8e5f30e8598ba49a5afd8eea3a55e295f1e43fb136019f60cc9154ae276c5d589002c0e5298a SHA512 a6dfa70edab62e439a9a998ca214f2415d57dbdc01766ad2e4b14048836557a32755f8b09de13c6a89023f215b61d2854017b389eae8d097ca6f3ba73ce2f583
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/metadata.xml b/sdk_container/src/third_party/portage-stable/app-editors/nano/metadata.xml
index f0ba3c2c58..0e05c7d4c6 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-editors/nano/metadata.xml
@@ -35,8 +35,5 @@ perhaps providing other extra functionality.
 			Disable all fancy features, including ones that otherwise have a dedicated
 			USE flag (such as spelling).
 		</flag>
-		<flag name="split-usr">
-			Enable this if /bin and /usr/bin are separate directories
-		</flag>
 	</use>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-6.4.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-6.4.ebuild
deleted file mode 100644
index e6c3f4ce90..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-6.4.ebuild
+++ /dev/null
@@ -1,113 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
-	inherit autotools git-r3
-else
-	MY_P="${PN}-${PV/_}"
-	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-
-DESCRIPTION="GNU GPL'd Pico clone with more functionality"
-HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Basics_Guide"
-
-LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
-SLOT="0"
-IUSE="debug justify magic minimal ncurses nls +spell +split-usr static unicode"
-
-LIB_DEPEND="
-	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
-	sys-libs/ncurses:=[static-libs(+)]
-	magic? ( sys-apps/file[static-libs(+)] )
-	nls? ( virtual/libintl )
-"
-RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
-DEPEND="
-	${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-"
-BDEPEND="
-	nls? ( sys-devel/gettext )
-	virtual/pkgconfig
-"
-
-REQUIRED_USE="
-	magic? ( !minimal )
-"
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	use static && append-ldflags -static
-
-	local myconfargs=(
-		--bindir="${EPREFIX}"/bin
-		--htmldir=/trash
-		$(use_enable !minimal color)
-		$(use_enable !minimal multibuffer)
-		$(use_enable !minimal nanorc)
-		$(use_enable magic libmagic)
-		$(use_enable spell speller)
-		$(use_enable justify)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable unicode utf8)
-		$(use_enable minimal tiny)
-	)
-
-	econf "${myconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	# Don't use "${ED}" here or things break (#654534)
-	rm -r "${D}"/trash || die
-
-	dodoc doc/sample.nanorc
-	docinto html
-	dodoc doc/faq.html
-	insinto /etc
-	newins doc/sample.nanorc nanorc
-
-	if ! use minimal ; then
-		# Enable colorization by default.
-		sed -i \
-			-e '/^# include /s:# *::' \
-			"${ED}"/etc/nanorc || die
-
-		# Since nano-5.0 these are no longer being "enabled" by default
-		# (bug #736848)
-		local rcdir="/usr/share/nano"
-		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
-		rmdir "${ED}"${rcdir}/extra || die
-
-		insinto "${rcdir}"
-		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
-	fi
-
-	use split-usr && dosym ../../bin/nano /usr/bin/nano
-}
-
-pkg_postrm() {
-	[[ -n ${REPLACED_BY_VERSION} ]] && return
-
-	local e
-	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
-	if [[ ${e##*/} == nano ]]; then
-		ewarn "The EDITOR variable is still set to ${e}."
-		ewarn "You can update it with \"eselect editor\"."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-7.1.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-7.1.ebuild
deleted file mode 100644
index 1cc0796fdf..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-editors/nano/nano-7.1.ebuild
+++ /dev/null
@@ -1,111 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
-	inherit autotools git-r3
-else
-	MY_P="${PN}-${PV/_}"
-	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-
-DESCRIPTION="GNU GPL'd Pico clone with more functionality"
-HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Basics_Guide"
-
-LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
-SLOT="0"
-IUSE="debug justify magic minimal ncurses nls +spell static unicode"
-
-LIB_DEPEND="
-	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
-	sys-libs/ncurses:=[static-libs(+)]
-	magic? ( sys-apps/file[static-libs(+)] )
-	nls? ( virtual/libintl )
-"
-RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
-DEPEND="
-	${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-"
-BDEPEND="
-	nls? ( sys-devel/gettext )
-	virtual/pkgconfig
-"
-
-REQUIRED_USE="
-	magic? ( !minimal )
-"
-
-src_prepare() {
-	default
-
-	if [[ ${PV} == 9999 ]] ; then
-		eautoreconf
-	fi
-}
-
-src_configure() {
-	use static && append-ldflags -static
-
-	local myconfargs=(
-		--bindir="${EPREFIX}"/bin
-		--htmldir=/trash
-		$(use_enable !minimal color)
-		$(use_enable !minimal multibuffer)
-		$(use_enable !minimal nanorc)
-		$(use_enable magic libmagic)
-		$(use_enable spell speller)
-		$(use_enable justify)
-		$(use_enable debug)
-		$(use_enable nls)
-		$(use_enable unicode utf8)
-		$(use_enable minimal tiny)
-	)
-
-	econf "${myconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	# Don't use "${ED}" here or things break (#654534)
-	rm -r "${D}"/trash || die
-
-	dodoc doc/sample.nanorc
-	docinto html
-	dodoc doc/faq.html
-	insinto /etc
-	newins doc/sample.nanorc nanorc
-
-	if ! use minimal ; then
-		# Enable colorization by default.
-		sed -i \
-			-e '/^# include /s:# *::' \
-			"${ED}"/etc/nanorc || die
-
-		# Since nano-5.0 these are no longer being "enabled" by default
-		# (bug #736848)
-		local rcdir="/usr/share/nano"
-		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
-		rmdir "${ED}"${rcdir}/extra || die
-
-		insinto "${rcdir}"
-		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
-	fi
-}
-
-pkg_postrm() {
-	[[ -n ${REPLACED_BY_VERSION} ]] && return
-
-	local e
-	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
-	if [[ ${e##*/} == nano ]]; then
-		ewarn "The EDITOR variable is still set to ${e}."
-		ewarn "You can update it with \"eselect editor\"."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
index 96d238da48..a57e2d8463 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest
@@ -1,4 +1,4 @@
 DIST vim-9.0.1157.tar.gz 16924574 BLAKE2B 0cdc6cf61f5abdaff0762b98550bfa5bae8f0485ddd0e9947a5fe52390f9da54fc8f5fdae767fb8f5d3ac2b441253917a80ae7f6092f67b69bdc9b6a630df8e2 SHA512 19240a9bcf5900766db42e2894b1bf7b849274711f17dc267671aacd867b334c3d30f39947dde7dd0245f289e9ad801eeb272f34a2ab15d01fac40bf71a54271
-DIST vim-9.0.1363.tar.gz 16974190 BLAKE2B 456114cd7e74836998b51e9272e9c9a12952146f42740b3df66e36ee8e47c8c0538341d9ac9c877c93e0b356fd9ca46a2016e9386d53e3cbfd51d0e2b113bc5a SHA512 2e79e104d9816438c14f94d0e858766129eb3f706b3a89a9761331d32b46b3f83eeadb2ce0d2ec14392a69122ab8761e57218c0e5731a4453d2b91f53a70c4c8
 DIST vim-9.0.1403.tar.gz 16976705 BLAKE2B 9664d52de488086308fcbcda0b0a1167161afbf0efbb40dd9ce9e2393f0ada35e0a44d7f0c3f789d26ae1427604a281f689e87885fbb1557dce12a69898ec46d SHA512 bd83feba38a4aa9b3cf910a0b5a2c153abc4c6eaf9abf0ebee389879ff9ddee51c6f9dba5151aab5df3f73594cf8921d0a0e34121c50e65366cdcdd6482fd00f
+DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e4b82bee371148b19042478d3f974793477c3fc2d9ddff9233fa1ec3c864962880840867544e92464f1a0876f51 SHA512 2f3242ec0f79cf6affc2f7fdaf689c35d8597706ac1689dbbdc01352676199605bb37f22bd901f1e8d59f312237d3fce4bee8b979b28a744ea9e40558621980e
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1403.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1403.ebuild
index b4d172893b..22272dba15 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1403.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1403.ebuild
@@ -16,7 +16,7 @@ if [[ ${PV} == 9999* ]] ; then
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
 		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 S="${WORKDIR}/vim-${PV}"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1363.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1503.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1363.ebuild
rename to sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.1503.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest b/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
index 96d238da48..a57e2d8463 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest
@@ -1,4 +1,4 @@
 DIST vim-9.0.1157.tar.gz 16924574 BLAKE2B 0cdc6cf61f5abdaff0762b98550bfa5bae8f0485ddd0e9947a5fe52390f9da54fc8f5fdae767fb8f5d3ac2b441253917a80ae7f6092f67b69bdc9b6a630df8e2 SHA512 19240a9bcf5900766db42e2894b1bf7b849274711f17dc267671aacd867b334c3d30f39947dde7dd0245f289e9ad801eeb272f34a2ab15d01fac40bf71a54271
-DIST vim-9.0.1363.tar.gz 16974190 BLAKE2B 456114cd7e74836998b51e9272e9c9a12952146f42740b3df66e36ee8e47c8c0538341d9ac9c877c93e0b356fd9ca46a2016e9386d53e3cbfd51d0e2b113bc5a SHA512 2e79e104d9816438c14f94d0e858766129eb3f706b3a89a9761331d32b46b3f83eeadb2ce0d2ec14392a69122ab8761e57218c0e5731a4453d2b91f53a70c4c8
 DIST vim-9.0.1403.tar.gz 16976705 BLAKE2B 9664d52de488086308fcbcda0b0a1167161afbf0efbb40dd9ce9e2393f0ada35e0a44d7f0c3f789d26ae1427604a281f689e87885fbb1557dce12a69898ec46d SHA512 bd83feba38a4aa9b3cf910a0b5a2c153abc4c6eaf9abf0ebee389879ff9ddee51c6f9dba5151aab5df3f73594cf8921d0a0e34121c50e65366cdcdd6482fd00f
+DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e4b82bee371148b19042478d3f974793477c3fc2d9ddff9233fa1ec3c864962880840867544e92464f1a0876f51 SHA512 2f3242ec0f79cf6affc2f7fdaf689c35d8597706ac1689dbbdc01352676199605bb37f22bd901f1e8d59f312237d3fce4bee8b979b28a744ea9e40558621980e
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1403.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1403.ebuild
index 740d9b9d36..ce978f7e8d 100644
--- a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1403.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1403.ebuild
@@ -21,7 +21,7 @@ if [[ ${PV} == 9999* ]] ; then
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
 		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 DESCRIPTION="Vim, an improved vi-style text editor"
diff --git a/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1363.ebuild b/sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1503.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1363.ebuild
rename to sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.1503.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
index f79e76b698..b33e329c03 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/Manifest
@@ -1,2 +1,3 @@
 DIST qemu-6.0.0.tar.xz 107333232 BLAKE2B 7746329d3e13782b7c346ce4052cc517cfc65cd9b2d514d199e4d5b8570ca79566ec04b0c114db2e97c84e68eb551e0d4cdce1b14b91a88fe08d2a5f682c1418 SHA512 ee3ff00aebec4d8891d2ff6dabe4e667e510b2a4fe3f6190aa34673a91ea32dcd2db2e9bf94c2f1bf05aa79788f17cfbbedc6027c0988ea08a92587b79ee05e4
 DIST qemu-7.1.0.tar.xz 121833004 BLAKE2B e05f91ce4993c7591a2df08b5fb017f8b8ec2141ab7bfd55d14730ea6b793ac1091de539992058392a5522d4e58beee92a87752707be58e3619b8213ef9f35bf SHA512 c60c5ff8ec99b7552e485768908920658fdd8035ff7a6fa370fb6881957dc8b7e5f18ff1a8f49bd6aa22909ede2a7c084986d8244f12074ccd33ebe40a0c411f
+DIST qemu-8.0.0.tar.xz 127835148 BLAKE2B 9b54aae10fe09691a26e68374723ded5fdda6409673b4de9461a25ee060cfd03968a16ddeadc21d48b9262e53aa6d4e5eb645376969f97c65807fad19607b04f SHA512 1f31d1e653dec2d35f1b7a5468ee3f471553b48eca8c8afafffcf9243c6b2260e78a5b73da3fe567f9b85d4133573eebd397747b3aec501fb24076263eb07b27
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.0.ebuild
new file mode 100644
index 0000000000..52a9e45d3b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu-guest-agent/qemu-guest-agent-8.0.0.ebuild
@@ -0,0 +1,81 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{9..11} )
+
+inherit edo systemd toolchain-funcs python-any-r1 udev
+
+MY_PN="qemu"
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="QEMU Guest Agent (qemu-ga) for use when running inside a VM"
+HOMEPAGE="https://wiki.qemu.org/Features/GuestAgent"
+SRC_URI="http://wiki.qemu.org/download/${MY_P}.tar.xz"
+
+LICENSE="GPL-2 BSD-2"
+SLOT="0"
+KEYWORDS="amd64 ~ppc ~ppc64 x86"
+
+RDEPEND="dev-libs/glib"
+DEPEND="${RDEPEND}"
+BDEPEND="${PYTHON_DEPS}
+	dev-lang/perl
+	dev-util/ninja"
+
+S="${WORKDIR}/${MY_P}"
+
+PATCHES=(
+)
+
+src_configure() {
+	tc-export AR LD OBJCOPY RANLIB
+
+	local myconf=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--libdir="/usr/$(get_libdir)"
+		--localstatedir=/
+		--disable-bsd-user
+		--disable-linux-user
+		--disable-system
+		--disable-strip
+		--enable-tools
+		--disable-werror
+		--enable-guest-agent
+		--python="${PYTHON}"
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+	)
+
+	edo ./configure "${myconf[@]}"
+}
+
+src_install() {
+	dobin build/qga/qemu-ga
+
+	# Normal init stuff
+	newinitd "${FILESDIR}/qemu-ga.init-r1" qemu-guest-agent
+	newconfd "${FILESDIR}/qemu-ga.conf-r1" qemu-guest-agent
+
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}/qemu-ga.logrotate" qemu-guest-agent
+
+	# systemd stuff
+	udev_newrules "${FILESDIR}/qemu-ga-systemd.udev" 99-qemu-guest-agent.rules
+
+	systemd_newunit "${FILESDIR}/qemu-ga-systemd.service" \
+		qemu-guest-agent.service
+}
+
+pkg_postinst() {
+	elog "You should add 'qemu-guest-agent' to the default runlevel."
+	elog "e.g. rc-update add qemu-guest-agent default"
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 0754b3215f..2fae7fda43 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -1,2 +1,5 @@
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.0.tar.xz 122408576 BLAKE2B 415ff621356c59f88b29cfe3ef5db1e282b26bbafbee3d535477c6125ccb060ec9762d9e3ab9f70ce5478804dca0a46a59bcf12c112a2462029a93e578e61530 SHA512 f3cfa00da739ba819a218d7e6e95c77fb79a8e0f487b024ddd281602e785249b81144595e3f8c746c32a4f5c4d1a88c6aebae3c162603edfbb50ae3722d7ed13
+DIST qemu-7.2.1.tar.xz 122400592 BLAKE2B bae1df5d332beaca313c4bac88f06dd5992988d7c1b6fdc6ced4043d858f437339cd7d0009ae667f9e66705117697bee7ee44ec4e911cc203d34eecc3d8f139b SHA512 e286dc66c923a5df77eb02d69235d048e80a7cced638fae52fbed385b4c3cd736cfea66bb3c9843bebf0a33e81ea141fc015e0bd82108df304f148ce59d9ae8a
+DIST qemu-8.0.0-docs.tar.xz 3218024 BLAKE2B b764a625024e78a39470048355471e12cfb57ab3c34e764dc4200fdf5c1aea635d26095ec961979bf46f177101c5bd38618bacf7e98e04bd64688ab5e29591aa SHA512 d9dfe191372e105fe16fe8f66f41ed793ade4c89b5ab1d84b39459f3419a1ca61bd49422a83981965cc257c05eca7fd49054703f58f179f5c7b656e9473a1054
+DIST qemu-8.0.0.tar.xz 127835148 BLAKE2B 9b54aae10fe09691a26e68374723ded5fdda6409673b4de9461a25ee060cfd03968a16ddeadc21d48b9262e53aa6d4e5eb645376969f97c65807fad19607b04f SHA512 1f31d1e653dec2d35f1b7a5468ee3f471553b48eca8c8afafffcf9243c6b2260e78a5b73da3fe567f9b85d4133573eebd397747b3aec501fb24076263eb07b27
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-disable-keymap.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-disable-keymap.patch
index aab5dde5fb..6a5437056e 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-disable-keymap.patch
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-disable-keymap.patch
@@ -1,7 +1,8 @@
-diff -ruN qemu-9999.orig/meson.build qemu-9999/meson.build
---- qemu-9999.orig/meson.build	2023-03-12 01:17:38.273756012 +0100
-+++ qemu-9999/meson.build	2023-03-12 01:18:44.854716789 +0100
-@@ -667,6 +667,8 @@
+diff --git a/meson.build b/meson.build
+index c44d05a13..5c5c09894 100644
+--- a/meson.build
++++ b/meson.build
+@@ -671,6 +671,8 @@ endif
  
  if get_option('xkbcommon').auto() and not have_system and not have_tools
    xkbcommon = not_found
@@ -10,10 +11,11 @@ diff -ruN qemu-9999.orig/meson.build qemu-9999/meson.build
  else
    xkbcommon = dependency('xkbcommon', required: get_option('xkbcommon'),
                           method: 'pkg-config', kwargs: static_kwargs)
-diff -ruN qemu-9999.orig/pc-bios/keymaps/meson.build qemu-9999/pc-bios/keymaps/meson.build
---- qemu-9999.orig/pc-bios/keymaps/meson.build	2023-03-12 01:17:38.321756706 +0100
-+++ qemu-9999/pc-bios/keymaps/meson.build	2023-03-12 01:20:22.015111600 +0100
-@@ -33,8 +33,10 @@
+diff --git a/pc-bios/keymaps/meson.build b/pc-bios/keymaps/meson.build
+index 158a3b410..3bb318a23 100644
+--- a/pc-bios/keymaps/meson.build
++++ b/pc-bios/keymaps/meson.build
+@@ -33,8 +33,10 @@ keymaps = {
    'tr': '-l tr',
  }
  
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-make.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-make.patch
index 4bf3f71577..40bafd4900 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-make.patch
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-make.patch
@@ -1,7 +1,8 @@
-diff -ruN qemu-9999.orig/configure qemu-9999/configure
---- qemu-9999.orig/configure	2023-03-12 01:26:15.488133462 +0100
-+++ qemu-9999/configure	2023-03-12 01:29:19.355724020 +0100
-@@ -1068,7 +1068,7 @@
+diff --git a/configure b/configure
+index 800b5850f..331e8950d 100755
+--- a/configure
++++ b/configure
+@@ -1069,7 +1069,7 @@ then
      fi
  fi
  
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-remove-python-meson-check.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-remove-python-meson-check.patch
new file mode 100644
index 0000000000..07d3836c57
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.0.0-remove-python-meson-check.patch
@@ -0,0 +1,40 @@
+diff --git a/configure b/configure
+index 4369fa5..7807ad5 100755
+--- a/configure
++++ b/configure
+@@ -1095,34 +1095,7 @@ has_meson() {
+   fi
+ }
+ 
+-if test -z "$meson"; then
+-    if test "$explicit_python" = no && has_meson && version_ge "$(meson --version)" 0.61.5; then
+-        meson=meson
+-    elif test "$git_submodules_action" != 'ignore' ; then
+-        meson=git
+-    elif test -e "${source_path}/meson/meson.py" ; then
+-        meson=internal
+-    else
+-        if test "$explicit_python" = yes; then
+-            error_exit "--python requires using QEMU's embedded Meson distribution, but it was not found."
+-        else
+-            error_exit "Meson not found.  Use --meson=/path/to/meson"
+-        fi
+-    fi
+-else
+-    # Meson uses its own Python interpreter to invoke other Python scripts,
+-    # but the user wants to use the one they specified with --python.
+-    #
+-    # We do not want to override the distro Python interpreter (and sometimes
+-    # cannot: for example in Homebrew /usr/bin/meson is a bash script), so
+-    # just require --meson=git|internal together with --python.
+-    if test "$explicit_python" = yes; then
+-        case "$meson" in
+-            git | internal) ;;
+-            *) error_exit "--python requires using QEMU's embedded Meson distribution." ;;
+-        esac
+-    fi
+-fi
++meson=meson
+ 
+ if test "$meson" = git; then
+     git_submodules="${git_submodules} meson"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.1.0-also-build-virtfs-proxy-helper.patch b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.1.0-also-build-virtfs-proxy-helper.patch
new file mode 100644
index 0000000000..61ea0f36d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-8.1.0-also-build-virtfs-proxy-helper.patch
@@ -0,0 +1,32 @@
+From d02ea89239768c93651a161d057f2bf04d56a024 Mon Sep 17 00:00:00 2001
+From: Matthias Maier <tamiko@43-1.org>
+Date: Mon, 4 Apr 2022 12:56:59 +0200
+Subject: [PATCH] also build virtfs-proxy-helper
+
+The Gentoo ebuild splits the qemu build into a softmmu, user and tool
+phase in order to be able to build and link some of the qemu emulators
+statically. This unfortunately has the consequence that we never
+configure with "have_virtfs" and "have_tools" at the same time.
+
+As a workaround, simply build the virtfs userland unconditionally. After
+all, it is a tiny executable
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 063c736aee..fda8639293 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2008,8 +2008,6 @@ have_virtfs = get_option('virtfs') \
+     .allowed()
+ 
+ have_virtfs_proxy_helper = get_option('virtfs_proxy_helper') \
+-    .require(targetos != 'darwin', error_message: 'the virtfs proxy helper is incompatible with macOS') \
+-    .require(have_virtfs, error_message: 'the virtfs proxy helper requires that virtfs is enabled') \
+     .disable_auto_if(not have_tools) \
+     .require(libcap_ng.found(), error_message: 'the virtfs proxy helper requires libcap-ng') \
+     .allowed()
+-- 
+2.35.1
+
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.0-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.0-r3.ebuild
index 39afad4b1b..c7c0a1525b 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.0-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.0-r3.ebuild
@@ -41,7 +41,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.1.ebuild
new file mode 100644
index 0000000000..2218435d4f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.1.ebuild
@@ -0,0 +1,972 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=ajak
+QEMU_DOCS_VERSION="7.2.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{9,10,11} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-util/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-7.2.0-linux-headers-6.2-glibc-2.36.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.0-r1.ebuild
new file mode 100644
index 0000000000..3000130b6f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.0-r1.ebuild
@@ -0,0 +1,963 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION="8.0.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{9,10,11} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-util/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-8.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-8.0.0-remove-python-meson-check.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index 0be0f8edae..39ab489f9c 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -6,8 +6,7 @@ EAPI=8
 # Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
 # Set to 1 if prebuilt, 0 if not
 # (the construct below is to allow overriding from env for script)
-: ${QEMU_DOCS_PREBUILT:=1}
-
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-0}
 QEMU_DOCS_PREBUILT_DEV=sam
 QEMU_DOCS_VERSION=$(ver_cut 1-3)
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
@@ -151,7 +150,7 @@ done
 # respected).  This is because qemu supports using the C library's API
 # when available rather than always using the external library.
 ALL_DEPEND="
-	>=dev-libs/glib-2.0[static-libs(+)]
+	dev-libs/glib:2[static-libs(+)]
 	sys-libs/zlib[static-libs(+)]
 	python? ( ${PYTHON_DEPS} )
 	systemtap? ( dev-util/systemtap )
@@ -176,8 +175,8 @@ SOFTMMU_TOOLS_DEPEND="
 	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
-		dev-libs/nettle:=[static-libs(+)]
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
 		x11-libs/gtk+:3
@@ -205,7 +204,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	pam? ( sys-libs/pam )
 	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
-	pulseaudio? ( media-sound/pulseaudio )
+	pulseaudio? ( media-libs/libpulse )
 	rbd? ( sys-cluster/ceph )
 	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
 	sdl? (
@@ -223,7 +222,7 @@ SOFTMMU_TOOLS_DEPEND="
 	)
 	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
 	udev? ( virtual/libudev:= )
-	usb? ( >=virtual/libusb-1-r2[static-libs(+)] )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
 	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
 	vde? ( net-misc/vde[static-libs(+)] )
 	virgl? ( media-libs/virglrenderer[static-libs(+)] )
@@ -303,8 +302,8 @@ RDEPEND="${CDEPEND}
 PATCHES=(
 	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
 	"${FILESDIR}"/${PN}-8.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
 )
 
 QA_PREBUILT="
@@ -450,7 +449,7 @@ src_prepare() {
 	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
 
 	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
+	rm -r dtc roms/*/ || die
 }
 
 ##
@@ -618,7 +617,6 @@ qemu_src_configure() {
 		conf_opts+=(
 			--enable-linux-user
 			--disable-system
-			--disable-install-blobs
 			--disable-tools
 			--disable-cap-ng
 			--disable-seccomp
@@ -639,7 +637,6 @@ qemu_src_configure() {
 		conf_opts+=(
 			--disable-linux-user
 			--disable-system
-			--disable-install-blobs
 			--enable-tools
 			--enable-cap-ng
 		)
@@ -651,7 +648,7 @@ qemu_src_configure() {
 	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
 
 	# Add support for SystemTAP
-	use systemtap && conf_opts+=( --enable-trace-backends=dtrace )
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
 
 	# We always want to attempt to build with PIE support as it results
 	# in a more secure binary. But it doesn't work with static or if
@@ -836,7 +833,7 @@ src_install() {
 	doins "${FILESDIR}/bridge.conf"
 
 	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	dodoc MAINTAINERS
 	newdoc pc-bios/README README.pc-bios
 
 	# Disallow stripping of prebuilt firmware files.
diff --git a/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/Manifest b/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/Manifest
index c8a0289528..7be41d51f5 100644
--- a/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/Manifest
@@ -1 +1,2 @@
 DIST build-docbook-catalog-2.3.tar.bz2 4686 BLAKE2B 3e386d0aec67ed9cada98cacd9bdce4345f8732a1d9653c096744178902036da5cefa2bde1d69279fe2080f660635f5c29380f40f6fb39aa586d80206c5e42b2 SHA512 79649f39f5a432a57e2457f61b73d83c8ccf76144e29b8e44a2c81bb86a00ff711c199fbd126236edfa965518e0cbd023597c97e386211b8c07a6ef66bf232a7
+DIST build-docbook-catalog-2.4.tar.bz2 4693 BLAKE2B 496356008ef31f87169f9f060ba5593e6054447789a8a1c0dbc43fb4f81ebf087d09adec8fe82d2641e3550616bb874c6a1253b7988553948956f1bbb2e241c7 SHA512 5d42a641c8b336e49749b28101f87d4d856d3e5491adca4053212a473b42dcda88ab00fa64f54813a3e1b4ef1e45756e7de3a652808ad7ee113aa3afe7bf99b5
diff --git a/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/build-docbook-catalog-2.4.ebuild b/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/build-docbook-catalog-2.4.ebuild
new file mode 100644
index 0000000000..ab5f58f571
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-text/build-docbook-catalog/build-docbook-catalog-2.4.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+DESCRIPTION="DocBook XML catalog auto-updater"
+HOMEPAGE="https://gitweb.gentoo.org/proj/build-docbook-catalog.git/"
+SRC_URI="https://gitweb.gentoo.org/proj/build-docbook-catalog.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+RDEPEND="
+	dev-libs/libxml2
+	|| ( sys-apps/util-linux app-misc/getopt )
+"
+
+src_prepare() {
+	default
+
+	sed -i -e "1s@#!@#!${EPREFIX}@" build-docbook-catalog || die
+	sed -i -e "/^EPREFIX=/s:=.*:='${EPREFIX}':" build-docbook-catalog || die
+	has_version sys-apps/util-linux || sed -i -e '/^GETOPT=/s/getopt/&-long/' build-docbook-catalog || die
+}
+
+src_configure() {
+	# export for bug #490754
+	export MAKEOPTS+=" EPREFIX=${EPREFIX}"
+
+	default
+}
+
+pkg_postinst() {
+	# New version -> regen files
+	# See bug #816303 for rationale behind die
+	build-docbook-catalog || die "Failed to regenerate docbook catalog."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-text/docbook-xsl-stylesheets/docbook-xsl-stylesheets-1.79.1-r4.ebuild b/sdk_container/src/third_party/portage-stable/app-text/docbook-xsl-stylesheets/docbook-xsl-stylesheets-1.79.1-r4.ebuild
index c2d7afe0f3..552379eab7 100644
--- a/sdk_container/src/third_party/portage-stable/app-text/docbook-xsl-stylesheets/docbook-xsl-stylesheets-1.79.1-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-text/docbook-xsl-stylesheets/docbook-xsl-stylesheets-1.79.1-r4.ebuild
@@ -17,7 +17,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="ruby"
 # Makefile is broken since 1.76.0
 RESTRICT="test"
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index 7e22dbb9c9..64fa0af8bd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,2 +1,4 @@
 DIST sqlite-doc-3410200.zip 10633275 BLAKE2B 1323179d04b9fa21df4ed93ad1aa89ff943a9d930ef02699aade779f18f28aa45dac8362d6427d7eb896c0c0b20e12f8446050f1fc08c3deef24e395123319c1 SHA512 77099fd3bfdb0c19baedb1248c5ff028a14cbc98d18956dfb13e55289a7dddbe82d25e4522f0cbbe9c2798e0531c354df5a207f89c62dfe0f84877db47bb4f9e
+DIST sqlite-doc-3420000.zip 10665938 BLAKE2B 62aef59e6976101ecca60d1ee194e9e558009dd8bdb7cd911f9938f1256e50bc946f8ca554666b6c101f7024baac7857b83adf6e897164afb9b5c4d4917593d1 SHA512 d675ee2897323d468816bc713594c4e94cb5c15270b4f991758e2c82e2891ad724c5790f29b76bc9e5d6b3be04e95aee371c57ceb2d855c1057b4af62a5af162
 DIST sqlite-src-3410200.zip 13836230 BLAKE2B 4edcd65728143b1ea27abe65db8c8353dfa309858e6f40d70f3c376ef9e5613d92c41ed5a3c3282cacef8a29a434e3881f6e47ba5642820331170ceb69321d86 SHA512 28cfa72f2b39d851c38fb757a0c6d0696c22548792ce2fa1be5e2f6084e4bf0a5fb216902b59ccba5b6ebaf140aab954ed7676d84841b58ad063404a119a0c17
+DIST sqlite-src-3420000.zip 13910252 BLAKE2B defe14bf0b5588775b2a2b17b3adbbaf39f1e95eac049cbd4868e2e59fbf50fb92b11c74ecf12fe0138521e7d4d3cc2a4bf45e7c83fd774abd7aa9ed7ee0f925 SHA512 509b7aa292870c927ef137469028e5e07ca74907414c5b295360cb10b377a42de7469d3afe79f8d9947d486ef74d676679c7f2d3b1caaeb8c949f27201180def
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.42.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.42.0.ebuild
new file mode 100644
index 0000000000..8312b26c92
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.42.0.ebuild
@@ -0,0 +1,428 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	SRC_PV="$(printf "%u%02u%02u%02u" $(ver_rs 1- " "))"
+	DOC_PV="${SRC_PV}"
+	#DOC_PV="$(printf "%u%02u%02u00" $(ver_rs 1-3 " "))"
+
+	SRC_URI="
+		https://sqlite.org/2023/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2023/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+BDEPEND=">=dev-lang/tcl-8.6:0"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS4
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	append-cppflags -DSQLITE_ENABLE_MEMSYS5
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	append-cppflags -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	append-cppflags -DSQLITE_ENABLE_SESSION
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		append-cppflags -DSQLITE_ENABLE_ICU
+		sed -e "s/^TLIBS = @LIBS@/& -licui18n -licuuc/" -i Makefile.in || die "sed failed"
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+
+		# Skip known-broken test for now
+		# https://sqlite.org/forum/forumpost/d97caf168f
+		# https://sqlite.org/forum/forumpost/50f136d91d
+		if use test ; then
+			rm test/atof1.test || die
+		fi
+	fi
+
+	econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db:/ÿ.db"
+
+	emake HAVE_TCL="$(usex tcl 1 "")" $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
index 956f7a9785..06add5c22a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest
@@ -4,5 +4,7 @@ DIST perl-5.34.1-zlib-1.2.12.patch.xz 180480 BLAKE2B 39da5c1ef406d018f73e641d86f
 DIST perl-5.34.1.tar.xz 12760168 BLAKE2B 3768e55f66551c83295153e91d25d568b7b8638789141f7fcd5a304509cb391cb9ad0232ba6ac70113bb0881ddb00ca5b19c53aa01e1e206c44401dad60d8942 SHA512 9261958291b49eea30c120a89e5ee32dc6a5fd46de4869c89c3d6a4c1162d6cf192ebe429d01a293eda93d8680ce15294af27717fd4ec4c75f511c1fa820fdac
 DIST perl-5.36.0-patches-1.tar.xz 20352 BLAKE2B f5413c75c5bbced230ad7fa692998caef8e4041f3394ae5212dc2aaee465de619b56cf07551be1bb36f2e06b9ed7d0ddda31ad4a7ec81d5c0c64b698ddd80379 SHA512 ab24577b6d71a13d9ccf272efa0881b29933b6a39532ca0d71d4c9a134f451bbe5f3d87c6c851f26114702ac3f92af5c5a72129a458ebee31e372106955eb157
 DIST perl-5.36.0.tar.xz 13051500 BLAKE2B e4864a4c21e5242df4164c73db8af10f7b9c36b075e0c05777abec79716db7778ccbf2c0c9e7e749518ad310019d2a6b32bd8b5ab2af5a8b16b5d920f83d034f SHA512 6dd6ac2a77566c173c5ab9c238cf555f2c3e592e89abb5600bc23ce1cbd0c349e0233f6417cbbf1f6d0aefc6a734ba491285af0d3dc68a605b658b65c89f1dab
+DIST perl-5.36.1.tar.xz 13053604 BLAKE2B baab610d16e444338ad7d529bad6a88e12010786bd25f2ab117ab4dd636859ff862cb925700095434f05a802bea5b89a9d41769f26bdbae439443020950882bd SHA512 8d1ec654c59d078bfc477f11c9526233199a85e4d4f6f5a55bf9eb7802cd355189c669cc6785d2d5e741c1de4d740b7a0cfd3c0198122586a07ac7f527fb14af
 DIST perl-cross-1.3.7.tar.gz 118291 BLAKE2B dc9c060857d6905c817e91c3f5b1f546b76e02c6de02dc260185e0de8628a5ead3a557501da75549e2585cd30879190558740e697b1c78a69fa08ccb5649efcd SHA512 1111274f34f8b46e9f418883e9b1652ba4a5a9b4a5880a9a5b38bc8aeb5d75a9f4943233870f5ebf5fbcdc0c30b2983ace11ad051b55d3283327d8f2c15e172c
+DIST perl-cross-1.4.1.tar.gz 117688 BLAKE2B e01103fb92764213dafb1ab92954fdc4bdcf1bd71a0064279ee75fed55a1c71850eaabdf667d6ab1c15eadccf7497668e5bb5ab13de33fef707fba14bfd52912 SHA512 5f403d3a52f724383d25c23b08e8001954300fa8f07a5b49df440ef4d06ef756404a6e448093c4f4d4f9a470b1c3f2b1b8b27d3d227ac1823552f6a377edd06a
 DIST perl-cross-1.4.tar.gz 113861 BLAKE2B 7c7783afccc6a04ab122a7c60b1cff7f0a2725655b2b63325ca25d7b8acb0cf993b496e2a590db943054336337ad215550b6b2a565f1d91a5aa9cfe3a4c36db4 SHA512 bde73cac13c0b42c4c6783d7e30dea491d70b65131e1c8434ef75db1f39a8e15ef5857568b706e8456faa3822402676dd247a1f20f4bed983597fdd5a6b4faad
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/files/perl-5.36.1-http-tiny.patch b/sdk_container/src/third_party/portage-stable/dev-lang/perl/files/perl-5.36.1-http-tiny.patch
new file mode 100644
index 0000000000..34907cc6d9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/files/perl-5.36.1-http-tiny.patch
@@ -0,0 +1,25 @@
+in current year, we should verify tls certs by default.
+not doing so is as good as not using tls
+https://www.openwall.com/lists/oss-security/2023/04/18/14
+
+Source:
+https://git.alpinelinux.org/aports/plain/main/perl/default-https-perl-http-tiny.patch?id=fc21c0f7930ae3a9e2f50bacc305fb167a456ded
+
+Bug: https://bugs.gentoo.org/905296
+See-also: https://github.com/chansen/p5-http-tiny/pull/151
+See-also: https://github.com/chansen/p5-http-tiny/issues/152
+
+--
+diff --git a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
+index 83ca06d..dc6217a 100644
+--- a/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
++++ b/cpan/HTTP-Tiny/lib/HTTP/Tiny.pm
+@@ -1055,7 +1055,7 @@ sub new {
+         timeout          => 60,
+         max_line_size    => 16384,
+         max_header_lines => 64,
+-        verify_SSL       => 0,
++        verify_SSL       => 1,
+         SSL_options      => {},
+         %args
+     }, $class;
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r1.ebuild
new file mode 100644
index 0000000000..53995157a8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1-r1.ebuild
@@ -0,0 +1,826 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
+
+PATCH_VER=1
+CROSS_VER=1.4.1
+PATCH_BASE="perl-5.36.0-patches-${PATCH_VER}"
+PATCH_DEV=dilfridge
+
+DIST_AUTHOR=RJBS
+
+# Greatest first, don't include yourself
+# Devel point-releases are not ABI-intercompatible, but stable point releases are
+# BIN_OLDVERSEN contains only C-ABI-intercompatible versions
+PERL_BIN_OLDVERSEN=""
+
+if [[ "${PV##*.}" == "9999" ]]; then
+	DIST_VERSION=5.30.0
+else
+	DIST_VERSION="${PV/_rc/-RC}"
+fi
+SHORT_PV="${DIST_VERSION%.*}"
+
+# Even numbered major versions are ABI intercompatible
+# Odd numbered major versions are not
+if [[ $(( ${SHORT_PV#*.} % 2 )) == 1 ]]; then
+	SUBSLOT="${DIST_VERSION%-RC*}"
+else
+	SUBSLOT="${DIST_VERSION%.*}"
+fi
+
+# Used only in tar paths
+MY_P="perl-${DIST_VERSION}"
+# Used in library paths
+MY_PV="${DIST_VERSION%-RC*}"
+
+DESCRIPTION="Larry Wall's Practical Extraction and Report Language"
+
+SRC_URI="
+	mirror://cpan/src/5.0/${MY_P}.tar.xz
+	mirror://cpan/authors/id/${DIST_AUTHOR:0:1}/${DIST_AUTHOR:0:2}/${DIST_AUTHOR}/${MY_P}.tar.xz
+	https://github.com/gentoo-perl/perl-patchset/releases/download/${PATCH_BASE}/${PATCH_BASE}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${PATCH_BASE}.tar.xz
+	https://github.com/arsv/perl-cross/releases/download/${CROSS_VER}/perl-cross-${CROSS_VER}.tar.gz
+"
+
+HOMEPAGE="https://www.perl.org/"
+
+LICENSE="|| ( Artistic GPL-1+ )"
+SLOT="0/${SUBSLOT}"
+
+if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+
+IUSE="berkdb debug doc gdbm ithreads minimal quadmath"
+
+RDEPEND="
+	berkdb? ( sys-libs/db:= )
+	gdbm? ( >=sys-libs/gdbm-1.8.3:= )
+	app-arch/bzip2
+	>=sys-libs/zlib-1.2.12
+	virtual/libcrypt:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="${RDEPEND}"
+
+PDEPEND="
+	!minimal? (
+		>=app-admin/perl-cleaner-2.5
+		>=virtual/perl-CPAN-2.290.0
+		>=virtual/perl-Encode-3.120.0
+		>=virtual/perl-File-Temp-0.230.400-r2
+		>=virtual/perl-Data-Dumper-2.154.0
+		virtual/perl-Test-Harness
+	)
+"
+# bug 390719, bug 523624
+# virtual/perl-Test-Harness is here for the bundled ExtUtils::MakeMaker
+
+S="${WORKDIR}/${MY_P}"
+
+dual_scripts() {
+	src_remove_dual      perl-core/Archive-Tar        2.400.0       ptar ptardiff ptargrep
+	src_remove_dual      perl-core/CPAN               2.330.0       cpan
+	src_remove_dual      perl-core/Digest-SHA         6.20.0        shasum
+	src_remove_dual      perl-core/Encode             3.170.0       enc2xs piconv
+	src_remove_dual      perl-core/ExtUtils-MakeMaker 7.640.0       instmodsh
+	src_remove_dual      perl-core/ExtUtils-ParseXS   3.450.0       xsubpp
+	src_remove_dual      perl-core/IO-Compress        2.106.0       zipdetails
+	src_remove_dual      perl-core/JSON-PP            4.70.0        json_pp
+	src_remove_dual      perl-core/Module-CoreList    5.202.304.230 corelist
+	src_remove_dual      perl-core/Pod-Checker        1.740.0       podchecker
+	src_remove_dual      perl-core/Pod-Perldoc        3.280.100     perldoc
+	src_remove_dual      perl-core/Pod-Usage          2.10.0       pod2usage
+	src_remove_dual      perl-core/Test-Harness       3.440.0       prove
+	src_remove_dual      perl-core/podlators          4.140.0       pod2man pod2text
+	src_remove_dual_man  perl-core/podlators          4.140.0       /usr/share/man/man1/perlpodstyle.1
+}
+
+check_rebuild() {
+	# Fresh install
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		return 0;
+	# Major Upgrade
+	# doesn't matter if there's multiple copies, it still needs a rebuild
+	# if the string is anything other than "5.CURRENTMAJOR"
+	elif [[ "${REPLACING_VERSIONS%.*}" != "${PV%.*}" ]]; then
+		echo ""
+		ewarn "UPDATE THE PERL MODULES:"
+		ewarn "After updating dev-lang/perl the installed Perl modules"
+		ewarn "have to be re-installed. In most cases, this is done automatically"
+		ewarn "by the package manager, but subsequent steps are still recommended"
+		ewarn "to ensure system consistency."
+		ewarn
+		ewarn "You should start with a depclean to remove any unused perl dependencies"
+		ewarn "that may confuse portage in future. Regular depcleans are also encouraged"
+		ewarn "as part of your regular update cycle, as that will keep perl upgrades working."
+		ewarn "Recommended: emerge --depclean -va"
+		ewarn
+		ewarn "You should then call perl-cleaner to clean up any old files and trigger any"
+		ewarn "remaining rebuilds portage may have missed."
+		ewarn "Use: perl-cleaner --all"
+		return 0;
+
+	# Reinstall w/ USE Change
+	elif
+		 (   use ithreads && ! has_version dev-lang/perl[ithreads] ) || \
+		 ( ! use ithreads &&   has_version dev-lang/perl[ithreads] ) || \
+		 (   use quadmath && ! has_version dev-lang/perl[quadmath] ) || \
+		 ( ! use quadmath &&   has_version dev-lang/perl[quadmath] ) || \
+		 (   use debug    && ! has_version dev-lang/perl[debug]    ) || \
+		 ( ! use debug    &&   has_version dev-lang/perl[debug]    ) ; then
+		echo ""
+		ewarn "TOGGLED USE-FLAGS WARNING:"
+		ewarn "You changed one of the use-flags ithreads, quadmath, or debug."
+		ewarn "You must rebuild all perl-modules installed."
+		ewarn "Use: perl-cleaner --modules ; perl-cleaner --force --libperl"
+	fi
+}
+
+pkg_setup() {
+	case ${CHOST} in
+		*-freebsd*)   osname="freebsd" ;;
+		*-dragonfly*) osname="dragonfly" ;;
+		*-netbsd*)    osname="netbsd" ;;
+		*-openbsd*)   osname="openbsd" ;;
+		*-darwin*)    osname="darwin" ;;
+		*-solaris*)   osname="solaris" ;;
+		*-cygwin*)    osname="cygwin" ;;
+		*)            osname="linux" ;;
+	esac
+
+	myarch="${CHOST%%-*}-${osname}"
+	if use debug ; then
+		myarch+="-debug"
+	fi
+	if use quadmath ; then
+		myarch+="-quadmath"
+	fi
+	if use ithreads ; then
+		mythreading="-multi"
+		myarch+="-thread"
+	fi
+
+	PRIV_BASE="/usr/$(get_libdir)/perl5"
+	SITE_BASE="/usr/local/$(get_libdir)/perl5"
+	VENDOR_BASE="/usr/$(get_libdir)/perl5/vendor_perl"
+
+	LIBPERL="libperl$(get_libname ${MY_PV} )"
+
+	PRIV_LIB="${PRIV_BASE}/${SUBSLOT}"
+	ARCH_LIB="${PRIV_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	SITE_LIB="${SITE_BASE}/${SUBSLOT}"
+	SITE_ARCH="${SITE_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	VENDOR_LIB="${VENDOR_BASE}/${SUBSLOT}"
+	VENDOR_ARCH="${VENDOR_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+
+	dual_scripts
+}
+
+src_remove_dual_file() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				alternatives_auto_makesym "${i}" "${i}-[0-9]*"
+			done
+			;;
+		setup)
+			for i in "$@" ; do
+				if [[ -f ${EROOT}${i} && ! -h ${EROOT}${i} ]] ; then
+					has_version ${pkg} && ewarn "You must reinstall ${pkg} !"
+					break
+				fi
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i}{,-${ver}-${P}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual_man() {
+	local i pkg ver ff
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				ff=`echo "${EROOT}${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}}"*`
+				ff=${ff##*${i#${i%.[0-9]}}}
+				alternatives_auto_makesym "${i}${ff}" "${i%.[0-9]}-[0-9]*"
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i} "${ED}"${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	for i in "$@" ; do
+		src_remove_dual_file  "${pkg}" "${ver}" "/usr/bin/${i}"
+		src_remove_dual_man   "${pkg}" "${ver}" "/usr/share/man/man1/${i}.1"
+	done
+}
+
+src_prepare_perlcross() {
+	cp -a ../perl-cross-${CROSS_VER}/* . || die
+
+	# bug 794463, needs further analysis what is exactly wrong here
+	eapply "${FILESDIR}/perl-5.34.0-crossfit.patch"
+
+	# bug 604072
+	MAKEOPTS+=" -j1"
+	export MAKEOPTS
+}
+
+src_prepare_dynamic() {
+	ln -s ${LIBPERL} libperl$(get_libname ${SHORT_PV}) || die
+	ln -s ${LIBPERL} libperl$(get_libname ) || die
+}
+
+# Copy a patch into the patch series
+# add_patch SRC_PATH DEST_NAME ['description'] ['bug'] ['bug']
+# - description is optional, but recommended
+# - all arguments after descriptions are bug URLs
+add_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local src_name dest_name desc
+	src_name="$1"
+	dest_name="$2"
+	desc="$3"
+	shift; shift; shift;
+	einfo "Adding ${dest_name} to patch bundle"
+	cp "${src_name}" "${patchdir}/${dest_name}" || die "Couldn't copy ${src_name} to ${dest_name}"
+	if [[ -n "${desc}" ]]; then
+		printf "%s" "${desc}" > "${infodir}/${dest_name}.desc" || die "Couldn't write ${dest_name}.desc"
+	fi
+	if [[ $# -gt 0 ]]; then
+		# Note: when $@ is more than one element, this emits a
+		# line for each element
+		printf "%s\n" "$@" > "${infodir}/${dest_name}.bugs" || die "Couldn't write ${dest_name}.bugs"
+	fi
+}
+
+# Remove a patch using a glob expr
+# eg:
+#	 rm_patch *-darwin-Use-CC*
+#
+rm_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local expr="$1"
+	local patch="$( cd "${patchdir}"; echo $expr )"
+	einfo "Removing $patch ($expr) from patch bundle"
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		rm -f "${patchdir}/${patch}" || die "Can't remove ${patch} ( $expr )"
+	else
+		ewarn "No ${expr} found in ${patchdir} to remove"
+	fi
+}
+
+# Yes, this is a reasonable amount of code for something seemingly simple
+# but this is far easier to debug when things go wrong, and things went wrong
+# multiple times while I was getting the exact number of slashes right, which
+# requires circumnavigating both bash and sed escape mechanisms.
+c_escape_string() {
+	local slash dquote
+	slash='\'
+	dquote='"'
+	re_slash="${slash}${slash}"
+	re_dquote="${slash}${dquote}"
+
+	# Convert \ to \\,
+	#         " to \"
+	echo "$1" |\
+		sed "s|${re_slash}|${re_slash}${re_slash}|g" |\
+		sed "s|${re_dquote}|${re_slash}${re_dquote}|g"
+}
+c_escape_file() {
+	c_escape_string "$(cat "$1")"
+}
+
+apply_patchdir() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local patchoutput="patchlevel-gentoo.h"
+
+	# Inject Patch-Level info into description for patchlevel.h patch
+	# to show in -V
+	local patch_expr="*List-packaged-patches*"
+	local patch="$( cd "${patchdir}"; echo $patch_expr )";
+	einfo "Injecting patch-level info into ${patch}.desc ( $patch_expr )"
+
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		printf "List packaged patches for %s(%s) in patchlevel.h" "${PF}" "${PATCH_BASE}"\
+			>"${infodir}/${patch}.desc" || die "Can't rewrite ${patch}.desc"
+	else
+		eerror "No $patch_expr found in ${patchdir}"
+	fi
+
+	# Compute patch list to apply
+	# different name other than PATCHES to stop default
+	# reapplying it
+	# Single depth is currently only supported, as artifacts can reside
+	# from the old layout being multiple-directories, as well as it grossly
+	# simplifying the patchlevel_gentoo.h generation.
+	local PERL_PATCHES=($(
+		find "${patchdir}" -maxdepth 1 -mindepth 1 -type f -printf "%f\n" |\
+			grep -E '[.](diff|patch)$' |\
+			sort -n
+	))
+
+	for patch in "${PERL_PATCHES[@]}"; do
+		eapply "${WORKDIR}"/patches/${patch}
+	done
+
+	einfo "Generating $patchoutput"
+
+	# This code creates a header file, each iteration
+	# creates one-or-more-lines for each entry found in PERL_PATCHES
+	# and STDOUT is redirected to the .h file
+	for patch in "${PERL_PATCHES[@]}"; do
+		local desc_f="${infodir}/${patch}.desc"
+		local bugs_f="${infodir}/${patch}.bugs"
+
+		printf ',"%s"\n' "${patch}"
+		if [[ ! -e "${desc_f}" ]]; then
+			ewarn "No description provided for ${patch} (expected: ${desc_f} )"
+		else
+			local desc="$(c_escape_file "${desc_f}")"
+			printf ',"- %s"\n' "${desc}"
+		fi
+		if [[ -e "${bugs_f}" ]]; then
+			while read -d $'\n' -r line; do
+				local esc_line="$(c_escape_string "${line}")"
+				printf ',"- Bug: %s"\n' "${esc_line}"
+			done <"${bugs_f}"
+		fi
+	done > "${S}/${patchoutput}"
+	printf "%s\n" "${patchoutput}" >> "${S}/MANIFEST"
+
+}
+
+src_prepare() {
+	local patchdir="${WORKDIR}/patches"
+
+	# Prepare Patch dir with additional patches / remove unwanted patches
+	# Inject bug/desc entries for perl -V
+	# Old example:
+	# add_patch "${FILESDIR}/${PN}-5.26.2-hppa.patch" "100-5.26.2-hppa.patch"\
+	#		"Fix broken miniperl on hppa"\
+	#		"https://bugs.debian.org/869122" "https://bugs.gentoo.org/634162"
+
+	add_patch "${FILESDIR}/${PN}-5.36.1-http-tiny.patch" "0111-5.36.1-http-tiny.patch"\
+			"Enable certificate checking in HTTP::Tiny by default"\
+			"https://bugs.gentoo.org/905296" "https://bugs.debian.org/954089"
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# do NOT mess with nsl, on Solaris this is always necessary,
+		# when -lsocket is used e.g. to get h_errno
+		rm_patch "*-nsl-and-cl*"
+	fi
+
+	apply_patchdir
+
+	tc-is-cross-compiler && src_prepare_perlcross
+
+	tc-is-static-only || src_prepare_dynamic
+
+	if use gdbm; then
+		sed -i "s:INC => .*:INC => \"-I${EROOT}/usr/include/gdbm\":g" \
+			ext/NDBM_File/Makefile.PL || die
+	fi
+
+	# Use errno.h from prefix rather than from host system, bug #645804
+	if use prefix && [[ -e "${EPREFIX}"/usr/include/errno.h ]] ; then
+		sed -i "/my..sysroot/s:'':'${EPREFIX}':" ext/Errno/Errno_pm.PL || die
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# set a soname, fix linking against just built libperl
+		sed -i -e 's/netbsd\*/netbsd*|solaris*/' Makefile.SH || die
+	fi
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name (soname) not to reference $D
+		sed -i -e '/install_name `pwd/s/`pwd`/\\$(shrpdir)/' Makefile.SH || die
+
+		# fix environ linkage absence (only a real issue on Darwin9)
+		if [[ ${CHOST##*-darwin} -le 9 ]] ; then
+			sed -i -e '/^PLDLFLAGS =/s/=/= -include crt_externs.h -Denviron="(*_NSGetEnviron())"/' \
+				Makefile.SH || die
+		fi
+	fi
+
+	default
+}
+
+myconf() {
+	# the myconf array is declared in src_configure
+	myconf=( "${myconf[@]}" "$@" )
+}
+
+# Outputs a list of versions which have been seen in any of the
+# primary perl @INC prefix paths, such as:
+#  /usr/lib64/perl5/<NUMBER>
+#  /usr/local/lib64/perl5/<NUMBER>
+#  /usr/lib64/perl5/vendor_perl/<NUMBER>
+#
+# All values of NUMBER must be like "5.x.y" or like "5.x"
+#
+find_candidate_inc_versions() {
+	local regex='.*/5[.][0-9]+\([.][0-9]+\|\)$'
+	local dirs=(
+		"${EROOT}${PRIV_BASE}"
+		"${EROOT}${SITE_BASE}"
+		"${EROOT}${VENDOR_BASE}"
+	)
+	for dir in "${dirs[@]}"; do
+		if [[ ! -e "${dir}" ]]; then
+			continue
+		fi
+		# Without access to readdir() on these dirs, find will not be able
+		# to reveal any @INC directories inside them, and will subsequently prune
+		# them from the built perl's @INC support, breaking our compatiblity options
+		# entirely.
+		if [[ ! -r "${dir}" || ! -x "${dir}" ]]; then
+			eerror "Bad permissions on ${dir}, this will probably break things"
+			eerror "Ensure ${dir} is +rx for at least uid=$EUID"
+			eerror "Recommended permission is +rx for all"
+			eerror "> chmod o+rx ${dir}"
+		fi
+	done
+	einfo "Scanning for old @INC dirs matching '$regex' in: ${dirs[*]}"
+	find "${dirs[@]}" -maxdepth 1 -mindepth 1 -type d -regex "${regex}" -printf "%f "  2>/dev/null
+}
+
+# Sort versions passed versiony-ly, remove self-version if present
+# dedup. Takes each version as an argument
+sanitize_inc_versions() {
+	local vexclude="${SUBSLOT}"
+	einfo "Normalizing/Sorting candidate list: $*"
+	einfo " to remove '${vexclude}'"
+	# Note, general numeric sort has to be used
+	# for the last component, or unique will convert
+	#  5.30.0 + 5.30 into just 5.30
+	printf "%s\n" "$@" |\
+		grep -vxF "${vexclude}" |\
+		sort -u -nr -t'.' -k1,1rn -k2,2rn -k3,3rg
+}
+
+versions_to_inclist() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+
+	for v;	do
+			has "${v}" ${oldv} && echo -n "${v}/${myarch}${mythreading}/ ";
+			echo -n "${v}/ ";
+	done
+}
+
+versions_to_gentoolibdirs() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+	local root
+	local v
+	for v;	do
+		for root in "${PRIV_BASE}" "${VENDOR_BASE}" "${SITE_BASE}"; do
+			local fullpath="${EROOT}${root}/${v}"
+			if [[ -e "${fullpath}" ]]; then
+				has "${v}" ${oldv} && printf "%s:" "${fullpath}/${myarch}${mythreading}";
+				printf "%s:" "${fullpath}"
+			fi
+		done
+	done
+}
+
+src_configure() {
+	declare -a myconf
+
+	export LC_ALL="C"
+	[[ ${COLUMNS:-1} -ge 1 ]] || unset COLUMNS # bug #394091
+
+	# Perl has problems compiling with -Os in your flags with glibc
+	replace-flags "-Os" "-O2"
+
+	# xlocale.h is going away in glibc-2.26, so it's counterproductive
+	# if we use it and include it in CORE/perl.h ... Perl builds just
+	# fine with glibc and locale.h only.
+	# However, the darwin prefix people have no locale.h ...
+	use elibc_glibc && myconf -Ui_xlocale
+
+	# This flag makes compiling crash in interesting ways
+	filter-flags "-malign-double"
+
+	# Generic LTO broken since 5.28, triggers EUMM failures
+	filter-flags "-flto"
+
+	use sparc && myconf -Ud_longdbl
+
+	export BUILD_BZIP2=0
+	export BZIP2_INCLUDE=${EROOT}/usr/include
+	export BZIP2_LIB=${EROOT}/usr/$(get_libdir)
+
+	export BUILD_ZLIB=False
+	export ZLIB_INCLUDE=${EROOT}/usr/include
+	export ZLIB_LIB=${EROOT}/usr/$(get_libdir)
+
+	# allow either gdbm to provide ndbm (in <gdbm/ndbm.h>) or db1
+	myndbm='U'
+	mygdbm='U'
+	mydb='U'
+	if use gdbm ; then
+		mygdbm='D'
+		if use berkdb ; then
+			myndbm='D'
+		fi
+	fi
+	if use berkdb ; then
+		mydb='D'
+		has_version '=sys-libs/db-1*' && myndbm='D'
+	fi
+
+	myconf "-${myndbm}i_ndbm" "-${mygdbm}i_gdbm" "-${mydb}i_db"
+
+	if use alpha && [[ "$(tc-getCC)" = "ccc" ]] ; then
+		ewarn "Perl will not be built with berkdb support, use gcc if you needed it..."
+		myconf -Ui_db -Ui_ndbm
+	fi
+
+	use ithreads && myconf -Dusethreads
+
+	use quadmath && myconf -Dusequadmath
+
+	if use debug ; then
+		append-cflags "-g"
+		myconf -DDEBUGGING
+	elif [[ ${CFLAGS} == *-g* ]] ; then
+		myconf -DDEBUGGING=-g
+	else
+		myconf -DDEBUGGING=none
+	fi
+
+	# modifying 'optimize' prevents cross configure script from appending required flags
+	if tc-is-cross-compiler; then
+		append-cflags "-fwrapv"
+	fi
+
+	# bug #877659, bug #821577
+	append-cflags -fno-strict-aliasing
+
+	# Autodiscover all old version directories, some of them will even be newer
+	# if you downgrade
+	if [[ -z ${PERL_OLDVERSEN} ]]; then
+		PERL_OLDVERSEN="$( find_candidate_inc_versions )"
+	fi
+
+	# Fixup versions, removing self match, fixing order and dupes
+	PERL_OLDVERSEN="$( sanitize_inc_versions ${PERL_OLDVERSEN} )"
+
+	# Experts who want a "Pure" install can set PERL_OLDVERSEN to an empty string
+	if [[ -n "${PERL_OLDVERSEN// }" ]]; then
+		local inclist="$( versions_to_inclist ${PERL_OLDVERSEN} )"
+		einfo "This version of perl may partially support modules previously"
+		einfo "installed in any of the following paths:"
+		for incpath in ${inclist}; do
+			[[ -e "${EROOT}${VENDOR_BASE}/${incpath}" ]] && einfo " ${EROOT}${VENDOR_BASE}/${incpath}"
+			[[ -e "${EROOT}${PRIV_BASE}/${incpath}"   ]] && einfo " ${EROOT}${PRIV_BASE}/${incpath}"
+			[[ -e "${EROOT}${SITE_BASE}/${incpath}"   ]] && einfo " ${EROOT}${SITE_BASE}/${incpath}"
+		done
+		einfo "This is a temporary measure and you should aim to cleanup these paths"
+		einfo "via world updates and perl-cleaner"
+		# myconf -Dinc_version_list="${inclist}"
+		myconf -Dgentoolibdirs="$( versions_to_gentoolibdirs ${PERL_OLDVERSEN} )"
+	fi
+
+	[[ ${ELIBC} == "FreeBSD" ]] && myconf "-Dlibc=/usr/$(get_libdir)/libc.a"
+
+	# Make sure we can do the final link #523730, need to set deployment
+	# target to override hardcoded 10.3 which breaks on modern OSX
+	[[ ${CHOST} == *-darwin* ]] && \
+		myconf "-Dld=env MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET} $(tc-getCC)"
+
+	# Older macOS with non-Apple GCC chokes on inline in system headers
+	# using c89 mode as injected by cflags.SH, in addition, we override
+	# cflags, so we loose PERL_DARWIN which enables compat code that
+	# apparently on more recent macOS releases is no longer necessary
+	[[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] && tc-is-gcc && \
+		append-cflags -Dinline=__inline__ -DPERL_DARWIN
+
+	# flock on 32-bit sparc Solaris is broken, fall back to fcntl
+	[[ ${CHOST} == sparc-*-solaris* ]] && \
+		myconf -Ud_flock
+
+	# Prefix: the host system needs not to follow Gentoo multilib stuff, and in
+	# Prefix itself we don't do multilib either, so make sure perl can find
+	# something compatible.
+	if use prefix ; then
+		# Set a hook to check for each detected library whether it actually works.
+		export libscheck="
+			( echo 'main(){}' > '${T}'/conftest.c &&
+				$(tc-getCC) -o '${T}'/conftest '${T}'/conftest.c -l\$thislib >/dev/null 2>/dev/null
+			) || xxx=/dev/null"
+
+		# Use all host paths that might contain useful stuff, the hook above will filter out bad choices.
+		local paths="/lib/*-linux-gnu /usr/lib/*-linux-gnu /lib64 /lib/64 /usr/lib64 /usr/lib/64 /lib32 /usr/lib32 /lib /usr/lib"
+		myconf "-Dlibpth=${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir) ${paths}"
+	elif [[ $(get_libdir) != "lib" ]] ; then
+		# We need to use " and not ', as the written config.sh use ' ...
+		myconf "-Dlibpth=/usr/local/$(get_libdir) /$(get_libdir) /usr/$(get_libdir)"
+	fi
+
+	# don't try building ODBM, bug #354453
+	disabled_extensions="ODBM_File"
+
+	if ! use gdbm ; then
+		# workaround for bug #157774: don't try building GDBM related stuff with USE="-gdbm"
+		disabled_extensions="${disabled_extensions} GDBM_File NDBM_File"
+	fi
+
+	myconf -Dnoextensions="${disabled_extensions}"
+
+	[[ "${PV##*.}" == "9999" ]] && myconf -Dusedevel -Uversiononly
+
+	[[ -n "${EXTRA_ECONF}" ]] && ewarn During Perl build, EXTRA_ECONF=${EXTRA_ECONF}
+	# allow fiddling via EXTRA_ECONF, bug 558070
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+
+	# setting -Dld= to tc-getLD breaks perl and all perl things
+	# https://github.com/Perl/perl5/issues/17791#issuecomment-630145202
+	myconf \
+		-Duseshrplib \
+		-Darchname="${myarch}" \
+		-Dcc="$(tc-getCC)" \
+		-Dar="$(tc-getAR)" \
+		-Dnm="$(tc-getNM)" \
+		-Dcpp="$(tc-getCPP)" \
+		-Dranlib="$(tc-getRANLIB)" \
+		-Accflags="${CFLAGS}" \
+		-Doptimize="${CFLAGS}" \
+		-Dldflags="${LDFLAGS}" \
+		-Dprefix="${EPREFIX}"'/usr' \
+		-Dsiteprefix="${EPREFIX}"'/usr/local' \
+		-Dvendorprefix="${EPREFIX}"'/usr' \
+		-Dscriptdir="${EPREFIX}"'/usr/bin' \
+		-Dprivlib="${EPREFIX}${PRIV_LIB}" \
+		-Darchlib="${EPREFIX}${ARCH_LIB}" \
+		-Dsitelib="${EPREFIX}${SITE_LIB}" \
+		-Dsitearch="${EPREFIX}${SITE_ARCH}" \
+		-Dvendorlib="${EPREFIX}${VENDOR_LIB}" \
+		-Dvendorarch="${EPREFIX}${VENDOR_ARCH}" \
+		-Dman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dsiteman1dir="${EPREFIX}"/usr/local/man/man1 \
+		-Dsiteman3dir="${EPREFIX}"/usr/local/man/man3 \
+		-Dvendorman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dvendorman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dman1ext='1' \
+		-Dman3ext='3pm' \
+		-Dlibperl="${LIBPERL}" \
+		-Dlocincpth="${EPREFIX}"'/usr/include ' \
+		-Dglibpth="${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir)"' ' \
+		-Duselargefiles \
+		-Dd_semctl_semun \
+		-Dcf_by='Gentoo' \
+		-Dmyhostname='localhost' \
+		-Dperladmin='root@localhost' \
+		-Ud_csh \
+		-Dsh="${EPREFIX}"/bin/sh \
+		-Dtargetsh="${EPREFIX}"/bin/sh \
+		-Uusenm \
+		"${EXTRA_ECONF[@]}"
+
+	if tc-is-cross-compiler; then
+		./configure \
+			--target="${CHOST}" \
+			--build="${CBUILD}" \
+			-Dinstallprefix='' \
+			-Dinstallusrbinperl='undef' \
+			-Dusevendorprefix='define' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	else
+		sh Configure \
+			-des \
+			-Dinstallprefix="${EPREFIX}"'/usr' \
+			-Dinstallusrbinperl='n' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	fi
+}
+
+src_test() {
+	export NO_GENTOO_NETWORK_TESTS=1;
+	export GENTOO_ASSUME_SANDBOXED="${GENTOO_ASSUME_SANDBOXED:-1}"
+	export GENTOO_NO_PORTING_TESTS="${GENTOO_NO_PORTING_TESTS:-1}"
+	if [[ ${EUID} == 0 ]] ; then
+		ewarn "Test fails with a sandbox error (#328793) if run as root. Skipping tests..."
+		return 0
+	fi
+	TEST_JOBS="$(makeopts_jobs)" make test_harness || die "test failed"
+}
+
+src_install() {
+	local i
+	local coredir="${ARCH_LIB}/CORE"
+
+	emake DESTDIR="${D}" install
+
+	rm -f "${ED}/usr/bin/perl${MY_PV}"
+	ln -s perl "${ED}"/usr/bin/perl${MY_PV} || die
+
+	if ! tc-is-static-only ; then
+		dolib.so "${ED}"${coredir}/${LIBPERL}
+		rm -f "${ED}"${coredir}/${LIBPERL}
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname) || die
+
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/${LIBPERL} || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname) || die
+	fi
+
+	rm -rf "${ED}"/usr/share/man/man3 || die "Unable to remove module man pages"
+
+	# This removes ${D} from Config.pm
+	for i in $(find "${D}" -iname "Config.pm" ) ; do
+		einfo "Removing ${D} from ${i}..."
+		sed -i -e "s:${D}::" "${i}" || die "Sed failed"
+	done
+
+	dodoc Changes* README AUTHORS
+
+	if use doc ; then
+		# HTML Documentation
+		# We expect errors, warnings, and such with the following.
+
+		dodir /usr/share/doc/${PF}/html
+		LD_LIBRARY_PATH=. ./perl installhtml \
+			--podroot='.' \
+			--podpath='lib:ext:pod:vms' \
+			--recurse \
+			--htmldir="${ED}/usr/share/doc/${PF}/html"
+	fi
+
+	[[ -d ${ED}/usr/local ]] && rm -r "${ED}"/usr/local
+
+	dual_scripts
+}
+
+pkg_preinst() {
+	check_rebuild
+}
+
+pkg_postinst() {
+	dual_scripts
+
+	if [[ -z "${ROOT}" ]] ; then
+		local INC DIR file
+		INC=$(perl -e 'for $line (@INC) { next if $line eq "."; next if $line =~ m/'${SHORT_PV}'|etc|local|perl$/; print "$line\n" }')
+		einfo "Removing old .ph files"
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				for file in $(find "${DIR}" -name "*.ph" -type f ) ; do
+					rm -f "${file}"
+					einfo "<< ${file}"
+				done
+			fi
+		done
+		# Silently remove the now empty dirs
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				find "${DIR}" -depth -type d -print0 | xargs -0 -r rmdir &> /dev/null
+			fi
+		done
+
+	fi
+}
+
+pkg_postrm() {
+	dual_scripts
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1.ebuild
new file mode 100644
index 0000000000..791ad320aa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.36.1.ebuild
@@ -0,0 +1,822 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
+
+PATCH_VER=1
+CROSS_VER=1.4
+PATCH_BASE="perl-5.36.0-patches-${PATCH_VER}"
+PATCH_DEV=dilfridge
+
+DIST_AUTHOR=RJBS
+
+# Greatest first, don't include yourself
+# Devel point-releases are not ABI-intercompatible, but stable point releases are
+# BIN_OLDVERSEN contains only C-ABI-intercompatible versions
+PERL_BIN_OLDVERSEN=""
+
+if [[ "${PV##*.}" == "9999" ]]; then
+	DIST_VERSION=5.30.0
+else
+	DIST_VERSION="${PV/_rc/-RC}"
+fi
+SHORT_PV="${DIST_VERSION%.*}"
+
+# Even numbered major versions are ABI intercompatible
+# Odd numbered major versions are not
+if [[ $(( ${SHORT_PV#*.} % 2 )) == 1 ]]; then
+	SUBSLOT="${DIST_VERSION%-RC*}"
+else
+	SUBSLOT="${DIST_VERSION%.*}"
+fi
+
+# Used only in tar paths
+MY_P="perl-${DIST_VERSION}"
+# Used in library paths
+MY_PV="${DIST_VERSION%-RC*}"
+
+DESCRIPTION="Larry Wall's Practical Extraction and Report Language"
+
+SRC_URI="
+	mirror://cpan/src/5.0/${MY_P}.tar.xz
+	mirror://cpan/authors/id/${DIST_AUTHOR:0:1}/${DIST_AUTHOR:0:2}/${DIST_AUTHOR}/${MY_P}.tar.xz
+	https://github.com/gentoo-perl/perl-patchset/releases/download/${PATCH_BASE}/${PATCH_BASE}.tar.xz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${PATCH_BASE}.tar.xz
+	https://github.com/arsv/perl-cross/releases/download/${CROSS_VER}/perl-cross-${CROSS_VER}.tar.gz
+"
+
+HOMEPAGE="https://www.perl.org/"
+
+LICENSE="|| ( Artistic GPL-1+ )"
+SLOT="0/${SUBSLOT}"
+
+if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+
+IUSE="berkdb debug doc gdbm ithreads minimal quadmath"
+
+RDEPEND="
+	berkdb? ( sys-libs/db:= )
+	gdbm? ( >=sys-libs/gdbm-1.8.3:= )
+	app-arch/bzip2
+	>=sys-libs/zlib-1.2.12
+	virtual/libcrypt:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="${RDEPEND}"
+
+PDEPEND="
+	!minimal? (
+		>=app-admin/perl-cleaner-2.5
+		>=virtual/perl-CPAN-2.290.0
+		>=virtual/perl-Encode-3.120.0
+		>=virtual/perl-File-Temp-0.230.400-r2
+		>=virtual/perl-Data-Dumper-2.154.0
+		virtual/perl-Test-Harness
+	)
+"
+# bug 390719, bug 523624
+# virtual/perl-Test-Harness is here for the bundled ExtUtils::MakeMaker
+
+S="${WORKDIR}/${MY_P}"
+
+dual_scripts() {
+	src_remove_dual      perl-core/Archive-Tar        2.400.0       ptar ptardiff ptargrep
+	src_remove_dual      perl-core/CPAN               2.330.0       cpan
+	src_remove_dual      perl-core/Digest-SHA         6.20.0        shasum
+	src_remove_dual      perl-core/Encode             3.170.0       enc2xs piconv
+	src_remove_dual      perl-core/ExtUtils-MakeMaker 7.640.0       instmodsh
+	src_remove_dual      perl-core/ExtUtils-ParseXS   3.450.0       xsubpp
+	src_remove_dual      perl-core/IO-Compress        2.106.0       zipdetails
+	src_remove_dual      perl-core/JSON-PP            4.70.0        json_pp
+	src_remove_dual      perl-core/Module-CoreList    5.202.304.230 corelist
+	src_remove_dual      perl-core/Pod-Checker        1.740.0       podchecker
+	src_remove_dual      perl-core/Pod-Perldoc        3.280.100     perldoc
+	src_remove_dual      perl-core/Pod-Usage          2.10.0       pod2usage
+	src_remove_dual      perl-core/Test-Harness       3.440.0       prove
+	src_remove_dual      perl-core/podlators          4.140.0       pod2man pod2text
+	src_remove_dual_man  perl-core/podlators          4.140.0       /usr/share/man/man1/perlpodstyle.1
+}
+
+check_rebuild() {
+	# Fresh install
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		return 0;
+	# Major Upgrade
+	# doesn't matter if there's multiple copies, it still needs a rebuild
+	# if the string is anything other than "5.CURRENTMAJOR"
+	elif [[ "${REPLACING_VERSIONS%.*}" != "${PV%.*}" ]]; then
+		echo ""
+		ewarn "UPDATE THE PERL MODULES:"
+		ewarn "After updating dev-lang/perl the installed Perl modules"
+		ewarn "have to be re-installed. In most cases, this is done automatically"
+		ewarn "by the package manager, but subsequent steps are still recommended"
+		ewarn "to ensure system consistency."
+		ewarn
+		ewarn "You should start with a depclean to remove any unused perl dependencies"
+		ewarn "that may confuse portage in future. Regular depcleans are also encouraged"
+		ewarn "as part of your regular update cycle, as that will keep perl upgrades working."
+		ewarn "Recommended: emerge --depclean -va"
+		ewarn
+		ewarn "You should then call perl-cleaner to clean up any old files and trigger any"
+		ewarn "remaining rebuilds portage may have missed."
+		ewarn "Use: perl-cleaner --all"
+		return 0;
+
+	# Reinstall w/ USE Change
+	elif
+		 (   use ithreads && ! has_version dev-lang/perl[ithreads] ) || \
+		 ( ! use ithreads &&   has_version dev-lang/perl[ithreads] ) || \
+		 (   use quadmath && ! has_version dev-lang/perl[quadmath] ) || \
+		 ( ! use quadmath &&   has_version dev-lang/perl[quadmath] ) || \
+		 (   use debug    && ! has_version dev-lang/perl[debug]    ) || \
+		 ( ! use debug    &&   has_version dev-lang/perl[debug]    ) ; then
+		echo ""
+		ewarn "TOGGLED USE-FLAGS WARNING:"
+		ewarn "You changed one of the use-flags ithreads, quadmath, or debug."
+		ewarn "You must rebuild all perl-modules installed."
+		ewarn "Use: perl-cleaner --modules ; perl-cleaner --force --libperl"
+	fi
+}
+
+pkg_setup() {
+	case ${CHOST} in
+		*-freebsd*)   osname="freebsd" ;;
+		*-dragonfly*) osname="dragonfly" ;;
+		*-netbsd*)    osname="netbsd" ;;
+		*-openbsd*)   osname="openbsd" ;;
+		*-darwin*)    osname="darwin" ;;
+		*-solaris*)   osname="solaris" ;;
+		*-cygwin*)    osname="cygwin" ;;
+		*)            osname="linux" ;;
+	esac
+
+	myarch="${CHOST%%-*}-${osname}"
+	if use debug ; then
+		myarch+="-debug"
+	fi
+	if use quadmath ; then
+		myarch+="-quadmath"
+	fi
+	if use ithreads ; then
+		mythreading="-multi"
+		myarch+="-thread"
+	fi
+
+	PRIV_BASE="/usr/$(get_libdir)/perl5"
+	SITE_BASE="/usr/local/$(get_libdir)/perl5"
+	VENDOR_BASE="/usr/$(get_libdir)/perl5/vendor_perl"
+
+	LIBPERL="libperl$(get_libname ${MY_PV} )"
+
+	PRIV_LIB="${PRIV_BASE}/${SUBSLOT}"
+	ARCH_LIB="${PRIV_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	SITE_LIB="${SITE_BASE}/${SUBSLOT}"
+	SITE_ARCH="${SITE_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	VENDOR_LIB="${VENDOR_BASE}/${SUBSLOT}"
+	VENDOR_ARCH="${VENDOR_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+
+	dual_scripts
+}
+
+src_remove_dual_file() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				alternatives_auto_makesym "${i}" "${i}-[0-9]*"
+			done
+			;;
+		setup)
+			for i in "$@" ; do
+				if [[ -f ${EROOT}${i} && ! -h ${EROOT}${i} ]] ; then
+					has_version ${pkg} && ewarn "You must reinstall ${pkg} !"
+					break
+				fi
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i}{,-${ver}-${P}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual_man() {
+	local i pkg ver ff
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				ff=`echo "${EROOT}${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}}"*`
+				ff=${ff##*${i#${i%.[0-9]}}}
+				alternatives_auto_makesym "${i}${ff}" "${i%.[0-9]}-[0-9]*"
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i} "${ED}"${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	for i in "$@" ; do
+		src_remove_dual_file  "${pkg}" "${ver}" "/usr/bin/${i}"
+		src_remove_dual_man   "${pkg}" "${ver}" "/usr/share/man/man1/${i}.1"
+	done
+}
+
+src_prepare_perlcross() {
+	cp -a ../perl-cross-${CROSS_VER}/* . || die
+
+	# bug 794463, needs further analysis what is exactly wrong here
+	eapply "${FILESDIR}/perl-5.34.0-crossfit.patch"
+
+	# bug 604072
+	MAKEOPTS+=" -j1"
+	export MAKEOPTS
+}
+
+src_prepare_dynamic() {
+	ln -s ${LIBPERL} libperl$(get_libname ${SHORT_PV}) || die
+	ln -s ${LIBPERL} libperl$(get_libname ) || die
+}
+
+# Copy a patch into the patch series
+# add_patch SRC_PATH DEST_NAME ['description'] ['bug'] ['bug']
+# - description is optional, but recommended
+# - all arguments after descriptions are bug URLs
+add_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local src_name dest_name desc
+	src_name="$1"
+	dest_name="$2"
+	desc="$3"
+	shift; shift; shift;
+	einfo "Adding ${dest_name} to patch bundle"
+	cp "${src_name}" "${patchdir}/${dest_name}" || die "Couldn't copy ${src_name} to ${dest_name}"
+	if [[ -n "${desc}" ]]; then
+		printf "%s" "${desc}" > "${infodir}/${dest_name}.desc" || die "Couldn't write ${dest_name}.desc"
+	fi
+	if [[ $# -gt 0 ]]; then
+		# Note: when $@ is more than one element, this emits a
+		# line for each element
+		printf "%s\n" "$@" > "${infodir}/${dest_name}.bugs" || die "Couldn't write ${dest_name}.bugs"
+	fi
+}
+
+# Remove a patch using a glob expr
+# eg:
+#	 rm_patch *-darwin-Use-CC*
+#
+rm_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local expr="$1"
+	local patch="$( cd "${patchdir}"; echo $expr )"
+	einfo "Removing $patch ($expr) from patch bundle"
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		rm -f "${patchdir}/${patch}" || die "Can't remove ${patch} ( $expr )"
+	else
+		ewarn "No ${expr} found in ${patchdir} to remove"
+	fi
+}
+
+# Yes, this is a reasonable amount of code for something seemingly simple
+# but this is far easier to debug when things go wrong, and things went wrong
+# multiple times while I was getting the exact number of slashes right, which
+# requires circumnavigating both bash and sed escape mechanisms.
+c_escape_string() {
+	local slash dquote
+	slash='\'
+	dquote='"'
+	re_slash="${slash}${slash}"
+	re_dquote="${slash}${dquote}"
+
+	# Convert \ to \\,
+	#         " to \"
+	echo "$1" |\
+		sed "s|${re_slash}|${re_slash}${re_slash}|g" |\
+		sed "s|${re_dquote}|${re_slash}${re_dquote}|g"
+}
+c_escape_file() {
+	c_escape_string "$(cat "$1")"
+}
+
+apply_patchdir() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local patchoutput="patchlevel-gentoo.h"
+
+	# Inject Patch-Level info into description for patchlevel.h patch
+	# to show in -V
+	local patch_expr="*List-packaged-patches*"
+	local patch="$( cd "${patchdir}"; echo $patch_expr )";
+	einfo "Injecting patch-level info into ${patch}.desc ( $patch_expr )"
+
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		printf "List packaged patches for %s(%s) in patchlevel.h" "${PF}" "${PATCH_BASE}"\
+			>"${infodir}/${patch}.desc" || die "Can't rewrite ${patch}.desc"
+	else
+		eerror "No $patch_expr found in ${patchdir}"
+	fi
+
+	# Compute patch list to apply
+	# different name other than PATCHES to stop default
+	# reapplying it
+	# Single depth is currently only supported, as artifacts can reside
+	# from the old layout being multiple-directories, as well as it grossly
+	# simplifying the patchlevel_gentoo.h generation.
+	local PERL_PATCHES=($(
+		find "${patchdir}" -maxdepth 1 -mindepth 1 -type f -printf "%f\n" |\
+			grep -E '[.](diff|patch)$' |\
+			sort -n
+	))
+
+	for patch in "${PERL_PATCHES[@]}"; do
+		eapply "${WORKDIR}"/patches/${patch}
+	done
+
+	einfo "Generating $patchoutput"
+
+	# This code creates a header file, each iteration
+	# creates one-or-more-lines for each entry found in PERL_PATCHES
+	# and STDOUT is redirected to the .h file
+	for patch in "${PERL_PATCHES[@]}"; do
+		local desc_f="${infodir}/${patch}.desc"
+		local bugs_f="${infodir}/${patch}.bugs"
+
+		printf ',"%s"\n' "${patch}"
+		if [[ ! -e "${desc_f}" ]]; then
+			ewarn "No description provided for ${patch} (expected: ${desc_f} )"
+		else
+			local desc="$(c_escape_file "${desc_f}")"
+			printf ',"- %s"\n' "${desc}"
+		fi
+		if [[ -e "${bugs_f}" ]]; then
+			while read -d $'\n' -r line; do
+				local esc_line="$(c_escape_string "${line}")"
+				printf ',"- Bug: %s"\n' "${esc_line}"
+			done <"${bugs_f}"
+		fi
+	done > "${S}/${patchoutput}"
+	printf "%s\n" "${patchoutput}" >> "${S}/MANIFEST"
+
+}
+
+src_prepare() {
+	local patchdir="${WORKDIR}/patches"
+
+	# Prepare Patch dir with additional patches / remove unwanted patches
+	# Inject bug/desc entries for perl -V
+	# Old example:
+	# add_patch "${FILESDIR}/${PN}-5.26.2-hppa.patch" "100-5.26.2-hppa.patch"\
+	#		"Fix broken miniperl on hppa"\
+	#		"https://bugs.debian.org/869122" "https://bugs.gentoo.org/634162"
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# do NOT mess with nsl, on Solaris this is always necessary,
+		# when -lsocket is used e.g. to get h_errno
+		rm_patch "*-nsl-and-cl*"
+	fi
+
+	apply_patchdir
+
+	tc-is-cross-compiler && src_prepare_perlcross
+
+	tc-is-static-only || src_prepare_dynamic
+
+	if use gdbm; then
+		sed -i "s:INC => .*:INC => \"-I${EROOT}/usr/include/gdbm\":g" \
+			ext/NDBM_File/Makefile.PL || die
+	fi
+
+	# Use errno.h from prefix rather than from host system, bug #645804
+	if use prefix && [[ -e "${EPREFIX}"/usr/include/errno.h ]] ; then
+		sed -i "/my..sysroot/s:'':'${EPREFIX}':" ext/Errno/Errno_pm.PL || die
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# set a soname, fix linking against just built libperl
+		sed -i -e 's/netbsd\*/netbsd*|solaris*/' Makefile.SH || die
+	fi
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name (soname) not to reference $D
+		sed -i -e '/install_name `pwd/s/`pwd`/\\$(shrpdir)/' Makefile.SH || die
+
+		# fix environ linkage absence (only a real issue on Darwin9)
+		if [[ ${CHOST##*-darwin} -le 9 ]] ; then
+			sed -i -e '/^PLDLFLAGS =/s/=/= -include crt_externs.h -Denviron="(*_NSGetEnviron())"/' \
+				Makefile.SH || die
+		fi
+	fi
+
+	default
+}
+
+myconf() {
+	# the myconf array is declared in src_configure
+	myconf=( "${myconf[@]}" "$@" )
+}
+
+# Outputs a list of versions which have been seen in any of the
+# primary perl @INC prefix paths, such as:
+#  /usr/lib64/perl5/<NUMBER>
+#  /usr/local/lib64/perl5/<NUMBER>
+#  /usr/lib64/perl5/vendor_perl/<NUMBER>
+#
+# All values of NUMBER must be like "5.x.y" or like "5.x"
+#
+find_candidate_inc_versions() {
+	local regex='.*/5[.][0-9]+\([.][0-9]+\|\)$'
+	local dirs=(
+		"${EROOT}${PRIV_BASE}"
+		"${EROOT}${SITE_BASE}"
+		"${EROOT}${VENDOR_BASE}"
+	)
+	for dir in "${dirs[@]}"; do
+		if [[ ! -e "${dir}" ]]; then
+			continue
+		fi
+		# Without access to readdir() on these dirs, find will not be able
+		# to reveal any @INC directories inside them, and will subsequently prune
+		# them from the built perl's @INC support, breaking our compatiblity options
+		# entirely.
+		if [[ ! -r "${dir}" || ! -x "${dir}" ]]; then
+			eerror "Bad permissions on ${dir}, this will probably break things"
+			eerror "Ensure ${dir} is +rx for at least uid=$EUID"
+			eerror "Recommended permission is +rx for all"
+			eerror "> chmod o+rx ${dir}"
+		fi
+	done
+	einfo "Scanning for old @INC dirs matching '$regex' in: ${dirs[*]}"
+	find "${dirs[@]}" -maxdepth 1 -mindepth 1 -type d -regex "${regex}" -printf "%f "  2>/dev/null
+}
+
+# Sort versions passed versiony-ly, remove self-version if present
+# dedup. Takes each version as an argument
+sanitize_inc_versions() {
+	local vexclude="${SUBSLOT}"
+	einfo "Normalizing/Sorting candidate list: $*"
+	einfo " to remove '${vexclude}'"
+	# Note, general numeric sort has to be used
+	# for the last component, or unique will convert
+	#  5.30.0 + 5.30 into just 5.30
+	printf "%s\n" "$@" |\
+		grep -vxF "${vexclude}" |\
+		sort -u -nr -t'.' -k1,1rn -k2,2rn -k3,3rg
+}
+
+versions_to_inclist() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+
+	for v;	do
+			has "${v}" ${oldv} && echo -n "${v}/${myarch}${mythreading}/ ";
+			echo -n "${v}/ ";
+	done
+}
+
+versions_to_gentoolibdirs() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+	local root
+	local v
+	for v;	do
+		for root in "${PRIV_BASE}" "${VENDOR_BASE}" "${SITE_BASE}"; do
+			local fullpath="${EROOT}${root}/${v}"
+			if [[ -e "${fullpath}" ]]; then
+				has "${v}" ${oldv} && printf "%s:" "${fullpath}/${myarch}${mythreading}";
+				printf "%s:" "${fullpath}"
+			fi
+		done
+	done
+}
+
+src_configure() {
+	declare -a myconf
+
+	export LC_ALL="C"
+	[[ ${COLUMNS:-1} -ge 1 ]] || unset COLUMNS # bug #394091
+
+	# Perl has problems compiling with -Os in your flags with glibc
+	replace-flags "-Os" "-O2"
+
+	# xlocale.h is going away in glibc-2.26, so it's counterproductive
+	# if we use it and include it in CORE/perl.h ... Perl builds just
+	# fine with glibc and locale.h only.
+	# However, the darwin prefix people have no locale.h ...
+	use elibc_glibc && myconf -Ui_xlocale
+
+	# This flag makes compiling crash in interesting ways
+	filter-flags "-malign-double"
+
+	# Generic LTO broken since 5.28, triggers EUMM failures
+	filter-flags "-flto"
+
+	use sparc && myconf -Ud_longdbl
+
+	export BUILD_BZIP2=0
+	export BZIP2_INCLUDE=${EROOT}/usr/include
+	export BZIP2_LIB=${EROOT}/usr/$(get_libdir)
+
+	export BUILD_ZLIB=False
+	export ZLIB_INCLUDE=${EROOT}/usr/include
+	export ZLIB_LIB=${EROOT}/usr/$(get_libdir)
+
+	# allow either gdbm to provide ndbm (in <gdbm/ndbm.h>) or db1
+	myndbm='U'
+	mygdbm='U'
+	mydb='U'
+	if use gdbm ; then
+		mygdbm='D'
+		if use berkdb ; then
+			myndbm='D'
+		fi
+	fi
+	if use berkdb ; then
+		mydb='D'
+		has_version '=sys-libs/db-1*' && myndbm='D'
+	fi
+
+	myconf "-${myndbm}i_ndbm" "-${mygdbm}i_gdbm" "-${mydb}i_db"
+
+	if use alpha && [[ "$(tc-getCC)" = "ccc" ]] ; then
+		ewarn "Perl will not be built with berkdb support, use gcc if you needed it..."
+		myconf -Ui_db -Ui_ndbm
+	fi
+
+	use ithreads && myconf -Dusethreads
+
+	use quadmath && myconf -Dusequadmath
+
+	if use debug ; then
+		append-cflags "-g"
+		myconf -DDEBUGGING
+	elif [[ ${CFLAGS} == *-g* ]] ; then
+		myconf -DDEBUGGING=-g
+	else
+		myconf -DDEBUGGING=none
+	fi
+
+	# modifying 'optimize' prevents cross configure script from appending required flags
+	if tc-is-cross-compiler; then
+		append-cflags "-fwrapv"
+	fi
+
+	# bug #877659, bug #821577
+	append-cflags -fno-strict-aliasing
+
+	# Autodiscover all old version directories, some of them will even be newer
+	# if you downgrade
+	if [[ -z ${PERL_OLDVERSEN} ]]; then
+		PERL_OLDVERSEN="$( find_candidate_inc_versions )"
+	fi
+
+	# Fixup versions, removing self match, fixing order and dupes
+	PERL_OLDVERSEN="$( sanitize_inc_versions ${PERL_OLDVERSEN} )"
+
+	# Experts who want a "Pure" install can set PERL_OLDVERSEN to an empty string
+	if [[ -n "${PERL_OLDVERSEN// }" ]]; then
+		local inclist="$( versions_to_inclist ${PERL_OLDVERSEN} )"
+		einfo "This version of perl may partially support modules previously"
+		einfo "installed in any of the following paths:"
+		for incpath in ${inclist}; do
+			[[ -e "${EROOT}${VENDOR_BASE}/${incpath}" ]] && einfo " ${EROOT}${VENDOR_BASE}/${incpath}"
+			[[ -e "${EROOT}${PRIV_BASE}/${incpath}"   ]] && einfo " ${EROOT}${PRIV_BASE}/${incpath}"
+			[[ -e "${EROOT}${SITE_BASE}/${incpath}"   ]] && einfo " ${EROOT}${SITE_BASE}/${incpath}"
+		done
+		einfo "This is a temporary measure and you should aim to cleanup these paths"
+		einfo "via world updates and perl-cleaner"
+		# myconf -Dinc_version_list="${inclist}"
+		myconf -Dgentoolibdirs="$( versions_to_gentoolibdirs ${PERL_OLDVERSEN} )"
+	fi
+
+	[[ ${ELIBC} == "FreeBSD" ]] && myconf "-Dlibc=/usr/$(get_libdir)/libc.a"
+
+	# Make sure we can do the final link #523730, need to set deployment
+	# target to override hardcoded 10.3 which breaks on modern OSX
+	[[ ${CHOST} == *-darwin* ]] && \
+		myconf "-Dld=env MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET} $(tc-getCC)"
+
+	# Older macOS with non-Apple GCC chokes on inline in system headers
+	# using c89 mode as injected by cflags.SH, in addition, we override
+	# cflags, so we loose PERL_DARWIN which enables compat code that
+	# apparently on more recent macOS releases is no longer necessary
+	[[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] && tc-is-gcc && \
+		append-cflags -Dinline=__inline__ -DPERL_DARWIN
+
+	# flock on 32-bit sparc Solaris is broken, fall back to fcntl
+	[[ ${CHOST} == sparc-*-solaris* ]] && \
+		myconf -Ud_flock
+
+	# Prefix: the host system needs not to follow Gentoo multilib stuff, and in
+	# Prefix itself we don't do multilib either, so make sure perl can find
+	# something compatible.
+	if use prefix ; then
+		# Set a hook to check for each detected library whether it actually works.
+		export libscheck="
+			( echo 'main(){}' > '${T}'/conftest.c &&
+				$(tc-getCC) -o '${T}'/conftest '${T}'/conftest.c -l\$thislib >/dev/null 2>/dev/null
+			) || xxx=/dev/null"
+
+		# Use all host paths that might contain useful stuff, the hook above will filter out bad choices.
+		local paths="/lib/*-linux-gnu /usr/lib/*-linux-gnu /lib64 /lib/64 /usr/lib64 /usr/lib/64 /lib32 /usr/lib32 /lib /usr/lib"
+		myconf "-Dlibpth=${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir) ${paths}"
+	elif [[ $(get_libdir) != "lib" ]] ; then
+		# We need to use " and not ', as the written config.sh use ' ...
+		myconf "-Dlibpth=/usr/local/$(get_libdir) /$(get_libdir) /usr/$(get_libdir)"
+	fi
+
+	# don't try building ODBM, bug #354453
+	disabled_extensions="ODBM_File"
+
+	if ! use gdbm ; then
+		# workaround for bug #157774: don't try building GDBM related stuff with USE="-gdbm"
+		disabled_extensions="${disabled_extensions} GDBM_File NDBM_File"
+	fi
+
+	myconf -Dnoextensions="${disabled_extensions}"
+
+	[[ "${PV##*.}" == "9999" ]] && myconf -Dusedevel -Uversiononly
+
+	[[ -n "${EXTRA_ECONF}" ]] && ewarn During Perl build, EXTRA_ECONF=${EXTRA_ECONF}
+	# allow fiddling via EXTRA_ECONF, bug 558070
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+
+	# setting -Dld= to tc-getLD breaks perl and all perl things
+	# https://github.com/Perl/perl5/issues/17791#issuecomment-630145202
+	myconf \
+		-Duseshrplib \
+		-Darchname="${myarch}" \
+		-Dcc="$(tc-getCC)" \
+		-Dar="$(tc-getAR)" \
+		-Dnm="$(tc-getNM)" \
+		-Dcpp="$(tc-getCPP)" \
+		-Dranlib="$(tc-getRANLIB)" \
+		-Accflags="${CFLAGS}" \
+		-Doptimize="${CFLAGS}" \
+		-Dldflags="${LDFLAGS}" \
+		-Dprefix="${EPREFIX}"'/usr' \
+		-Dsiteprefix="${EPREFIX}"'/usr/local' \
+		-Dvendorprefix="${EPREFIX}"'/usr' \
+		-Dscriptdir="${EPREFIX}"'/usr/bin' \
+		-Dprivlib="${EPREFIX}${PRIV_LIB}" \
+		-Darchlib="${EPREFIX}${ARCH_LIB}" \
+		-Dsitelib="${EPREFIX}${SITE_LIB}" \
+		-Dsitearch="${EPREFIX}${SITE_ARCH}" \
+		-Dvendorlib="${EPREFIX}${VENDOR_LIB}" \
+		-Dvendorarch="${EPREFIX}${VENDOR_ARCH}" \
+		-Dman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dsiteman1dir="${EPREFIX}"/usr/local/man/man1 \
+		-Dsiteman3dir="${EPREFIX}"/usr/local/man/man3 \
+		-Dvendorman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dvendorman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dman1ext='1' \
+		-Dman3ext='3pm' \
+		-Dlibperl="${LIBPERL}" \
+		-Dlocincpth="${EPREFIX}"'/usr/include ' \
+		-Dglibpth="${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir)"' ' \
+		-Duselargefiles \
+		-Dd_semctl_semun \
+		-Dcf_by='Gentoo' \
+		-Dmyhostname='localhost' \
+		-Dperladmin='root@localhost' \
+		-Ud_csh \
+		-Dsh="${EPREFIX}"/bin/sh \
+		-Dtargetsh="${EPREFIX}"/bin/sh \
+		-Uusenm \
+		"${EXTRA_ECONF[@]}"
+
+	if tc-is-cross-compiler; then
+		./configure \
+			--target="${CHOST}" \
+			--build="${CBUILD}" \
+			-Dinstallprefix='' \
+			-Dinstallusrbinperl='undef' \
+			-Dusevendorprefix='define' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	else
+		sh Configure \
+			-des \
+			-Dinstallprefix="${EPREFIX}"'/usr' \
+			-Dinstallusrbinperl='n' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	fi
+}
+
+src_test() {
+	export NO_GENTOO_NETWORK_TESTS=1;
+	export GENTOO_ASSUME_SANDBOXED="${GENTOO_ASSUME_SANDBOXED:-1}"
+	export GENTOO_NO_PORTING_TESTS="${GENTOO_NO_PORTING_TESTS:-1}"
+	if [[ ${EUID} == 0 ]] ; then
+		ewarn "Test fails with a sandbox error (#328793) if run as root. Skipping tests..."
+		return 0
+	fi
+	TEST_JOBS="$(makeopts_jobs)" make test_harness || die "test failed"
+}
+
+src_install() {
+	local i
+	local coredir="${ARCH_LIB}/CORE"
+
+	emake DESTDIR="${D}" install
+
+	rm -f "${ED}/usr/bin/perl${MY_PV}"
+	ln -s perl "${ED}"/usr/bin/perl${MY_PV} || die
+
+	if ! tc-is-static-only ; then
+		dolib.so "${ED}"${coredir}/${LIBPERL}
+		rm -f "${ED}"${coredir}/${LIBPERL}
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname) || die
+
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/${LIBPERL} || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname) || die
+	fi
+
+	rm -rf "${ED}"/usr/share/man/man3 || die "Unable to remove module man pages"
+
+	# This removes ${D} from Config.pm
+	for i in $(find "${D}" -iname "Config.pm" ) ; do
+		einfo "Removing ${D} from ${i}..."
+		sed -i -e "s:${D}::" "${i}" || die "Sed failed"
+	done
+
+	dodoc Changes* README AUTHORS
+
+	if use doc ; then
+		# HTML Documentation
+		# We expect errors, warnings, and such with the following.
+
+		dodir /usr/share/doc/${PF}/html
+		LD_LIBRARY_PATH=. ./perl installhtml \
+			--podroot='.' \
+			--podpath='lib:ext:pod:vms' \
+			--recurse \
+			--htmldir="${ED}/usr/share/doc/${PF}/html"
+	fi
+
+	[[ -d ${ED}/usr/local ]] && rm -r "${ED}"/usr/local
+
+	dual_scripts
+}
+
+pkg_preinst() {
+	check_rebuild
+}
+
+pkg_postinst() {
+	dual_scripts
+
+	if [[ -z "${ROOT}" ]] ; then
+		local INC DIR file
+		INC=$(perl -e 'for $line (@INC) { next if $line eq "."; next if $line =~ m/'${SHORT_PV}'|etc|local|perl$/; print "$line\n" }')
+		einfo "Removing old .ph files"
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				for file in $(find "${DIR}" -name "*.ph" -type f ) ; do
+					rm -f "${file}"
+					einfo "<< ${file}"
+				done
+			fi
+		done
+		# Silently remove the now empty dirs
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				find "${DIR}" -depth -type d -print0 | xargs -0 -r rmdir &> /dev/null
+			fi
+		done
+
+	fi
+}
+
+pkg_postrm() {
+	dual_scripts
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index d71fec6c19..e2f6694933 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -1,15 +1,9 @@
 DIST Python-2.7.18.tar.xz 12854736 BLAKE2B 060a621c91dd8e3d321aec99d44c17aa67381998256a1a002d316b38288349884d5960de35c49352d03129ed0bae599e641ec2225898158ebce50a7a2fd74d2c SHA512 a7bb62b51f48ff0b6df0b18f5b0312a523e3110f49c3237936bfe56ed0e26838c0274ff5401bda6fc21bf24337477ccac49e8026c5d651e4b4cafb5eb5086f6c
 DIST Python-2.7.18.tar.xz.asc 833 BLAKE2B 1d98770e46171971fb99994508d238c01d2755281d2f94353314014d9e83e0ec5f0b3e3950ea1fdf5fce9ba6b8f55312355845c2a3fc4291c27ee56fe6215448 SHA512 c2a5f5a52f47dec52460ad3275758d4e5de6e7075c3def4353c988d74d563a39b42cae2d5eb24e2a23a6247cef69100f91620b11a49c2359fbf99b203c9cbda8
-DIST Python-3.10.10.tar.xz 19627028 BLAKE2B 57fc6869fa05586158a170c1892d93a3036823bfafb9484b9d70bca6cdc3e76f75357622eace4bde9a4c0ca62a1bb79665e5751b41655f9f4d7e345547013ad8 SHA512 f0aee65970a68287b34c4eafcf35c6fa09c81ba234ac356db16fbbc6c36417e4ac67071e616d118f5e192d541d7f177dcab5585b9780e842f656c09e01c37ced
-DIST Python-3.10.10.tar.xz.asc 833 BLAKE2B fd60e6268f7dd6676ea58bd7e80c513506ac9810c1a62ff060134207b0fd8e7b096d5f11f3cc536a1578144ff54c00bcb076d3c3f5889a69a898660dd280312b SHA512 591746d74c6123bf36c763b6e8e1de1554f02eeff30c855623ef0f12d3864d5573eb5efe96d6e142f24627c77b90738ada3456df4ad59bddcb008658f2ca8af9
 DIST Python-3.10.11.tar.xz 19640792 BLAKE2B ce281549cb8fdcb74e068cc76c5412af749a6394644c2aacabdcbf5e10210fb5c0f4e7cb2eb3b728837eb89e382873074e938f609d94001dd5b4bf823084a994 SHA512 fa113b4b635d271a1412999587ec64654d337db263851a6a9d88b3cab4ed66dba76fe03e65c4d341f0a83fd8182d35e245bfd9827465d7aebcb4deb71af4d047
 DIST Python-3.10.11.tar.xz.asc 833 BLAKE2B ba107904c1658374481636bc950187a7bd1a2fb33aa3fb2fd1343e5aec6e84afdadab0b2edc6f0768856ae7b847a592fc79a7476247f4ff67c38c1ff18f831e9 SHA512 edddacc81d4671851cd2a52853cabc53314fa226dac77c2248ee61cf7d58dd2f59301b7729b2ff9f5717b84268140c3bef30e358b80718c6c84b308bd560bcd8
-DIST Python-3.11.2.tar.xz 19893284 BLAKE2B 0cfb1fefcdd4c4baf5c34f74ab0600ac7cd40101d266c28f66f9d35bcfbf19d6c3ff2a5b0d357ee1d03061e06005ea3ee7b18adf878d32e197434b3da2b7d918 SHA512 5684ec7eae2dce26facc54d448ccdb6901bbfa1cab03abbe8fd34e4268a2b701daa13df15903349492447035be78380d473389e8703b4e910a65b088d2462e8b
-DIST Python-3.11.2.tar.xz.asc 833 BLAKE2B 15795836babd269424f1ff511073e27235827353383d15cac6a85406b967787840ca6c0f119faa1971a50ebb6699e6cdf0de095f428b868b57a91eb8dc6d5baa SHA512 9d9d1c6dd6e56a916c6861cd0e7e623a165b0845bafe0acfcae27b4fe10a6b7015844e6b3f8deded26a763c935e32f565b2e12beb20c43fda16c11eba8d282a1
 DIST Python-3.11.3.tar.xz 19906156 BLAKE2B c23815e09a0012b2af03f3e18471389382978ef0991cb081c4c6410e98613589d47d3ad782c0a06a48ddd86fc5df7f1d59e93dbab5871b89559e225084544248 SHA512 a3bba4b69322a47bfeefe42ba0fd7331b5b67fd2ab41441e2219d16ef8c6f307f1a48977afd073c18cfd24ec6cb1bfe0c4bb4b273031eb524dc7e9fb5fbcc3b6
 DIST Python-3.11.3.tar.xz.asc 833 BLAKE2B 1846858480428293047bfaf87a74f5a6cf28227f63dbc36e658ab68444a5b91c2178fca42f35a413591103a0ceeea3cd5f8b757fb2f42cbcad023c62970ab950 SHA512 34bfb6e74e2bbec15bf3f653e32a3d705961b5f724e3f4713cf9b6b530f9c9e7e94f5cf855798bdf9763235b97a60ec9ad554d24cdc793e21a0c39540b5818d8
-DIST Python-3.12.0a6.tar.xz 19779564 BLAKE2B 57928629c3df4baceda524c4968c97b7d531dd4072d0fa94780c42786b58cd9836c856ce024561641037099808557b133e60b74d019202e79c6b464a366b15ed SHA512 f1f4fa5982ff37765fc657a99c0a3277935587b6073c0f6c9e0d1fdbc79c63f3dff9b2e296e72bfa1b6a0ebcbcb13801d6e6599c13230e8c0256c13ac2754488
-DIST Python-3.12.0a6.tar.xz.asc 963 BLAKE2B a0c148e4451b1f55bc3fa0cae2940872b6e0cf47d47283e04ab99c997bef4128c349d399675bce6738875ffa0cbcfa16393eb1b7530ca96369c8cea633d48874 SHA512 9e72be00a9b99a4d01c60b9b3af718b39ff7a1e68b5a8d5215f5797ac133f84f6382dc7339da5ed2e5be706fa5abaedc54b461b50a679e051e96189987be4cc5
 DIST Python-3.12.0a7.tar.xz 19819836 BLAKE2B e899a47228560219b9e2dd1520999a026bd198fa47867ef3da30f6817d85c2ba6fe3956d1da0a038a096d3e70227d43c53fab88329af7c3dd9652d8b30f89bca SHA512 181e73215666a7deb4286a70f506d788adb0d13e3b688f3c4e061819bc59cbcedaf8aca0251d4e58791be8488f43ca0075176335bd1b3ff496b4ea2f14967d8b
 DIST Python-3.12.0a7.tar.xz.asc 963 BLAKE2B 9e1b223b5b0556f95fb6bacb1ae66cd6115f8b589eb8ad46d1fec7e4d64aa5cc12c993be5b1fc87966b6b1b6964d433c00920dd98de41380bd8a8ee9b4f98490 SHA512 07c27bfb649755cfe505a902ff677e146ed1e8e19e7d5801d41c5926359b7d3f2ef73961c26f6cce6dd948355324330d4e9bae79e3661f87079b1adb5bf62355
 DIST Python-3.8.16.tar.xz 19046724 BLAKE2B cbdeec7961d39cb9ab4960760b5d4c7ae71675c174156aa9f6fca55ee92a93a937ef39defe86e423237a25e0e24703233ce4b91dc97005b6ffc1f342ddd9e22c SHA512 d206e80806409410c00ef8acd8c3d90e3cc9553f996d0a57faa63802f2415e9d7591542b2e84b5e8e79245f40f6478790b5ba2acf1da98ebbc9495999183f7fd
@@ -17,11 +11,8 @@ DIST Python-3.8.16.tar.xz.asc 833 BLAKE2B 678dabc558d013b104bf9e65d4319076c4730a
 DIST Python-3.9.16.tar.xz 19738796 BLAKE2B 70dedeb70d9d8f27e4f6db5106623e087c61d451c7a04639cf8d3503ad02d4d43f1b36d0cdf1131aefc9bf6e677e561227dd4baef2c2c3d2dbf6d3e7dc36bd94 SHA512 b5fd0afe131c82bbce6ddf887c59eef6945910d6a9a2bc87c0927f4e4a096bf9ca4d25bcb729c40f6ebb8a65fbe8bf7b0b97a7c4a8c9e551240eb4f34b878653
 DIST Python-3.9.16.tar.xz.asc 833 BLAKE2B 416b4a4be06e101c5971c12a6f21229c425bcabaea58487e0d1b24d6dea318c58806ee43892fc704df8252670451bd6a4a2610c25672d3983ddb081fed34b92d SHA512 468959c36a3ec6136f57a39475fff4745a25be0cb5d3d58cf3e5faf0b9ce2d2a8b89f1f9fea1479c4c6ad12ac49e97c1cfd4291c978bb3d30df5a582ec315210
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
-DIST python-gentoo-patches-3.10.10_p3.tar.xz 14700 BLAKE2B 934462f437ffbf0b65e1cd63719121b7d551698e5ca9e67283a60f24151c6cf62eb0d31b16dad3b6e95da0dd6eac8c84c86332e42195f0f9dd7fbc4db52a3f9e SHA512 72e97a441463fff2760deb5557d2bbee82a5354b3db30e1ea34ea05bf349af0a46e0ff244e5ec212c8d2663ad79e660634733c3737ed853f5270c5c0427c902f
 DIST python-gentoo-patches-3.10.11.tar.xz 13984 BLAKE2B 00c682609876756f61d41f637d0354538823dd713c81f8a3a168d217c515d4559d24e1988c1796b2b920f3962f56e023758b292175d29d5348a87bd8b422f6e7 SHA512 f819113908bc689bb522d2cbe749c658a6b29e7f627718954b12797461a13781352b01f798e2f42b3741a0a0489049bf03405ead4ac8103a025dac11e72b0888
-DIST python-gentoo-patches-3.11.2_p2.tar.xz 8516 BLAKE2B 52bfdfac533ed53f32b8546c37a10b7019f3f0cd296b7929d3eb83fdc6a5e49c95515bb2ba56487b81e68701c586520db08e323ac1f49ef6f82da56010e21a28 SHA512 4388c0ae0bd25a002aed095d1db42076bcf6b7486955aa41c34ac41318e82eec686e8b9aac31ff766eed16edf3fb86fd333c448090240ba79bbc35e458a96dd0
 DIST python-gentoo-patches-3.11.3.tar.xz 7776 BLAKE2B 78bf26f554c608c68826b9ea3c63a1df2b45bff755860f39f14306ebb63f17f5111b117519c4a9cb30452a62a14a3a7393798b8920c3d108ec8b6a30db88641e SHA512 64b79c90055fd940590b72ffd3744fe02ab9e46caf7b46f4aa1d074bf3e62d355e128bb2ac68c42f228f2e1bcdee2b0b114d9e2b9bf8427512083c1c5f8680e8
-DIST python-gentoo-patches-3.12.0a6.tar.xz 5160 BLAKE2B 3149259ac54ee360714e6b24811cafcc25011b14427b24811831ea02aef044b1670b951976e5756938fdba0710e8b9c8465eeb6bcdea0b78a91bb586f8ae212a SHA512 aaeb4b4102e2d9116798b52d98cdb5955226b3e97b3ba7c9e319d4ea98c126faebbfac3c609436fde2eae75254205a3aa9644b1aafad95c44d52b754e72b031e
 DIST python-gentoo-patches-3.12.0a7.tar.xz 5168 BLAKE2B bfc249bf634deb3fab283c5d9a1710e35e6e7331f6a4f5c0d6b3795a3419adb7fa017117496966f7b3d7430d7564c66088cfd7cb8a2b8406776f42a5801960a7 SHA512 f806aa788f86d516bb23ad255edc24716a9385b3092e06e02e83617ef103b04878bb404081e7dded9c194dd6f2e4362bc2643b61076cb387b6070be3af391651
 DIST python-gentoo-patches-3.8.16_p4.tar.xz 32436 BLAKE2B 76984bbc04e5cf32d70853891967a33366dd28ca2cd47f3538ed1e9f4d39008d04c90f616d92112f5ec3468c42119089d195ee4d936536f8da4a772164aae221 SHA512 ad6d653fec3cce1f73db4b192f7e95b35ae2cf70aa8782d7b69f9d48eee240ef1cc32257a42bbb57f3952720df68b9976164a0b2748e36600332fba488383016
 DIST python-gentoo-patches-3.9.16_p3.tar.xz 27160 BLAKE2B 5a41a6ff135c3aca02b19cf9a61f554ca224173854274b872ce85e8c71f25c678604e50b87bae40d4b5ac082731c143338fcc6ef47acebad2b59ce0b1d600f5d SHA512 1ace0a9e929769c29082fdec6845a476c07c13fbbff8726a7a592fda09da8b50c996638b4e4e40acccb15630a796074329adbcc9a004c4305952fa5b0dc4146c
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.10_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.10_p3.ebuild
deleted file mode 100644
index 3f45df96fd..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.10_p3.ebuild
+++ /dev/null
@@ -1,488 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build +ensurepip examples gdbm hardened libedit lto
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind +xml
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	dev-lang/python-exec[python_targets_python3_10(-)]
-	dev-libs/libffi:=
-	dev-python/gentoo-common
-	sys-apps/util-linux:=
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-	xml? ( >=dev-libs/expat-2.1:= )
-	!!<sys-apps/sandbox-2.21
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	valgrind? ( dev-util/valgrind )
-	test? ( app-arch/xz-utils[extra-filters(+)] )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	sys-devel/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-	local disable
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	use xml       || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if ! use xml; then
-		ewarn "You have configured Python without XML support."
-		ewarn "This is NOT a recommended configuration as you"
-		ewarn "may face problems parsing any XML documents."
-	fi
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# https://bugs.gentoo.org/700012
-	if is-flagq -flto || is-flagq '-flto=*'; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-	fi
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--with-system-expat
-		--with-system-ffi
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with lto)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
-		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
-		local -x CFLAGS= LDFLAGS=
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
-		# Point the imminent CHOST build to the Python we just
-		# built for CBUILD.
-		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	emake DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.11.ebuild
index 36d2fa653f..c5dd75f190 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.11.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build +ensurepip examples gdbm hardened libedit lto
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind +xml
@@ -46,12 +46,12 @@ RDEPEND="
 	dev-lang/python-exec[python_targets_python3_10(-)]
 	dev-libs/libffi:=
 	dev-python/gentoo-common
-	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
 	ensurepip? ( dev-python/ensurepip-wheels )
 	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
 	ncurses? ( >=sys-libs/ncurses-5.2:= )
 	readline? (
 		!libedit? ( >=sys-libs/readline-4.1:= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.2_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.2_p2.ebuild
deleted file mode 100644
index ceddcc4e76..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.2_p2.ebuild
+++ /dev/null
@@ -1,517 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="
-	bluetooth build +ensurepip examples gdbm hardened libedit lto
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-python/gentoo-common
-	sys-apps/util-linux:=
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-	!!<sys-apps/sandbox-2.21
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils[extra-filters(+)] )
-	valgrind? ( dev-util/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	sys-devel/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( sec-keys/openpgp-keys-python )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	rm -r Modules/expat || die
-	rm -r Modules/_ctypes/libffi* || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# https://bugs.gentoo.org/850151
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs)
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local disable
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# https://bugs.gentoo.org/700012
-	if is-flagq -flto || is-flagq '-flto=*'; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-	fi
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--with-system-expat
-		--with-system-ffi
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with lto)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
-		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
-		local -x CFLAGS= LDFLAGS=
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross to satisfy --with-build-python.
-			--without-lto
-			--without-readline
-			--disable-optimizations
-		)
-
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__GDBM_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__SQLITE3_STATE=disabled
-			MODULE__HASHLIB_STATE=disabled
-			MODULE__SSL_STATE=disabled
-			MODULE__CURSES_STATE=disabled
-			MODULE__CURSES_PANEL_STATE=disabled
-			MODULE_READLINE_STATE=disabled
-			MODULE__TKINTER_STATE=disabled
-			MODULE_PYEXPAT_STATE=disabled
-			MODULE_ZLIB_STATE=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the --with-build-python value
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.3.ebuild
index f575d640f0..fed1bebc47 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.3.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="
 	bluetooth build +ensurepip examples gdbm hardened libedit lto
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
@@ -47,12 +47,12 @@ RDEPEND="
 	>=dev-libs/expat-2.1:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
-	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
 	ensurepip? ( dev-python/ensurepip-wheels )
 	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
 	ncurses? ( >=sys-libs/ncurses-5.2:= )
 	readline? (
 		!libedit? ( >=sys-libs/readline-4.1:= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha6.ebuild
deleted file mode 100644
index abbc74ddf6..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha6.ebuild
+++ /dev/null
@@ -1,512 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
-inherit prefix python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_alpha/a}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="
-	https://www.python.org/
-	https://github.com/python/cpython/
-"
-SRC_URI="
-	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
-	)
-"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-IUSE="
-	bluetooth build +ensurepip examples gdbm hardened libedit lto
-	+ncurses pgo +readline +sqlite +ssl test tk valgrind
-"
-RESTRICT="!test? ( test )"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-RDEPEND="
-	app-arch/bzip2:=
-	app-arch/xz-utils:=
-	app-crypt/libb2
-	>=dev-libs/expat-2.1:=
-	dev-libs/libffi:=
-	dev-python/gentoo-common
-	sys-apps/util-linux:=
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl
-	ensurepip? ( dev-python/ensurepip-wheels )
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? (
-		!libedit? ( >=sys-libs/readline-4.1:= )
-		libedit? ( dev-libs/libedit:= )
-	)
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-	!!<sys-apps/sandbox-2.21
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils[extra-filters(+)] )
-	valgrind? ( dev-util/valgrind )
-"
-# autoconf-archive needed to eautoreconf
-BDEPEND="
-	sys-devel/autoconf-archive
-	app-alternatives/awk
-	virtual/pkgconfig
-	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
-"
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
-if [[ ${PV} != *_alpha* ]]; then
-	RDEPEND+="
-		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
-	"
-fi
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-QA_PKGCONFIG_VERSION=${PYVER}
-# false positives -- functions specific to *BSD
-QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
-
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of expat and libffi are not used.
-	# TODO: Makefile has annoying deps on expat headers
-	#rm -r Modules/expat || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	# force the correct number of jobs
-	# https://bugs.gentoo.org/737660
-	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local disable
-	# disable automagic bluetooth headers detection
-	if ! use bluetooth; then
-		local -x ac_cv_header_bluetooth_bluetooth_h=no
-	fi
-
-	append-flags -fwrapv
-	filter-flags -malign-double
-
-	# https://bugs.gentoo.org/700012
-	if is-flagq -flto || is-flagq '-flto=*'; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-	fi
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	# PKG_CONFIG needed for cross.
-	tc-export CXX PKG_CONFIG
-
-	local dbmliborder=
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local profile_task_flags=(
-			-m test
-			"-j$(makeopts_jobs)"
-			--pgo-extended
-			-x test_gdb
-			-u-network
-
-			# All of these seem to occasionally hang for PGO inconsistently
-			# They'll even hang here but be fine in src_test sometimes.
-			# bug #828535 (and related: bug #788022)
-			-x test_asyncio
-			-x test_httpservers
-			-x test_logging
-			-x test_multiprocessing_fork
-			-x test_socket
-			-x test_xmlrpc
-		)
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			profile_task_flags+=(
-				-x test_distutils
-			)
-		fi
-		local -x PROFILE_TASK="${profile_task_flags[*]}"
-	fi
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--enable-shared
-		--without-static-libpython
-		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--with-system-expat
-		--with-platlibdir=lib
-		--with-pkg-config=yes
-		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
-
-		$(use_with lto)
-		$(use_enable pgo optimizations)
-		$(use_with readline readline "$(usex libedit editline readline)")
-		$(use_with valgrind)
-	)
-
-	# disable implicit optimization/debugging flags
-	local -x OPT=
-
-	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		local -x CFLAGS_NODIST=${CFLAGS_FOR_BUILD}
-		local -x LDFLAGS_NODIST=${LDFLAGS_FOR_BUILD}
-		local -x CFLAGS= LDFLAGS=
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross to satisfy --with-build-python.
-			--without-lto
-			--without-readline
-			--disable-optimizations
-		)
-
-		myeconfargs+=(
-			# Point the imminent CHOST build to the Python we just
-			# built for CBUILD.
-			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
-		)
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__GDBM_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__SQLITE3_STATE=disabled
-			MODULE__HASHLIB_STATE=disabled
-			MODULE__SSL_STATE=disabled
-			MODULE__CURSES_STATE=disabled
-			MODULE__CURSES_PANEL_STATE=disabled
-			MODULE_READLINE_STATE=disabled
-			MODULE__TKINTER_STATE=disabled
-			MODULE_PYEXPAT_STATE=disabled
-			MODULE_ZLIB_STATE=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the --with-build-python value
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
-	fi
-
-	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-	# propagated to sysconfig for built extensions
-	local -x CFLAGS_NODIST=${CFLAGS}
-	local -x LDFLAGS_NODIST=${LDFLAGS}
-	local -x CFLAGS= LDFLAGS=
-
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	if use ncurses; then
-		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-	fi
-
-	hprefixify setup.py
-	econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-
-	# force-disable modules we don't want built
-	local disable_modules=( NIS )
-	use gdbm || disable_modules+=( _GDBM _DBM )
-	use sqlite || disable_modules+=( _SQLITE3 )
-	use ssl || disable_modules+=( _HASHLIB _SSL )
-	use ncurses || disable_modules+=( _CURSES _CURSES_PANEL )
-	use readline || disable_modules+=( READLINE )
-	use tk || disable_modules+=( _TKINTER )
-
-	local mod
-	for mod in "${disable_modules[@]}"; do
-		echo "MODULE_${mod}_STATE=disabled"
-	done >> Makefile || die
-
-	# install epython.py as part of stdlib
-	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	export PYTHONSTRICTEXTENSIONBUILD=1
-
-	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
-	# end up writing bytecode & violating sandbox.
-	# bug #831897
-	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
-
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict "/usr/lib/python${PYVER}/site-packages"
-	fi
-
-	# also need to clear the flags explicitly here or they end up
-	# in _sysconfigdata*
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-
-	# Restore saved value from above.
-	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# this just happens to skip test_support.test_freeze that is broken
-	# without bundled expat
-	# TODO: get a proper skip for it upstream
-	local -x LOGNAME=buildbot
-
-	local test_opts=(
-		-u-network
-		-j "$(makeopts_jobs)"
-
-		# fails
-		-x test_gdb
-	)
-
-	if use sparc ; then
-		# bug #788022
-		test_opts+=(
-			-x test_multiprocessing_fork
-			-x test_multiprocessing_forkserver
-		)
-	fi
-
-	# workaround docutils breaking tests
-	cat > Lib/docutils.py <<-EOF || die
-		raise ImportError("Thou shalt not import!")
-	EOF
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-	# workaround https://bugs.gentoo.org/775416
-	addwrite "/usr/lib/python${PYVER}/site-packages"
-
-	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local ret=${?}
-
-	rm Lib/docutils.py || die
-
-	[[ ${ret} -eq 0 ]] || die "emake test failed"
-}
-
-src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
-
-	# the Makefile rules are broken
-	# https://github.com/python/cpython/issues/100221
-	mkdir -p "${libdir}"/lib-dynload || die
-
-	# -j1 hack for now for bug #843458
-	emake -j1 DESTDIR="${D}" altinstall
-
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
-
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
-
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	rm -r "${libdir}"/ensurepip/_bundled || die
-	if ! use ensurepip; then
-		rm -r "${libdir}"/ensurepip || die
-	fi
-	if ! use sqlite; then
-		rm -r "${libdir}/"sqlite3 || die
-	fi
-	if ! use tk; then
-		rm -r "${ED}/usr/bin/idle${PYVER}" || die
-		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-	fi
-
-	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(
-		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
-		emake --no-print-directory -s -f - 2>/dev/null
-	)
-	newins Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local EPYTHON=python${PYVER}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
-	fi
-}
-
-pkg_postinst() {
-	local v
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
-			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
-			ewarn "installed previously are no longer valid and will be regenerated"
-			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
-			ewarn "when installing some packages and checksum mismatches when removing"
-			ewarn "old versions.  To actively prevent this, rebuild all packages"
-			ewarn "installing Python 3.11 modules, e.g. using:"
-			ewarn
-			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha7.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha7.ebuild
index d5837ceffb..95d394d31c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_alpha7.ebuild
@@ -47,12 +47,12 @@ RDEPEND="
 	>=dev-libs/expat-2.1:=
 	dev-libs/libffi:=
 	dev-python/gentoo-common
-	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
 	ensurepip? ( dev-python/ensurepip-wheels )
 	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
 	ncurses? ( >=sys-libs/ncurses-5.2:= )
 	readline? (
 		!libedit? ( >=sys-libs/readline-4.1:= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.16_p4.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.16_p4.ebuild
index 76995741c6..9c310fbeef 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.16_p4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.16_p4.ebuild
@@ -44,12 +44,12 @@ RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	dev-libs/libffi:=
-	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
 	ensurepip? ( dev-python/ensurepip-wheels )
 	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
 	ncurses? ( >=sys-libs/ncurses-5.2:= )
 	readline? ( >=sys-libs/readline-4.1:= )
 	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3-r1.ebuild
index 618909e14b..d40463a1e9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.16_p3-r1.ebuild
@@ -43,15 +43,14 @@ RESTRICT="!test? ( test )"
 RDEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
-	dev-lang/python-exec[python_targets_python3_9(-)]
 	dev-libs/libffi:=
 	dev-python/gentoo-common
-	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
 	ensurepip? ( dev-python/ensurepip-wheels )
 	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
 	ncurses? ( >=sys-libs/ncurses-5.2:= )
 	readline? ( >=sys-libs/readline-4.1:= )
 	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/boost/Manifest
index 9789dbd925..4c89701f99 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/boost/Manifest
@@ -1,3 +1,2 @@
-DIST boost_1_80_0.tar.bz2 115869904 BLAKE2B 507e811be7659442c41bc2d99811bd02a236dc94932e1a7a8cf256243b479f2d2707819cd99e016a51c9dadc215713e803afdd9ea4c105af8d5d2d28d3d06a1f SHA512 829a95b463473d69ff79ea41799c68429bb79d3b2321fbdb71df079af237ab01de9ad7e9612d8783d925730acada010068d2d1aa856c34244ee5c0ece16f208f
 DIST boost_1_81_0.tar.bz2 118797750 BLAKE2B ae57247fb80ee5a952881a99bdbe9a1d5622690879ef59053716647dc1121e70fdd322251837387b43357f1cd63c6d1ba285cf35c0c40e4f5ee28a929d7eacf7 SHA512 a04201e73da59f68fa02761b333c864a96ebaf268247b6b10cb19ed3d70ee9ad3da4c53123f2a7a4a9b9e1408793b51e1adbcc6fd09f60fecef3ca9522bb6b36
 DIST boost_1_82_0.tar.bz2 121325129 BLAKE2B 16ee164ce7114d8134c861b3652c842750cec63ab0e79e4386d8cb9c56f7a454f9a9cfa75f25d9132a8d8d9e6f39d32a8e7535f83f52f355bbc40ef530163fa5 SHA512 6fddc452ca67f99f5c181e21c73d96feb7346e10886477c91b4abc2cdf447750599e0d42f935ef591222200ef6c033de078a7ad2bb577c81fa56a249b17420cb
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.80.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.80.0-r1.ebuild
deleted file mode 100644
index 89992f5452..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.80.0-r1.ebuild
+++ /dev/null
@@ -1,343 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit flag-o-matic multiprocessing python-r1 toolchain-funcs multilib-minimal
-
-MY_PV="$(ver_rs 1- _)"
-
-DESCRIPTION="Boost Libraries for C++"
-HOMEPAGE="https://www.boost.org/"
-SRC_URI="https://boostorg.jfrog.io/artifactory/main/release/${PV}/source/boost_${MY_PV}.tar.bz2"
-S="${WORKDIR}/${PN}_${MY_PV}"
-
-LICENSE="Boost-1.0"
-SLOT="0/${PV}" # ${PV} instead of the major version due to bug 486122
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
-IUSE="bzip2 context debug doc icu lzma +nls mpi numpy python tools zlib zstd"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-# the tests will never fail because these are not intended as sanity
-# tests at all. They are more a way for upstream to check their own code
-# on new compilers. Since they would either be completely unreliable
-# (failing for no good reason) or completely useless (never failing)
-# there is no point in having them in the ebuild to begin with.
-RESTRICT="test"
-
-RDEPEND="
-	!<dev-libs/leatherman-1.12.0-r1
-	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
-	icu? ( >=dev-libs/icu-3.6:=[${MULTILIB_USEDEP}] )
-	!icu? ( virtual/libiconv[${MULTILIB_USEDEP}] )
-	lzma? ( app-arch/xz-utils:=[${MULTILIB_USEDEP}] )
-	mpi? ( >=virtual/mpi-2.0-r4[${MULTILIB_USEDEP},cxx,threads] )
-	python? (
-		${PYTHON_DEPS}
-		numpy? ( dev-python/numpy[${PYTHON_USEDEP}] )
-	)
-	zlib? ( sys-libs/zlib:=[${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}"
-BDEPEND=">=dev-util/b2-4.9.2"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.80.0-disable_icu_rpath.patch
-	"${FILESDIR}"/${PN}-1.79.0-context-x32.patch
-	"${FILESDIR}"/${PN}-1.79.0-build-auto_index-tool.patch
-	# Boost.MPI's __init__.py doesn't work on Py3
-	"${FILESDIR}"/${PN}-1.79.0-boost-mpi-python-PEP-328.patch
-	"${FILESDIR}"/${PN}-1.80.0-fix-mips1-transition.patch
-	# (upstreamed)
-	"${FILESDIR}"/${PN}-1.80.0-unordered-fix.patch
-	"${FILESDIR}"/${PN}-1.80.0-unary-function.patch
-	"${FILESDIR}"/${PN}-1.80.0-python3.11.patch
-	"${FILESDIR}"/${PN}-1.80.0-unordered-ftm-malloc.patch
-)
-
-python_bindings_needed() {
-	multilib_is_native_abi && use python
-}
-
-tools_needed() {
-	multilib_is_native_abi && use tools
-}
-
-create_user-config.jam() {
-	local user_config_jam="${BUILD_DIR}"/user-config.jam
-	if [[ -s ${user_config_jam} ]]; then
-		einfo "${user_config_jam} already exists, skipping configuration"
-		return
-	else
-		einfo "Creating configuration in ${user_config_jam}"
-	fi
-
-	local compiler compiler_version compiler_executable="$(tc-getCXX)"
-	if [[ ${CHOST} == *-darwin* ]]; then
-		compiler="darwin"
-		compiler_version="$(gcc-fullversion)"
-	else
-		compiler="gcc"
-		compiler_version="$(gcc-version)"
-	fi
-
-	if use mpi; then
-		local mpi_configuration="using mpi ;"
-	fi
-
-	cat > "${user_config_jam}" <<- __EOF__ || die
-		using ${compiler} : ${compiler_version} : ${compiler_executable} : <cflags>"${CFLAGS}" <cxxflags>"${CXXFLAGS}" <linkflags>"${LDFLAGS}" <archiver>"$(tc-getAR)" <ranlib>"$(tc-getRANLIB)" ;
-		${mpi_configuration}
-	__EOF__
-
-	if python_bindings_needed; then
-		append_to_user_config() {
-			local py_config
-			if tc-is-cross-compiler; then
-				py_config="using python : ${EPYTHON#python} : : ${ESYSROOT}/usr/include/${EPYTHON} : ${ESYSROOT}/usr/$(get_libdir) ;"
-			else
-				py_config="using python : ${EPYTHON#python} : ${PYTHON} : $(python_get_includedir) ;"
-			fi
-			echo "${py_config}" >> "${user_config_jam}" || die
-		}
-		python_foreach_impl append_to_user_config
-	fi
-
-	if python_bindings_needed && use numpy; then
-		einfo "Enabling support for NumPy extensions in Boost.Python"
-	else
-		einfo "Disabling support for NumPy extensions in Boost.Python"
-
-		# Boost.Build does not allow for disabling of numpy
-		# extensions, thereby leading to automagic numpy
-		# https://github.com/boostorg/python/issues/111#issuecomment-280447482
-		sed \
-			-e 's/\[ unless \[ python\.numpy \] : <build>no \]/<build>no/g' \
-			-i "${BUILD_DIR}"/libs/python/build/Jamfile || die
-	fi
-}
-
-pkg_setup() {
-	# Bail out on unsupported build configuration, bug #456792
-	if [[ -f "${EROOT}"/etc/site-config.jam ]]; then
-		if ! grep -q 'gentoo\(debug\|release\)' "${EROOT}"/etc/site-config.jam; then
-			eerror "You are using custom ${EROOT}/etc/site-config.jam without defined gentoorelease/gentoodebug targets."
-			eerror "Boost can not be built in such configuration."
-			eerror "Please, either remove this file or add targets from ${EROOT}/usr/share/boost-build/site-config.jam to it."
-			die "Unsupported target in ${EROOT}/etc/site-config.jam"
-		fi
-	fi
-}
-
-src_prepare() {
-	default
-	multilib_copy_sources
-}
-
-ejam() {
-	create_user-config.jam
-
-	local b2_opts=( "--user-config=${BUILD_DIR}/user-config.jam" )
-	if python_bindings_needed; then
-		append_to_b2_opts() {
-			b2_opts+=( python="${EPYTHON#python}" )
-		}
-		python_foreach_impl append_to_b2_opts
-	else
-		b2_opts+=( --without-python )
-	fi
-	b2_opts+=( "$@" )
-
-	echo b2 "${b2_opts[@]}" >&2
-	b2 "${b2_opts[@]}"
-}
-
-src_configure() {
-	# Workaround for too many parallel processes requested, bug #506064
-	[[ "$(makeopts_jobs)" -gt 64 ]] && MAKEOPTS="${MAKEOPTS} -j64"
-
-	# We don't want to end up with -L/usr/lib on our linker lines
-	# which then gives us lots of
-	#   skipping incompatible /usr/lib/libc.a when searching for -lc
-	# warnings
-	[[ -n ${ESYSROOT} ]] && local icuarg="-sICU_PATH=${ESYSROOT}/usr"
-
-	OPTIONS=(
-		$(usex debug gentoodebug gentoorelease)
-		"-j$(makeopts_jobs)"
-		-q
-		-d+2
-		pch=off
-		$(usex icu "${icuarg}" '--disable-icu boost.locale.icu=off')
-		$(usev !mpi --without-mpi)
-		$(usev !nls --without-locale)
-		$(usev !context '--without-context --without-coroutine --without-fiber')
-		--without-stacktrace
-		--boost-build="${BROOT}"/usr/share/b2/src
-		--layout=system
-		# building with threading=single is currently not possible
-		# https://svn.boost.org/trac/boost/ticket/7105
-		threading=multi
-		link=shared
-		# this seems to be the only way to disable compression algorithms
-		# https://www.boost.org/doc/libs/1_70_0/libs/iostreams/doc/installation.html#boost-build
-		-sNO_BZIP2=$(usex bzip2 0 1)
-		-sNO_LZMA=$(usex lzma 0 1)
-		-sNO_ZLIB=$(usex zlib 0 1)
-		-sNO_ZSTD=$(usex zstd 0 1)
-	)
-
-	if [[ ${CHOST} == *-darwin* ]]; then
-		# We need to add the prefix, and in two cases this exceeds, so prepare
-		# for the largest possible space allocation.
-		append-ldflags -Wl,-headerpad_max_install_names
-	fi
-
-	# Use C++17 globally as of 1.80
-	append-cxxflags -std=c++17
-}
-
-multilib_src_compile() {
-	ejam \
-		--prefix="${EPREFIX}"/usr \
-		"${OPTIONS[@]}" || die
-
-	if tools_needed; then
-		pushd tools >/dev/null || die
-		ejam \
-			--prefix="${EPREFIX}"/usr \
-			"${OPTIONS[@]}" \
-			|| die "Building of Boost tools failed"
-		popd >/dev/null || die
-	fi
-}
-
-multilib_src_install() {
-	ejam \
-		--prefix="${ED}"/usr \
-		--includedir="${ED}"/usr/include \
-		--libdir="${ED}"/usr/$(get_libdir) \
-		"${OPTIONS[@]}" install || die "Installation of Boost libraries failed"
-
-	if tools_needed; then
-		dobin dist/bin/*
-
-		insinto /usr/share
-		doins -r dist/share/boostbook
-	fi
-
-	# boost's build system truely sucks for not having a destdir.  Because for
-	# this reason we are forced to build with a prefix that includes the
-	# DESTROOT, dynamic libraries on Darwin end messed up, referencing the
-	# DESTROOT instread of the actual EPREFIX.  There is no way out of here
-	# but to do it the dirty way of manually setting the right install_names.
-	if [[ ${CHOST} == *-darwin* ]]; then
-		einfo "Working around completely broken build-system(tm)"
-		local d
-		for d in "${ED}"/usr/lib/*.dylib; do
-			if [[ -f ${d} ]]; then
-				# fix the "soname"
-				ebegin "  correcting install_name of ${d#${ED}}"
-				install_name_tool -id "/${d#${D}}" "${d}"
-				eend $?
-				# fix references to other libs
-				refs=$(otool -XL "${d}" | \
-					sed -e '1d' -e 's/^\t//' | \
-					grep "^libboost_" | \
-					cut -f1 -d' ')
-				local r
-				for r in ${refs}; do
-					ebegin "    correcting reference to ${r}"
-					install_name_tool -change \
-						"${r}" \
-						"${EPREFIX}/usr/lib/${r}" \
-						"${d}"
-					eend $?
-				done
-			fi
-		done
-	fi
-}
-
-multilib_src_install_all() {
-	if ! use numpy; then
-		rm -r "${ED}"/usr/include/boost/python/numpy* || die
-	fi
-
-	if use python; then
-		if use mpi; then
-			move_mpi_py_into_sitedir() {
-				python_moduleinto boost
-				python_domodule "${S}"/libs/mpi/build/__init__.py
-
-				python_domodule "${ED}"/usr/$(get_libdir)/boost-${EPYTHON}/mpi.so
-				rm -r "${ED}"/usr/$(get_libdir)/boost-${EPYTHON} || die
-
-				python_optimize
-			}
-			python_foreach_impl move_mpi_py_into_sitedir
-		else
-			rm -r "${ED}"/usr/include/boost/mpi/python* || die
-		fi
-	else
-		rm -r "${ED}"/usr/include/boost/{python*,mpi/python*,parameter/aux_/python,parameter/python*} || die
-	fi
-
-	if ! use nls; then
-		rm -r "${ED}"/usr/include/boost/locale || die
-	fi
-
-	if ! use context; then
-		rm -r "${ED}"/usr/include/boost/context || die
-		rm -r "${ED}"/usr/include/boost/coroutine{,2} || die
-		rm "${ED}"/usr/include/boost/asio/spawn.hpp || die
-	fi
-
-	if use doc; then
-		# find extraneous files that shouldn't be installed
-		# as part of the documentation and remove them.
-		find libs/*/* \( -iname 'test' -o -iname 'src' \) -exec rm -rf '{}' + || die
-		find doc \( -name 'Jamfile.v2' -o -name 'build' -o -name '*.manifest' \) -exec rm -rf '{}' + || die
-		find tools \( -name 'Jamfile.v2' -o -name 'src' -o -name '*.cpp' -o -name '*.hpp' \) -exec rm -rf '{}' + || die
-
-		docinto html
-		dodoc *.{htm,html,png,css}
-		dodoc -r doc libs more tools
-
-		# To avoid broken links
-		dodoc LICENSE_1_0.txt
-
-		dosym ../../../../include/boost /usr/share/doc/${PF}/html/boost
-	fi
-}
-
-pkg_preinst() {
-	# Yay for having symlinks that are nigh-impossible to remove without
-	# resorting to dirty hacks like these. Removes lingering symlinks
-	# from the slotted versions.
-	local symlink
-	for symlink in "${EROOT}"/usr/include/boost "${EROOT}"/usr/share/boostbook; do
-		if [[ -L ${symlink} ]]; then
-			rm -f "${symlink}" || die
-		fi
-	done
-
-	# some ancient installs still have boost cruft lying around
-	# for unknown reasons, causing havoc for reverse dependencies
-	# Bug: 607734
-	rm -rf "${EROOT}"/usr/include/boost-1_[3-5]? || die
-}
-
-pkg_postinst() {
-	elog "Boost.Regex is *extremely* ABI sensitive. If you get errors such as"
-	elog
-	elog "  undefined reference to \`boost::re_detail_$(ver_cut 1)0$(ver_cut 2)00::cpp_regex_traits_implementation"
-	elog "    <char>::transform_primary[abi:cxx11](char const*, char const*) const'"
-	elog
-	elog "Then you need to recompile Boost and all its reverse dependencies"
-	elog "using the same toolchain. In general, *every* change of the C++ toolchain"
-	elog "requires a complete rebuild of the Boost-dependent ecosystem."
-	elog
-	elog "See for instance https://bugs.gentoo.org/638138"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0-r1.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0-r1.ebuild
index efe85c3319..f257063c37 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/boost/boost-1.82.0-r1.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/${PN}_${MY_PV}"
 
 LICENSE="Boost-1.0"
 SLOT="0/${PV}" # ${PV} instead of the major version due to bug 486122
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
 IUSE="bzip2 context debug doc icu lzma +nls mpi numpy python tools zlib zstd"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 # the tests will never fail because these are not intended as sanity
@@ -51,6 +51,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-1.81.0-phoenix-multiple-definitions.patch
 
 	# (upstreamed)
+	"${FILESDIR}"/${PN}-1.82.0-context-arm64.patch
 )
 
 python_bindings_needed() {
@@ -71,13 +72,8 @@ create_user-config.jam() {
 	fi
 
 	local compiler compiler_version compiler_executable="$(tc-getCXX)"
-	if [[ ${CHOST} == *-darwin* ]]; then
-		compiler="darwin"
-		compiler_version="$(gcc-fullversion)"
-	else
-		compiler="gcc"
-		compiler_version="$(gcc-version)"
-	fi
+	compiler="gcc"
+	compiler_version="$(gcc-version)"
 
 	if use mpi; then
 		local mpi_configuration="using mpi ;"
@@ -194,8 +190,15 @@ src_configure() {
 	# Use C++17 globally as of 1.80
 	append-cxxflags -std=c++17
 
-	# need to enable LFS explicitly for 64-bit offsets on 32-bit hosts (#894564)
-	append-lfs-flags
+	if [[ ${CHOST} != *-darwin* ]]; then
+		# On modern macOS, file I/O is already 64-bit by default,
+		# there's no support for special options like O_LARGEFILE.
+		# Thus, LFS must be disabled.
+		#
+		# On other systems, we need to enable LFS explicitly for 64-bit
+		# offsets on 32-bit hosts (#894564)
+		append-lfs-flags
+	fi
 }
 
 multilib_src_compile() {
@@ -242,16 +245,24 @@ multilib_src_install() {
 				install_name_tool -id "/${d#${D}}" "${d}"
 				eend $?
 				# fix references to other libs
+				# these paths look like this:
+				# bin.v2/libs/thread/build/gcc-12.1/gentoorelease/pch-off/
+				#  threadapi-pthread/threading-multi/visibility-hidden/
+				#  libboost_thread.dylib
 				refs=$(otool -XL "${d}" | \
 					sed -e '1d' -e 's/^\t//' | \
-					grep "^libboost_" | \
+					grep "libboost_" | \
 					cut -f1 -d' ')
 				local r
 				for r in ${refs}; do
-					ebegin "    correcting reference to ${r}"
+					# strip path prefix from references, so we obtain
+					# something like libboost_thread.dylib.
+					local r_basename=${r##*/}
+
+					ebegin "    correcting reference to ${r_basename}"
 					install_name_tool -change \
 						"${r}" \
-						"${EPREFIX}/usr/lib/${r}" \
+						"${EPREFIX}/usr/lib/${r_basename}" \
 						"${d}"
 					eend $?
 				done
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-disable_icu_rpath.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-disable_icu_rpath.patch
deleted file mode 100644
index 1f4ec29fcf..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-disable_icu_rpath.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/libs/locale/build/Jamfile.v2
-+++ b/libs/locale/build/Jamfile.v2
-@@ -82,8 +82,8 @@ ICU_LINK ?= [ modules.peek : ICU_LINK_LOCALE ] ;
- 
- if $(ICU_LINK)
- {
--    ICU_OPTS = <include>$(icu-path)/include <linkflags>$(ICU_LINK) <dll-path>$(icu-path)/bin <runtime-link>shared ;
--    ICU64_OPTS = <include>$(icu-path)/include <linkflags>$(ICU_LINK) <dll-path>$(icu-path)/bin64 <runtime-link>shared ;
-+    ICU_OPTS = <include>$(icu_path)/include <linkflags>$(ICU_LINK) <runtime-link>shared ;
-+    ICU64_OPTS = <include>$(icu_path)/include <linkflags>$(ICU_LINK) <runtime-link>shared ;
- } else
- {
-     searched-lib icuuc : :  <name>icuuc
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-python3.11.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-python3.11.patch
deleted file mode 100644
index cdbc36ca95..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-python3.11.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-https://github.com/boostorg/python/commit/a218babc8daee904a83f550fb66e5cb3f1cb3013
-https://github.com/boostorg/python/pull/385
-
-From a218babc8daee904a83f550fb66e5cb3f1cb3013 Mon Sep 17 00:00:00 2001
-From: Victor Stinner <vstinner@python.org>
-Date: Mon, 25 Apr 2022 10:51:46 +0200
-Subject: [PATCH] Fix enum_type_object type on Python 3.11
-
-The enum_type_object type inherits from PyLong_Type which is not tracked
-by the GC. Instances doesn't have to be tracked by the GC: remove the
-Py_TPFLAGS_HAVE_GC flag.
-
-The Python C API documentation says:
-
-    "To create a container type, the tp_flags field of the type object
-    must include the Py_TPFLAGS_HAVE_GC and provide an implementation of
-    the tp_traverse handler."
-
-https://docs.python.org/dev/c-api/gcsupport.html
-
-The new exception was introduced in Python 3.11 by:
-https://github.com/python/cpython/issues/88429
---- a/libs/python/src/object/enum.cpp
-+++ b/libs/python/src/object/enum.cpp
-@@ -113,7 +113,6 @@ static PyTypeObject enum_type_object = {
- #if PY_VERSION_HEX < 0x03000000
-     | Py_TPFLAGS_CHECKTYPES
- #endif
--    | Py_TPFLAGS_HAVE_GC
-     | Py_TPFLAGS_BASETYPE,                  /* tp_flags */
-     0,                                      /* tp_doc */
-     0,                                      /* tp_traverse */
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unary-function.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unary-function.patch
deleted file mode 100644
index 7941d7c663..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unary-function.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-https://bugs.gentoo.org/869401
-https://github.com/boostorg/config/commit/f0af4a9184457939b89110795ae2d293582c5f66
-https://github.com/boostorg/container_hash/issues/24
-
-From: jzmaddock <john@johnmaddock.co.uk>
-Date: Mon, 11 Jul 2022 18:26:07 +0100
-Subject: [PATCH] The std lib unary/binary_function base classes are
- deprecated/removed from libcpp15. Fixes
- https://github.com/boostorg/container_hash/issues/24.
-
---- a/boost/config/stdlib/libcpp.hpp
-+++ b/boost/config/stdlib/libcpp.hpp
-@@ -168,4 +168,13 @@
- #  define BOOST_NO_CXX14_HDR_SHARED_MUTEX
- #endif
- 
-+#if _LIBCPP_VERSION >= 15000
-+//
-+// Unary function is now deprecated in C++11 and later:
-+//
-+#if __cplusplus >= 201103L
-+#define BOOST_NO_CXX98_FUNCTION_BASE
-+#endif
-+#endif
-+
- //  --- end ---
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-fix.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-fix.patch
deleted file mode 100644
index 5177609438..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-fix.patch
+++ /dev/null
@@ -1,192 +0,0 @@
-From f9eae4153f4ea9aac4b6c46e660ec92824d5827f Mon Sep 17 00:00:00 2001
-From: Christian Mazakas <christian.mazakas@gmail.com>
-Date: Tue, 16 Aug 2022 14:34:58 -0700
-Subject: [PATCH] Update code to be valid when the internal `buckets_` data
- member is moved-from
-
----
- boost/unordered/detail/fca.hpp        | 18 +++++--
- .../boost/unordered/detail/implementation.hpp | 49 +++++++++++--------
- boost/unordered/unordered_map.hpp     |  8 +++
- boost/unordered/unordered_set.hpp     |  8 +++
- 4 files changed, 58 insertions(+), 25 deletions(-)
-
-diff --git a/boost/unordered/detail/fca.hpp b/boost/unordered/detail/fca.hpp
-index 19fafe739..a1d14d957 100644
---- a/boost/unordered/detail/fca.hpp
-+++ b/boost/unordered/detail/fca.hpp
-@@ -646,7 +646,7 @@ namespace boost {
- 
-         size_type bucket_count() const { return size_; }
- 
--        iterator begin() const { return ++at(size_); }
-+        iterator begin() const { return size_ == 0 ? end() : ++at(size_); }
- 
-         iterator end() const
-         {
-@@ -660,6 +660,10 @@ namespace boost {
- 
-         local_iterator begin(size_type n) const
-         {
-+          if (size_ == 0) {
-+            return this->end(n);
-+          }
-+
-           return local_iterator(
-             (buckets + static_cast<difference_type>(n))->next);
-         }
-@@ -670,12 +674,16 @@ namespace boost {
- 
-         iterator at(size_type n) const
-         {
--          std::size_t const N = group::N;
-+          if (size_ > 0) {
-+            std::size_t const N = group::N;
- 
--          iterator pbg(buckets + static_cast<difference_type>(n),
--            groups + static_cast<difference_type>(n / N));
-+            iterator pbg(buckets + static_cast<difference_type>(n),
-+              groups + static_cast<difference_type>(n / N));
- 
--          return pbg;
-+            return pbg;
-+          } else {
-+            return this->end();
-+          }
-         }
- 
-         span<Bucket> raw()
-diff --git a/boost/unordered/detail/implementation.hpp b/boost/unordered/detail/implementation.hpp
-index 2cc27c5d4..373236754 100644
---- a/boost/unordered/detail/implementation.hpp
-+++ b/boost/unordered/detail/implementation.hpp
-@@ -2054,12 +2054,14 @@ namespace boost {
- 
-         std::size_t bucket_size(std::size_t index) const
-         {
--          bucket_iterator itb = buckets_.at(index);
--          node_pointer n = itb->next;
-           std::size_t count = 0;
--          while (n) {
--            ++count;
--            n = n->next;
-+          if (size_ > 0) {
-+            bucket_iterator itb = buckets_.at(index);
-+            node_pointer n = itb->next;
-+            while (n) {
-+              ++count;
-+              n = n->next;
-+            }
-           }
-           return count;
-         }
-@@ -2420,11 +2422,14 @@ namespace boost {
-         node_pointer find_node_impl(
-           Key const& x, bucket_iterator itb) const
-         {
--          key_equal const& pred = this->key_eq();
--          node_pointer p = itb->next;
--          for (; p; p = p->next) {
--            if (pred(x, extractor::extract(p->value()))) {
--              break;
-+          node_pointer p = node_pointer();
-+          if (itb != buckets_.end()) {
-+            key_equal const& pred = this->key_eq();
-+            p = itb->next;
-+            for (; p; p = p->next) {
-+              if (pred(x, extractor::extract(p->value()))) {
-+                break;
-+              }
-             }
-           }
-           return p;
-@@ -2453,11 +2458,13 @@ namespace boost {
-         inline iterator transparent_find(
-           Key const& k, Hash const& h, Pred const& pred) const
-         {
--          std::size_t const key_hash = h(k);
--          bucket_iterator itb = buckets_.at(buckets_.position(key_hash));
--          for (node_pointer p = itb->next; p; p = p->next) {
--            if (BOOST_LIKELY(pred(k, extractor::extract(p->value())))) {
--              return iterator(p, itb);
-+          if (size_ > 0) {
-+            std::size_t const key_hash = h(k);
-+            bucket_iterator itb = buckets_.at(buckets_.position(key_hash));
-+            for (node_pointer p = itb->next; p; p = p->next) {
-+              if (BOOST_LIKELY(pred(k, extractor::extract(p->value())))) {
-+                return iterator(p, itb);
-+              }
-             }
-           }
- 
-@@ -2467,11 +2474,13 @@ namespace boost {
-         template <class Key>
-         node_pointer* find_prev(Key const& key, bucket_iterator itb)
-         {
--          key_equal pred = this->key_eq();
--          for (node_pointer* pp = boost::addressof(itb->next); *pp;
--               pp = boost::addressof((*pp)->next)) {
--            if (pred(key, extractor::extract((*pp)->value()))) {
--              return pp;
-+          if (size_ > 0) {
-+            key_equal pred = this->key_eq();
-+            for (node_pointer* pp = boost::addressof(itb->next); *pp;
-+                pp = boost::addressof((*pp)->next)) {
-+              if (pred(key, extractor::extract((*pp)->value()))) {
-+                return pp;
-+              }
-             }
-           }
-           typedef node_pointer* node_pointer_pointer;
-diff --git a/boost/unordered/unordered_map.hpp b/boost/unordered/unordered_map.hpp
-index 97908fb65..3e25a28a2 100644
---- a/boost/unordered/unordered_map.hpp
-+++ b/boost/unordered/unordered_map.hpp
-@@ -2069,6 +2069,10 @@ namespace boost {
-     template <class K, class T, class H, class P, class A>
-     float unordered_map<K, T, H, P, A>::load_factor() const BOOST_NOEXCEPT
-     {
-+      if (table_.size_ == 0) {
-+        return 0.0f;
-+      }
-+
-       BOOST_ASSERT(table_.bucket_count() != 0);
-       return static_cast<float>(table_.size_) /
-              static_cast<float>(table_.bucket_count());
-@@ -2506,6 +2510,10 @@ namespace boost {
-     template <class K, class T, class H, class P, class A>
-     float unordered_multimap<K, T, H, P, A>::load_factor() const BOOST_NOEXCEPT
-     {
-+      if (table_.size_ == 0) {
-+        return 0.0f;
-+      }
-+
-       BOOST_ASSERT(table_.bucket_count() != 0);
-       return static_cast<float>(table_.size_) /
-              static_cast<float>(table_.bucket_count());
-diff --git a/boost/unordered/unordered_set.hpp b/boost/unordered/unordered_set.hpp
-index 8721a68a0..82d323c6e 100644
---- a/boost/unordered/unordered_set.hpp
-+++ b/boost/unordered/unordered_set.hpp
-@@ -1586,6 +1586,10 @@ namespace boost {
-     template <class T, class H, class P, class A>
-     float unordered_set<T, H, P, A>::load_factor() const BOOST_NOEXCEPT
-     {
-+      if (table_.size_ == 0) {
-+        return 0.0f;
-+      }
-+
-       BOOST_ASSERT(table_.bucket_count() != 0);
-       return static_cast<float>(table_.size_) /
-              static_cast<float>(table_.bucket_count());
-@@ -1986,6 +1990,10 @@ namespace boost {
-     template <class T, class H, class P, class A>
-     float unordered_multiset<T, H, P, A>::load_factor() const BOOST_NOEXCEPT
-     {
-+      if (table_.size_ == 0) {
-+        return 0.0f;
-+      }
-+
-       BOOST_ASSERT(table_.bucket_count() != 0);
-       return static_cast<float>(table_.size_) /
-              static_cast<float>(table_.bucket_count());
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-ftm-malloc.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-ftm-malloc.patch
deleted file mode 100644
index 95b39e4bb6..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.80.0-unordered-ftm-malloc.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-https://github.com/boostorg/align/commit/5ad7df63cd792fbdb801d600b93cad1a432f0151
-https://github.com/boostorg/align/pull/19
-
-From 5ad7df63cd792fbdb801d600b93cad1a432f0151 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=89rico=20Nogueira=20Rolim?=
- <34201958+ericonr@users.noreply.github.com>
-Date: Fri, 11 Nov 2022 18:29:45 -0300
-Subject: [PATCH] Don't use FTMs to determine implementation choice
-
---- a/boost/align/aligned_alloc.hpp
-+++ b/boost/align/aligned_alloc.hpp
-@@ -38,7 +38,7 @@ Distributed under the Boost Software License, Version 1.0.
- #include <boost/align/detail/aligned_alloc_posix.hpp>
- #elif defined(sun) || defined(__sun)
- #include <boost/align/detail/aligned_alloc_sunos.hpp>
--#elif (_POSIX_C_SOURCE >= 200112L) || (_XOPEN_SOURCE >= 600)
-+#elif defined(_POSIX_VERSION)
- #include <boost/align/detail/aligned_alloc_posix.hpp>
- #else
- #include <boost/align/detail/aligned_alloc.hpp>
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.82.0-context-arm64.patch b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.82.0-context-arm64.patch
new file mode 100644
index 0000000000..a4efac7f2f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/boost/files/boost-1.82.0-context-arm64.patch
@@ -0,0 +1,19 @@
+https://github.com/boostorg/context/commit/d039c8e4da79dbc76481236249e22892bfdde047
+https://bugs.gentoo.org/904132
+
+From d039c8e4da79dbc76481236249e22892bfdde047 Mon Sep 17 00:00:00 2001
+From: Nikita Kniazev <nok.raven@gmail.com>
+Date: Thu, 23 Mar 2023 16:23:07 +0300
+Subject: [PATCH] Fix arm64 detection broken by recent B2 change
+
+--- a/libs/context/build/Jamfile.v2
++++ b/libs/context/build/Jamfile.v2
+@@ -79,7 +79,7 @@ local rule default_abi ( )
+     local tmp = sysv ;
+     if [ os.name ] = "NT" { tmp = ms ; }
+     else if [ os.name ] = "CYGWIN" { tmp = ms ; }
+-    else if [ os.platform ] = "ARM" { tmp = aapcs ; }
++    else if [ os.platform ] in ARM ARM64 { tmp = aapcs ; }
+     else if [ os.platform ] = "MIPS32" { tmp = o32 ; }
+     else if [ os.platform ] = "MIPS64" { tmp = n64 ; }
+     return $(tmp) ;
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
index b47d779db7..adfff3be54 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild
@@ -15,7 +15,7 @@ SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.
 LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="bzip2 lzma nls static-libs test +utils valgrind zstd"
+IUSE="bzip2 lzma nls static-libs test +utils zstd"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -33,7 +33,6 @@ RDEPEND="
 "
 DEPEND="
 	${RDEPEND}
-	valgrind? ( dev-util/valgrind )
 "
 BDEPEND="
 	>=sys-devel/flex-2.5.4a
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
index 16bea52ed1..8add6ad1cb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild
@@ -15,7 +15,7 @@ SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.
 LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
 SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-IUSE="bzip2 lzma nls static-libs test +utils valgrind zstd"
+IUSE="bzip2 lzma nls static-libs test +utils zstd"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -33,7 +33,6 @@ RDEPEND="
 "
 DEPEND="
 	${RDEPEND}
-	valgrind? ( dev-util/valgrind )
 "
 BDEPEND="
 	>=sys-devel/flex-2.5.4a
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
index d91314ed4c..1b2b95f274 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/metadata.xml
@@ -8,7 +8,6 @@
 	<use>
 		<flag name="lzma">Support automatic decompression of LZMA-compressed files and kernel images</flag>
 		<flag name="utils">Install command-line utilities (all the eu-* programs)</flag>
-		<flag name="valgrind">Add support for memory debugging using <pkg>dev-util/valgrind</pkg></flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:elfutils_project:elfutils</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
index ccac97275a..37d2aa1b2b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
@@ -1,3 +1 @@
-DIST glib-2.74.6.tar.xz 5217312 BLAKE2B 07b0a5cb74c1451ba863d5f9a781a122d3d20af1f1227177025de114279277cacada3dd6ab5eb5ad5c0bff5ac7abab6fdfbe0551f44d07b2ddc9141a0640a8c8 SHA512 6b6d113012ec90f6cf77513ec0132668c49aa7224c806181ad662388701004667cdf6d263050d6f896b8688c085abf461aa3e659eb288e6ba93ba4970a2f181b
-DIST glib-2.76.1.tar.xz 5270936 BLAKE2B 6e6d15bda7ca6365d5f33e197cad41043f17c2f505997953e4f5222121571dabfa07ac88d0a1e298313021c63ef97e7560128c3f8ddf7f518afba98692555e81 SHA512 7ab8740925fa4ed2d860a35544c475ae905df5fa7fc0cc64ffa8c543df6073794e44c8ff39e3e1de1d677016ef9d27e9bc709d2505d13090faa8d6c47cd64bd0
 DIST glib-2.76.2.tar.xz 5273836 BLAKE2B db5d5e45fe4a17bade7f5bf923ac0e5541237d19146ede33b4d52f05b82e4ecb94519393f49ac3b04e17d0f56bfd5dd99b8e81ae80956cfdb5cb2396cd5ec8cc SHA512 5a99723d72ae987999bdf3eac4f3cabe2e014616038f2006e84060b97d6d290b7d44a20d700e9c0f4572a6defed56169f624bcd21b0337f32832b311aa2737e6
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.74.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.74.6.ebuild
deleted file mode 100644
index 678d48cb72..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.74.6.ebuild
+++ /dev/null
@@ -1,287 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_REQ_USE="xml(+)"
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit flag-o-matic gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
-
-DESCRIPTION="The GLib library of C routines"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="2"
-IUSE="dbus debug +elf gtk-doc +mime selinux static-libs sysprof systemtap test utils xattr"
-RESTRICT="!test? ( test )"
-#REQUIRED_USE="gtk-doc? ( test )" # Bug #777636
-
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-
-# * elfutils (via libelf) does not build on Windows. gresources are not embedded
-# within ELF binaries on that platform anyway and inspecting ELF binaries from
-# other platforms is not that useful so exclude the dependency in this case.
-# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
-# these are used by GIO, which glib[static-libs] consumers don't really seem
-# to need at all, thus not imposing the deps for now and once some consumers
-# are actually found to static link libgio-2.0.a, we can revisit and either add
-# them or just put the (build) deps in that rare consumer instead of recursive
-# RDEPEND here (due to lack of recursive DEPEND).
-RDEPEND="
-	!<dev-util/gdbus-codegen-${PV}
-	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/libpcre2-10.32:0=[${MULTILIB_USEDEP},unicode(+),static-libs?]
-	>=dev-libs/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
-	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
-	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
-	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
-	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
-	xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
-	elf? ( virtual/libelf:0= )
-	sysprof? ( >=dev-util/sysprof-capture-3.40.1:4[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}"
-# libxml2 used for optional tests that get automatically skipped
-BDEPEND="
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	>=sys-devel/gettext-0.19.8
-	gtk-doc? ( >=dev-util/gtk-doc-1.33
-		app-text/docbook-xml-dtd:4.2
-		app-text/docbook-xml-dtd:4.5 )
-	systemtap? ( >=dev-util/systemtap-1.3 )
-	${PYTHON_DEPS}
-	test? ( >=sys-apps/dbus-1.2.14 )
-	virtual/pkgconfig
-"
-# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
-
-PDEPEND="
-	dbus? ( gnome-base/dconf )
-	mime? ( x11-misc/shared-mime-info )
-"
-# shared-mime-info needed for gio/xdgmime, bug #409481
-# dconf is needed to be able to save settings, bug #498436
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/gio-querymodules$(get_exeext)
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.64.1-mark-gdbus-server-auth-test-flaky.patch
-)
-
-pkg_setup() {
-	if use kernel_linux ; then
-		CONFIG_CHECK="~INOTIFY_USER"
-		if use test ; then
-			CONFIG_CHECK="~IPV6"
-			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
-		fi
-		linux-info_pkg_setup
-	fi
-	python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	if use test; then
-		# TODO: Review the test exclusions, especially now with meson
-		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
-		if ! has_version dev-util/desktop-file-utils ; then
-			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
-			ewarn "think on installing it to get these tests run."
-			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
-			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
-		fi
-
-		# gdesktopappinfo requires existing terminal (gnome-terminal or any
-		# other), falling back to xterm if one doesn't exist
-		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
-		#	ewarn "Some tests will be skipped due to missing terminal program"
-		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
-		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready for backport (or in a bump) and file new issue if still fails
-		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
-		# desktop-app-info/launch* might fail similarly
-		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
-		#fi
-
-		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
-		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
-		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
-
-		ewarn "Tests for search-utils have been skipped"
-		sed -i -e "/search-utils/d" glib/tests/meson.build || die
-
-		# Play nice with network-sandbox, but this approach would defeat the purpose of the test
-		#sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
-	else
-		# Don't build tests, also prevents extra deps, bug #512022
-		sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
-	fi
-
-	# Don't build fuzzing binaries - not used
-	sed -i -e '/subdir.*fuzzing/d' meson.build || die
-
-	# gdbus-codegen is a separate package
-	sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
-
-	# Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
-	sed -i -e '/install_dir/d' gio/tests/meson.build || die
-
-	cat > "${T}/glib-test-ld-wrapper" <<-EOF
-		#!/usr/bin/env sh
-		exec \${LD:-ld} "\$@"
-	EOF
-	chmod a+x "${T}/glib-test-ld-wrapper" || die
-	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
-
-	default
-	gnome2_environment_reset
-	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
-}
-
-multilib_src_configure() {
-	if use debug; then
-		append-cflags -DG_ENABLE_DEBUG
-	else
-		append-cflags -DG_DISABLE_CAST_CHECKS # https://gitlab.gnome.org/GNOME/glib/issues/1833
-	fi
-
-	# TODO: figure a way to pass appropriate values for all cross properties that glib uses (search for get_cross_property)
-	#if tc-is-cross-compiler ; then
-		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
-		# TODO-meson: This should be in meson cross file as 'growing_stack' property; and more, look at get_cross_property
-		#case ${CHOST} in
-		#hppa*|metag*) export glib_cv_stack_grows=yes ;;
-		#*)            export glib_cv_stack_grows=no ;;
-		#esac
-	#fi
-
-	local emesonargs=(
-		-Ddefault_library=$(usex static-libs both shared)
-		$(meson_feature selinux)
-		$(meson_use xattr)
-		-Dlibmount=enabled # only used if host_system == 'linux'
-		-Dman=true
-		$(meson_use systemtap dtrace)
-		$(meson_use systemtap)
-		$(meson_feature sysprof)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_use test tests)
-		-Dinstalled_tests=false
-		-Dnls=enabled
-		-Doss_fuzz=disabled
-		$(meson_native_use_feature elf libelf)
-		-Dmultiarch=false
-	)
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export XDG_CONFIG_DIRS=/etc/xdg
-	export XDG_DATA_DIRS=/usr/local/share:/usr/share
-	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
-	export LC_TIME=C # bug #411967
-	export TZ=UTC
-	unset GSETTINGS_BACKEND # bug #596380
-	python_setup
-
-	# https://bugs.gentoo.org/839807
-	local -x SANDBOX_PREDICT=${SANDBOX_PREDICT}
-	addpredict /usr/b
-
-	# Related test is a bit nitpicking
-	mkdir "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-
-	meson_src_test --timeout-multiplier 2 --no-suite flaky
-}
-
-multilib_src_install() {
-	meson_src_install
-	keepdir /usr/$(get_libdir)/gio/modules
-}
-
-multilib_src_install_all() {
-	# These are installed by dev-util/glib-utils
-	# TODO: With patching we might be able to get rid of the python-any deps and removals, and test depend on glib-utils instead; revisit now with meson
-	rm "${ED}/usr/bin/glib-genmarshal" || die
-	rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
-	rm "${ED}/usr/bin/glib-mkenums" || die
-	rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
-	rm "${ED}/usr/bin/gtester-report" || die
-	rm "${ED}/usr/share/man/man1/gtester-report.1" || die
-	# gdbus-codegen manpage installed by dev-util/gdbus-codegen
-	rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
-}
-
-pkg_preinst() {
-	xdg_pkg_preinst
-
-	# Make gschemas.compiled belong to glib alone
-	local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
-
-	if [[ -e ${EROOT}${cache} ]]; then
-		cp "${EROOT}"${cache} "${ED}"/${cache} || die
-	else
-		touch "${ED}"${cache} || die
-	fi
-
-	multilib_pkg_preinst() {
-		# Make giomodule.cache belong to glib alone
-		local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
-
-		if [[ -e ${EROOT}${cache} ]]; then
-			cp "${EROOT}"${cache} "${ED}"${cache} || die
-		else
-			touch "${ED}"${cache} || die
-		fi
-	}
-
-	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
-	# file due to inability to create it and GIO might not look at any of the modules there
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_preinst
-	fi
-}
-
-pkg_postinst() {
-	xdg_pkg_postinst
-	# glib installs no schemas itself, but we force update for fresh install in case
-	# something has dropped in a schemas file without direct glib dep; and for upgrades
-	# in case the compiled schema format could have changed
-	gnome2_schemas_update
-
-	multilib_pkg_postinst() {
-		gnome2_giomodule_cache_update \
-			|| die "Update GIO modules cache failed (for ${ABI})"
-	}
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_postinst
-	else
-		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
-		ewarn "You might want to run gio-querymodules manually on the target for"
-		ewarn "your final image for performance reasons and re-run it when packages"
-		ewarn "installing GIO modules get upgraded or added to the image."
-	fi
-
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "$v" "-lt" "2.63.6"; then
-			ewarn "glib no longer installs the gio-launch-desktop binary. You may need"
-			ewarn "to restart your session for \"Open With\" dialogs to work."
-		fi
-	done
-}
-
-pkg_postrm() {
-	xdg_pkg_postrm
-	gnome2_schemas_update
-
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		multilib_pkg_postrm() {
-			rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache
-		}
-		multilib_foreach_abi multilib_pkg_postrm
-		rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.1.ebuild
deleted file mode 100644
index e9c054fc2a..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.1.ebuild
+++ /dev/null
@@ -1,279 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_REQ_USE="xml(+)"
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
-
-DESCRIPTION="The GLib library of C routines"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="2"
-IUSE="dbus debug +elf gtk-doc +mime selinux static-libs sysprof systemtap test utils xattr"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="gtk-doc? ( test )" # Bug #777636
-
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-
-# * elfutils (via libelf) does not build on Windows. gresources are not embedded
-# within ELF binaries on that platform anyway and inspecting ELF binaries from
-# other platforms is not that useful so exclude the dependency in this case.
-# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
-# these are used by GIO, which glib[static-libs] consumers don't really seem
-# to need at all, thus not imposing the deps for now and once some consumers
-# are actually found to static link libgio-2.0.a, we can revisit and either add
-# them or just put the (build) deps in that rare consumer instead of recursive
-# RDEPEND here (due to lack of recursive DEPEND).
-RDEPEND="
-	!<dev-util/gdbus-codegen-${PV}
-	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/libpcre2-10.32:0=[${MULTILIB_USEDEP},unicode(+),static-libs?]
-	>=dev-libs/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
-	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
-	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
-	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
-	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
-	xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
-	elf? ( virtual/libelf:0= )
-	sysprof? ( >=dev-util/sysprof-capture-3.40.1:4[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}"
-# libxml2 used for optional tests that get automatically skipped
-BDEPEND="
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	>=sys-devel/gettext-0.19.8
-	gtk-doc? ( >=dev-util/gtk-doc-1.33
-		app-text/docbook-xml-dtd:4.2
-		app-text/docbook-xml-dtd:4.5 )
-	systemtap? ( >=dev-util/systemtap-1.3 )
-	${PYTHON_DEPS}
-	test? ( >=sys-apps/dbus-1.2.14 )
-	virtual/pkgconfig
-"
-# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
-
-PDEPEND="
-	dbus? ( gnome-base/dconf )
-	mime? ( x11-misc/shared-mime-info )
-"
-# shared-mime-info needed for gio/xdgmime, bug #409481
-# dconf is needed to be able to save settings, bug #498436
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/gio-querymodules$(get_exeext)
-)
-
-pkg_setup() {
-	if use kernel_linux ; then
-		CONFIG_CHECK="~INOTIFY_USER"
-		if use test ; then
-			CONFIG_CHECK="~IPV6"
-			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
-		fi
-		linux-info_pkg_setup
-	fi
-	python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	if use test; then
-		# TODO: Review the test exclusions, especially now with meson
-		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
-		if ! has_version dev-util/desktop-file-utils ; then
-			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
-			ewarn "think on installing it to get these tests run."
-			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
-			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
-		fi
-
-		# gdesktopappinfo requires existing terminal (gnome-terminal or any
-		# other), falling back to xterm if one doesn't exist
-		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
-		#	ewarn "Some tests will be skipped due to missing terminal program"
-		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
-		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready for backport (or in a bump) and file new issue if still fails
-		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
-		# desktop-app-info/launch* might fail similarly
-		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
-		#fi
-
-		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
-		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
-		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
-
-		ewarn "Tests for search-utils have been skipped"
-		sed -i -e "/search-utils/d" glib/tests/meson.build || die
-
-		# Play nice with network-sandbox, but this approach would defeat the purpose of the test
-		#sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
-	else
-		# Don't build tests, also prevents extra deps, bug #512022
-		sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
-	fi
-
-	# Don't build fuzzing binaries - not used
-	sed -i -e '/subdir.*fuzzing/d' meson.build || die
-
-	# gdbus-codegen is a separate package
-	sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
-
-	# Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
-	sed -i -e '/install_dir/d' gio/tests/meson.build || die
-
-	cat > "${T}/glib-test-ld-wrapper" <<-EOF
-		#!/usr/bin/env sh
-		exec \${LD:-ld} "\$@"
-	EOF
-	chmod a+x "${T}/glib-test-ld-wrapper" || die
-	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
-
-	default
-	gnome2_environment_reset
-	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
-}
-
-multilib_src_configure() {
-	# TODO: figure a way to pass appropriate values for all cross properties that glib uses (search for get_cross_property)
-	#if tc-is-cross-compiler ; then
-		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
-		# TODO-meson: This should be in meson cross file as 'growing_stack' property; and more, look at get_cross_property
-		#case ${CHOST} in
-		#hppa*|metag*) export glib_cv_stack_grows=yes ;;
-		#*)            export glib_cv_stack_grows=no ;;
-		#esac
-	#fi
-
-	local emesonargs=(
-		--buildtype $(usex debug debug plain)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Druntime_dir="${EPREFIX}"/run
-		$(meson_feature selinux)
-		$(meson_use xattr)
-		-Dlibmount=enabled # only used if host_system == 'linux'
-		-Dman=true
-		$(meson_use systemtap dtrace)
-		$(meson_use systemtap)
-		$(meson_feature sysprof)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_use test tests)
-		-Dinstalled_tests=false
-		-Dnls=enabled
-		-Doss_fuzz=disabled
-		$(meson_native_use_feature elf libelf)
-		-Dmultiarch=false
-	)
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export XDG_CONFIG_DIRS=/etc/xdg
-	export XDG_DATA_DIRS=/usr/local/share:/usr/share
-	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
-	export LC_TIME=C # bug #411967
-	export TZ=UTC
-	unset GSETTINGS_BACKEND # bug #596380
-	python_setup
-
-	# https://bugs.gentoo.org/839807
-	local -x SANDBOX_PREDICT=${SANDBOX_PREDICT}
-	addpredict /usr/b
-
-	# Related test is a bit nitpicking
-	mkdir "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-
-	meson_src_test --timeout-multiplier 2 --no-suite flaky
-}
-
-multilib_src_install() {
-	meson_src_install
-	keepdir /usr/$(get_libdir)/gio/modules
-}
-
-multilib_src_install_all() {
-	# These are installed by dev-util/glib-utils
-	# TODO: With patching we might be able to get rid of the python-any deps and removals, and test depend on glib-utils instead; revisit now with meson
-	rm "${ED}/usr/bin/glib-genmarshal" || die
-	rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
-	rm "${ED}/usr/bin/glib-mkenums" || die
-	rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
-	rm "${ED}/usr/bin/gtester-report" || die
-	rm "${ED}/usr/share/man/man1/gtester-report.1" || die
-	# gdbus-codegen manpage installed by dev-util/gdbus-codegen
-	rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
-}
-
-pkg_preinst() {
-	xdg_pkg_preinst
-
-	# Make gschemas.compiled belong to glib alone
-	local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
-
-	if [[ -e ${EROOT}${cache} ]]; then
-		cp "${EROOT}"${cache} "${ED}"/${cache} || die
-	else
-		touch "${ED}"${cache} || die
-	fi
-
-	multilib_pkg_preinst() {
-		# Make giomodule.cache belong to glib alone
-		local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
-
-		if [[ -e ${EROOT}${cache} ]]; then
-			cp "${EROOT}"${cache} "${ED}"${cache} || die
-		else
-			touch "${ED}"${cache} || die
-		fi
-	}
-
-	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
-	# file due to inability to create it and GIO might not look at any of the modules there
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_preinst
-	fi
-}
-
-pkg_postinst() {
-	xdg_pkg_postinst
-	# glib installs no schemas itself, but we force update for fresh install in case
-	# something has dropped in a schemas file without direct glib dep; and for upgrades
-	# in case the compiled schema format could have changed
-	gnome2_schemas_update
-
-	multilib_pkg_postinst() {
-		gnome2_giomodule_cache_update \
-			|| die "Update GIO modules cache failed (for ${ABI})"
-	}
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_postinst
-	else
-		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
-		ewarn "You might want to run gio-querymodules manually on the target for"
-		ewarn "your final image for performance reasons and re-run it when packages"
-		ewarn "installing GIO modules get upgraded or added to the image."
-	fi
-
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "$v" "-lt" "2.63.6"; then
-			ewarn "glib no longer installs the gio-launch-desktop binary. You may need"
-			ewarn "to restart your session for \"Open With\" dialogs to work."
-		fi
-	done
-}
-
-pkg_postrm() {
-	xdg_pkg_postrm
-	gnome2_schemas_update
-
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		multilib_pkg_postrm() {
-			rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache
-		}
-		multilib_foreach_abi multilib_pkg_postrm
-		rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.2.ebuild
index e9c054fc2a..ce0eb4b286 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.76.2.ebuild
@@ -16,7 +16,7 @@ IUSE="dbus debug +elf gtk-doc +mime selinux static-libs sysprof systemtap test u
 RESTRICT="!test? ( test )"
 REQUIRED_USE="gtk-doc? ( test )" # Bug #777636
 
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 # * elfutils (via libelf) does not build on Windows. gresources are not embedded
 # within ELF binaries on that platform anyway and inspecting ELF binaries from
@@ -67,6 +67,10 @@ MULTILIB_CHOST_TOOLS=(
 	/usr/bin/gio-querymodules$(get_exeext)
 )
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.64.1-mark-gdbus-server-auth-test-flaky.patch
+)
+
 pkg_setup() {
 	if use kernel_linux ; then
 		CONFIG_CHECK="~INOTIFY_USER"
@@ -131,6 +135,30 @@ src_prepare() {
 	chmod a+x "${T}/glib-test-ld-wrapper" || die
 	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
 
+	# make default sane for us
+	if use prefix ; then
+		sed -i -e "s:/usr/local:${EPREFIX}/usr:" gio/xdgmime/xdgmime.c || die
+		# bug #308609, without path, bug #314057
+		export PERL=perl
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# fix standards conflicts
+		sed -i \
+			-e 's/\<\(_XOPEN_SOURCE_EXTENDED\)\>/_POSIX_PTHREAD_SEMANTICS/' \
+			-e '/\<_XOPEN_SOURCE\>/s/\<2\>/600/' \
+			meson.build || die
+		sed -i -e '/#define\s\+_POSIX_SOURCE/d' \
+			glib/giounix.c || die
+	fi
+
+	# disable native macOS integrations
+	sed -i -e '/glib_conf.set(.HAVE_\(CARBON\|COCOA\).)/s/true/false/' \
+		meson.build || die
+	sed -i \
+		-e '/AvailabilityMacros.h/d' \
+		gio/giomodule.c || die
+
 	default
 	gnome2_environment_reset
 	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r2.ebuild
index 6cabb0d521..f2cf7e98c6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-inherit libtool multilib-minimal toolchain-funcs
+inherit libtool flag-o-matic multilib-minimal toolchain-funcs
 
 MY_PV=${PV/_p*}
 MY_PV=${MY_PV/_/-}
@@ -66,6 +66,11 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# Generally a very fragile package
+	strip-flags
+	# Miscompiled with LTO at least on arm64, bug #889948
+	filter-lto
+
 	# Because of our 32-bit userland, 1.0 is the only HPPA ABI that works
 	# https://gmplib.org/manual/ABI-and-ISA.html#ABI-and-ISA (bug #344613)
 	if [[ ${CHOST} == hppa2.0-* ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
index a3c223b16e..5854254998 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit gnuconfig libtool multilib-minimal toolchain-funcs
+inherit gnuconfig libtool flag-o-matic multilib-minimal toolchain-funcs
 
 MY_PV=${PV/_p*}
 MY_PV=${MY_PV/_/-}
@@ -94,6 +94,11 @@ src_prepare() {
 }
 
 multilib_src_configure() {
+	# Generally a very fragile package
+	strip-flags
+	# Miscompiled with LTO at least on arm64, bug #889948
+	filter-lto
+
 	# Because of our 32-bit userland, 1.0 is the only HPPA ABI that works
 	# https://gmplib.org/manual/ABI-and-ISA.html#ABI-and-ISA (bug #344613)
 	if [[ ${CHOST} == hppa2.0-* ]] ; then
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
index 8092eb14c7..2d9f357291 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
@@ -1,2 +1 @@
-DIST gobject-introspection-1.74.0.tar.xz 1044008 BLAKE2B 223bb9b8b452f03945f941086e47fb3b14f03f8353f4f903b21e3f494af728652a44de986752374057e90dd8111f21f5b0cd3e00bb0a8c3aa25c8261bb0b9247 SHA512 decff5dda0ec5ec0afda4d6bcd3bdadcbf34289002c0d9c0c77ecf8c5d3f15d196b24d8035041545031006acbdfe76af47c42da061c40e200c87f2c74cd301f0
 DIST gobject-introspection-1.76.1.tar.xz 1055416 BLAKE2B 2251c34b543c95f95bdec6853c8234db1b2e6271e729eaa5abf28e39c7718b326e0813a1214c62fb4634fd11218c4c856e6651de09081b01c9fcf8f73b8cf316 SHA512 84331a30f8854d2259609650c21aadd6363ea1417a75828bd395f8f4346da1c6d6550cff5f2c9f5f6fd6fbf2a9d27b5880c2ee1616fa905c5f362384d481a916
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.74.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.74.0.ebuild
deleted file mode 100644
index 6e70bb93eb..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.74.0.ebuild
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-GNOME_ORG_MODULE="gobject-introspection"
-
-inherit gnome.org
-
-DESCRIPTION="Build infrastructure for GObject Introspection"
-HOMEPAGE="https://wiki.gnome.org/Projects/GObjectIntrospection"
-
-LICENSE="HPND"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-
-RDEPEND="!<${CATEGORY}/${GNOME_ORG_MODULE}-${PV}"
-# Use !<${PV} because mixing gobject-introspection with different version of -common can cause issues like:
-# https://forums.gentoo.org/viewtopic-p-7421930.html
-
-src_configure() { :; }
-
-src_compile() { :; }
-
-src_install() {
-	insinto /usr/share/aclocal
-	doins m4/introspection.m4
-
-	insinto /usr/share/gobject-introspection-1.0
-	doins Makefile.introspection
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.76.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.76.1.ebuild
index bce7762306..b4664c03a3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.76.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.76.1.ebuild
@@ -11,7 +11,7 @@ HOMEPAGE="https://wiki.gnome.org/Projects/GObjectIntrospection"
 
 LICENSE="HPND"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 RDEPEND="!<${CATEGORY}/${GNOME_ORG_MODULE}-${PV}"
 # Use !<${PV} because mixing gobject-introspection with different version of -common can cause issues like:
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
index 8092eb14c7..2d9f357291 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
@@ -1,2 +1 @@
-DIST gobject-introspection-1.74.0.tar.xz 1044008 BLAKE2B 223bb9b8b452f03945f941086e47fb3b14f03f8353f4f903b21e3f494af728652a44de986752374057e90dd8111f21f5b0cd3e00bb0a8c3aa25c8261bb0b9247 SHA512 decff5dda0ec5ec0afda4d6bcd3bdadcbf34289002c0d9c0c77ecf8c5d3f15d196b24d8035041545031006acbdfe76af47c42da061c40e200c87f2c74cd301f0
 DIST gobject-introspection-1.76.1.tar.xz 1055416 BLAKE2B 2251c34b543c95f95bdec6853c8234db1b2e6271e729eaa5abf28e39c7718b326e0813a1214c62fb4634fd11218c4c856e6651de09081b01c9fcf8f73b8cf316 SHA512 84331a30f8854d2259609650c21aadd6363ea1417a75828bd395f8f4346da1c6d6550cff5f2c9f5f6fd6fbf2a9d27b5880c2ee1616fa905c5f362384d481a916
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.74.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.74.0.ebuild
deleted file mode 100644
index 592e42c160..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.74.0.ebuild
+++ /dev/null
@@ -1,79 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-PYTHON_REQ_USE="xml(+)"
-inherit gnome.org meson python-single-r1 xdg
-
-DESCRIPTION="Introspection system for GObject-based libraries"
-HOMEPAGE="https://wiki.gnome.org/Projects/GObjectIntrospection"
-
-LICENSE="LGPL-2+ GPL-2+"
-SLOT="0"
-IUSE="doctool gtk-doc test"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-
-# virtual/pkgconfig needed at runtime, bug #505408
-RDEPEND="
-	>=dev-libs/gobject-introspection-common-${PV}
-	>=dev-libs/glib-2.74.0:2
-	dev-libs/libffi:=
-	doctool? (
-		$(python_gen_cond_dep '
-			dev-python/mako[${PYTHON_USEDEP}]
-			dev-python/markdown[${PYTHON_USEDEP}]
-		')
-	)
-	virtual/pkgconfig
-	${PYTHON_DEPS}
-"
-# Wants real bison, not app-alternatives/yacc
-DEPEND="${RDEPEND}"
-BDEPEND="
-	gtk-doc? (
-		>=dev-util/gtk-doc-1.19
-		app-text/docbook-xml-dtd:4.3
-		app-text/docbook-xml-dtd:4.5
-	)
-	sys-devel/bison
-	sys-devel/flex
-	test? (
-		x11-libs/cairo[glib]
-		$(python_gen_cond_dep '
-			dev-python/mako[${PYTHON_USEDEP}]
-			dev-python/markdown[${PYTHON_USEDEP}]
-		')
-	)
-"
-
-pkg_setup() {
-	python-single-r1_pkg_setup
-}
-
-src_configure() {
-	local emesonargs=(
-		$(meson_feature test cairo)
-		$(meson_feature doctool)
-		#-Dglib_src_dir
-		$(meson_use gtk-doc gtk_doc)
-		#-Dcairo_libname
-		-Dpython="${EPYTHON}"
-		#-Dgir_dir_prefix
-	)
-	meson_src_configure
-}
-
-src_install() {
-	meson_src_install
-	python_fix_shebang "${ED}"/usr/bin/
-	python_optimize "${ED}"/usr/$(get_libdir)/gobject-introspection/giscanner
-
-	# Prevent collision with gobject-introspection-common
-	rm -v "${ED}"/usr/share/aclocal/introspection.m4 \
-		"${ED}"/usr/share/gobject-introspection-1.0/Makefile.introspection || die
-	rmdir "${ED}"/usr/share/aclocal || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.76.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.76.1.ebuild
index 7362abb833..84522f911b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.76.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.76.1.ebuild
@@ -15,7 +15,7 @@ SLOT="0"
 IUSE="doctool gtk-doc test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 # virtual/pkgconfig needed at runtime, bug #505408
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.3.ebuild
index 39d1be5581..33fc27fe44 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.3.ebuild
@@ -37,6 +37,7 @@ src_configure() {
 	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(use_enable static-libs static)
 
 		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r1.ebuild
index 18522d5343..4c1bdd5438 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -22,17 +22,22 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="BSD"
 SLOT="3"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
-IUSE="bzip2 +cxx +jit libedit pcre16 pcre32 +readline static-libs unicode zlib"
-REQUIRED_USE="readline? ( !libedit )
-	libedit? ( !readline )"
+IUSE="bzip2 +cxx +jit libedit pcre16 pcre32 +readline static-libs unicode valgrind zlib"
+REQUIRED_USE="
+	readline? ( !libedit )
+	libedit? ( !readline )
+"
 
 RDEPEND="
 	bzip2? ( app-arch/bzip2 )
 	zlib? ( sys-libs/zlib )
 	libedit? ( dev-libs/libedit )
-	readline? ( sys-libs/readline:0= )
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-util/valgrind )
 "
-DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
 MULTILIB_CHOST_TOOLS=(
@@ -63,6 +68,7 @@ multilib_src_configure() {
 		$(use_enable static-libs static)
 		$(use_enable unicode utf)
 		$(use_enable unicode unicode-properties)
+		$(multilib_native_use_enable valgrind)
 		$(multilib_native_use_enable zlib pcregrep-libz)
 
 		--enable-pcre8
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r1.ebuild
index 5a0b23904c..56e994b8bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r1.ebuild
@@ -24,7 +24,7 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="BSD"
 SLOT="0/3" # libpcre2-posix.so version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="bzip2 +jit libedit +pcre16 pcre32 +readline static-libs unicode zlib"
+IUSE="bzip2 +jit libedit +pcre16 pcre32 +readline static-libs unicode valgrind zlib"
 REQUIRED_USE="?? ( libedit readline )"
 
 RDEPEND="
@@ -33,7 +33,10 @@ RDEPEND="
 	readline? ( sys-libs/readline:= )
 	zlib? ( sys-libs/zlib )
 "
-DEPEND="${RDEPEND}"
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-util/valgrind )
+"
 BDEPEND="
 	virtual/pkgconfig
 	verify-sig? ( sec-keys/openpgp-keys-philiphazel )
@@ -60,6 +63,7 @@ multilib_src_configure() {
 		$(multilib_native_use_enable bzip2 pcre2grep-libbz2)
 		$(multilib_native_use_enable libedit pcre2test-libedit)
 		$(multilib_native_use_enable readline pcre2test-libreadline)
+		$(multilib_native_use_enable valgrind)
 		$(multilib_native_use_enable zlib pcre2grep-libz)
 		$(use_enable jit)
 		$(use_enable jit pcre2grep-jit)
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.19.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.19.0.ebuild
index aea8d95ec4..42c60f24b3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.19.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/libtasn1-4.19.0.ebuild
@@ -14,14 +14,13 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="LGPL-2.1+"
 SLOT="0/6" # subslot = libtasn1 soname version
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="static-libs test valgrind"
+IUSE="static-libs test"
 
 RESTRICT="!test? ( test )"
 
 BDEPEND="
 	sys-apps/help2man
 	app-alternatives/yacc
-	test? ( valgrind? ( dev-util/valgrind ) )
 	verify-sig? ( sec-keys/openpgp-keys-libtasn1 )
 "
 
@@ -41,8 +40,8 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(use_enable static-libs static)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 	)
 
 	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/metadata.xml
index 34019a209d..2889e087bc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libtasn1/metadata.xml
@@ -5,11 +5,6 @@
 		<name>Gentoo Base System</name>
 		<email>base-system@gentoo.org</email>
 	</maintainer>
-	<use>
-		<flag name="valgrind">
-			Enable usage of <pkg>dev-util/valgrind</pkg> in debug
-		</flag>
-	</use>
 	<upstream>
 		<changelog>https://gitlab.com/gnutls/libtasn1/blob/master/NEWS</changelog>
 		<remote-id type="cpe">cpe:/a:gnu:libtasn1</remote-id>
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
index af0ec7d9b0..36ddb95ef7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest
@@ -1,5 +1,5 @@
-DIST libxml2-2.10.3.tar.xz 2639908 BLAKE2B aef2cc87e4632ddc478ff719155fdcb17601a8af37ecc1145ca05e01340935b57f07722e016ca2b27e4b269d47bd2fe97db09119a47849e8745e077e42b8bb66 SHA512 33bb87ae9a45c475c3de09477e5d94840d8f687f893ef7839408bc7267e57611c4f2b863ed8ec819a4b5f1ebd6a122db9f6054c73bceed427d37f3e67f62620c
 DIST libxml2-2.10.4.tar.xz 2643600 BLAKE2B 5bbb63c6e58accf434513aeb974fed7349e5458de642ef89db77768c8d1383532614254e0e3f1d9471e2274c6b81a04a0a3afcb602707ce79550c2bd8e9028d9 SHA512 792c1dceb098cd353a7eca4c46d31cce6310b2553d97fd3918cf0b94d93b2480759202036511bde36c24166236bd4616f57e79959eea9afe3f60614bdfe13094
+DIST libxml2-2.11.4.tar.xz 2626756 BLAKE2B 5d7e6388291a8473195131f5cb22aee9a4182f28fd8eed468c449b762d363cfb1713a7466c1f98e96cf819ed8f78e13a6ba930c2fadd8d63869b6efe8e8be8a8 SHA512 c1df7441c729430bdd2de52e9da69b171afc4b776e4a2eb43acbc71ada7a3814a465247fb5fca4c83ecf1c281f7745069ec3d051a7964cb7cc119a3d983f93ba
 DIST xmlts20130923.tar.gz 641522 BLAKE2B 63a47bc69278ef510cd0b3779aed729e1b309e30efa0015d28ed051cc03f9dfddb447ab57b07b3393e8f47393d15473b0e199c34cb1f5f746b15ddfaa55670be SHA512 d5c4d26b324ed21f4e0641cd7f8b76dbf9de80df8b519982e44d41c960df29fd03618e02e9693b2d11ad06d19c4a965274c95a048ec3b9653eacb919a7f8b733
 DIST xsts-2002-01-16.tar.gz 6894439 BLAKE2B 1e9ec63d2c104655e64249e07440a04d862fcbcd4d4e19745d81b34994319b510a531c9d6df1491fae1e90b5d0764f0f1a827251ca8df5d613178b0eab01ef25 SHA512 43300af6d39c1e2221b0ed7318fe14c7464eeb6eb030ed1e22eb29b4ab17f014e2a4c8887c3a46ae5d243e3072da27f00f4e285498ae6f1288177d38d1108288
 DIST xsts-2004-01-14.tar.gz 2761085 BLAKE2B 41545995fb3a65d053257c376c07d45ffd1041a433bfbdb46d4dd87a5afb60c18c8629a3d988323f9e7a1d709775b5a7e5930276a7121c0725a22705c0976e36 SHA512 32854388d7e720ad67156baf50bf2bae7bd878ca3e35fd7e44e57cad3f434f69d56bbbedd61509f8a1faf01c9eae74a078df8fe130780b182c05c05cb1c39ebe
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0001-iconv.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0001-iconv.patch
new file mode 100644
index 0000000000..615f413c44
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0001-iconv.patch
@@ -0,0 +1,63 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/9c1f5fe7fbad2b57149c628802c4ded3e4f3d284
+
+From 9c1f5fe7fbad2b57149c628802c4ded3e4f3d284 Mon Sep 17 00:00:00 2001
+From: Mike Dalessio <mike.dalessio@gmail.com>
+Date: Fri, 5 May 2023 17:34:57 -0400
+Subject: [PATCH] autoconf: fix iconv library paths
+
+and pass cflags when building executables
+
+See 0f77167f for prior related work
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -145,11 +145,12 @@ runsuite_DEPENDENCIES = $(DEPS)
+ runsuite_LDADD= $(LDADDS)
+ 
+ xmllint_SOURCES=xmllint.c
+-xmllint_CFLAGS = $(AM_CFLAGS) $(RDL_CFLAGS)
++xmllint_CFLAGS = $(AM_CFLAGS) $(RDL_CFLAGS) $(ICONV_CFLAGS)
+ xmllint_DEPENDENCIES = $(DEPS)
+ xmllint_LDADD=  $(RDL_LIBS) $(LDADDS)
+ 
+ xmlcatalog_SOURCES=xmlcatalog.c
++xmlcatalog_CFLAGS = $(AM_CFLAGS) $(RDL_CFLAGS) $(ICONV_CFLAGS)
+ xmlcatalog_DEPENDENCIES = $(DEPS)
+ xmlcatalog_LDADD = $(RDL_LIBS) $(LDADDS)
+ 
+--- a/configure.ac
++++ b/configure.ac
+@@ -1036,7 +1036,7 @@ else
+     if test "$with_iconv" != "yes" && test "$with_iconv" != "" ; then
+ 	ICONV_DIR=$with_iconv
+ 	CPPFLAGS="$CPPFLAGS -I$ICONV_DIR/include"
+-        LIBS="$LIBS -L$ICONV_DIR/libs"
++	LIBS="$LIBS -L$ICONV_DIR/lib"
+ 	# Export this since our headers include iconv.h
+ 	XML_INCLUDEDIR="$XML_INCLUDEDIR -I$ICONV_DIR/include"
+     fi
+@@ -1052,12 +1052,13 @@ else
+                 ICONV_LIBS="-liconv"])])])
+     if test "$WITH_ICONV" = "1" && test "$ICONV_DIR" != ""; then
+         ICONV_CFLAGS="-I$ICONV_DIR/include"
+-        ICONV_LIBS="-L$ICONV_DIR/libs $ICONV_LIBS"
++        ICONV_LIBS="-L$ICONV_DIR/lib $ICONV_LIBS"
+     fi
+     CPPFLAGS=$_cppflags
+     LIBS=$_libs
+ fi
+ AC_SUBST(WITH_ICONV)
++AC_SUBST(ICONV_CFLAGS)
+ 
+ dnl
+ dnl Checks for ICU library.
+@@ -1100,7 +1101,7 @@ else
+                     ICU_LIBS=-licucore
+                     if test "$ICU_DIR" != ""; then
+                         ICU_CFLAGS="-I$ICU_DIR/include"
+-                        ICU_LIBS="-L$ICU_DIR/libs $ICU_LIBS"
++                        ICU_LIBS="-L$ICU_DIR/lib $ICU_LIBS"
+                     fi])])
+             CPPFLAGS=$_cppflags
+             LIBS=$_libs
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0002-crash-old-libxslt.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0002-crash-old-libxslt.patch
new file mode 100644
index 0000000000..2253ea6211
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0002-crash-old-libxslt.patch
@@ -0,0 +1,27 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/e6a9cc8d66778c20435a46e50d4e5866deace5f6
+
+From e6a9cc8d66778c20435a46e50d4e5866deace5f6 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Sat, 6 May 2023 15:28:13 +0200
+Subject: [PATCH] hash: Fix possible startup crash with old libxslt versions
+
+Call xmlInitParser in xmlHashCreate to make it work if the library
+wasn't initialized yet.
+
+Otherwise, exsltRegisterAll from libxslt 1.1.24 or older might cause
+a crash.
+
+See #534.
+--- a/hash.c
++++ b/hash.c
+@@ -180,6 +180,8 @@ xmlHashTablePtr
+ xmlHashCreate(int size) {
+     xmlHashTablePtr table;
+ 
++    xmlInitParser();
++
+     if (size <= 0)
+         size = 256;
+ 
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0003-no-xpath.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0003-no-xpath.patch
new file mode 100644
index 0000000000..f036c5814f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0003-no-xpath.patch
@@ -0,0 +1,245 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/41e78f8f8656b8e2206c06995da6bd8dcc82823d
+
+From 41e78f8f8656b8e2206c06995da6bd8dcc82823d Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Mon, 8 May 2023 23:12:33 +0200
+Subject: [PATCH] xpath: Fix build without LIBXML_XPATH_ENABLED
+
+Move static function declaration into XPATH block. Also move comparison
+functions.
+
+Fixes #537.
+--- a/xpath.c
++++ b/xpath.c
+@@ -145,6 +145,114 @@
+  * any use of the macros IS_ASCII_CHARACTER and IS_ASCII_DIGIT)
+  */
+ 
++#if defined(LIBXML_XPATH_ENABLED) || defined(LIBXML_SCHEMAS_ENABLED)
++
++/************************************************************************
++ *									*
++ *			Floating point stuff				*
++ *									*
++ ************************************************************************/
++
++double xmlXPathNAN = 0.0;
++double xmlXPathPINF = 0.0;
++double xmlXPathNINF = 0.0;
++
++/**
++ * xmlXPathInit:
++ *
++ * DEPRECATED: Alias for xmlInitParser.
++ */
++void
++xmlXPathInit(void) {
++    xmlInitParser();
++}
++
++/**
++ * xmlInitXPathInternal:
++ *
++ * Initialize the XPath environment
++ */
++ATTRIBUTE_NO_SANITIZE("float-divide-by-zero")
++void
++xmlInitXPathInternal(void) {
++#if defined(NAN) && defined(INFINITY)
++    xmlXPathNAN = NAN;
++    xmlXPathPINF = INFINITY;
++    xmlXPathNINF = -INFINITY;
++#else
++    /* MSVC doesn't allow division by zero in constant expressions. */
++    double zero = 0.0;
++    xmlXPathNAN = 0.0 / zero;
++    xmlXPathPINF = 1.0 / zero;
++    xmlXPathNINF = -xmlXPathPINF;
++#endif
++}
++
++/**
++ * xmlXPathIsNaN:
++ * @val:  a double value
++ *
++ * Returns 1 if the value is a NaN, 0 otherwise
++ */
++int
++xmlXPathIsNaN(double val) {
++#ifdef isnan
++    return isnan(val);
++#else
++    return !(val == val);
++#endif
++}
++
++/**
++ * xmlXPathIsInf:
++ * @val:  a double value
++ *
++ * Returns 1 if the value is +Infinite, -1 if -Infinite, 0 otherwise
++ */
++int
++xmlXPathIsInf(double val) {
++#ifdef isinf
++    return isinf(val) ? (val > 0 ? 1 : -1) : 0;
++#else
++    if (val >= xmlXPathPINF)
++        return 1;
++    if (val <= -xmlXPathPINF)
++        return -1;
++    return 0;
++#endif
++}
++
++#endif /* SCHEMAS or XPATH */
++
++#ifdef LIBXML_XPATH_ENABLED
++
++/*
++ * TODO: when compatibility allows remove all "fake node libxslt" strings
++ *       the test should just be name[0] = ' '
++ */
++#ifdef DEBUG_XPATH_EXPRESSION
++#define DEBUG_STEP
++#define DEBUG_EXPR
++#define DEBUG_EVAL_COUNTS
++#endif
++
++static xmlNs xmlXPathXMLNamespaceStruct = {
++    NULL,
++    XML_NAMESPACE_DECL,
++    XML_XML_NAMESPACE,
++    BAD_CAST "xml",
++    NULL,
++    NULL
++};
++static xmlNsPtr xmlXPathXMLNamespace = &xmlXPathXMLNamespaceStruct;
++#ifndef LIBXML_THREAD_ENABLED
++/*
++ * Optimizer is disabled only when threaded apps are detected while
++ * the library ain't compiled for thread safety.
++ */
++static int xmlXPathDisableOptimizer = 0;
++#endif
++
+ static void
+ xmlXPathNodeSetClear(xmlNodeSetPtr set, int hasNsNodes);
+ 
+@@ -475,114 +583,6 @@ int wrap_cmp( xmlNodePtr x, xmlNodePtr y );
+ #include "timsort.h"
+ #endif /* WITH_TIM_SORT */
+ 
+-#if defined(LIBXML_XPATH_ENABLED) || defined(LIBXML_SCHEMAS_ENABLED)
+-
+-/************************************************************************
+- *									*
+- *			Floating point stuff				*
+- *									*
+- ************************************************************************/
+-
+-double xmlXPathNAN = 0.0;
+-double xmlXPathPINF = 0.0;
+-double xmlXPathNINF = 0.0;
+-
+-/**
+- * xmlXPathInit:
+- *
+- * DEPRECATED: Alias for xmlInitParser.
+- */
+-void
+-xmlXPathInit(void) {
+-    xmlInitParser();
+-}
+-
+-/**
+- * xmlInitXPathInternal:
+- *
+- * Initialize the XPath environment
+- */
+-ATTRIBUTE_NO_SANITIZE("float-divide-by-zero")
+-void
+-xmlInitXPathInternal(void) {
+-#if defined(NAN) && defined(INFINITY)
+-    xmlXPathNAN = NAN;
+-    xmlXPathPINF = INFINITY;
+-    xmlXPathNINF = -INFINITY;
+-#else
+-    /* MSVC doesn't allow division by zero in constant expressions. */
+-    double zero = 0.0;
+-    xmlXPathNAN = 0.0 / zero;
+-    xmlXPathPINF = 1.0 / zero;
+-    xmlXPathNINF = -xmlXPathPINF;
+-#endif
+-}
+-
+-/**
+- * xmlXPathIsNaN:
+- * @val:  a double value
+- *
+- * Returns 1 if the value is a NaN, 0 otherwise
+- */
+-int
+-xmlXPathIsNaN(double val) {
+-#ifdef isnan
+-    return isnan(val);
+-#else
+-    return !(val == val);
+-#endif
+-}
+-
+-/**
+- * xmlXPathIsInf:
+- * @val:  a double value
+- *
+- * Returns 1 if the value is +Infinite, -1 if -Infinite, 0 otherwise
+- */
+-int
+-xmlXPathIsInf(double val) {
+-#ifdef isinf
+-    return isinf(val) ? (val > 0 ? 1 : -1) : 0;
+-#else
+-    if (val >= xmlXPathPINF)
+-        return 1;
+-    if (val <= -xmlXPathPINF)
+-        return -1;
+-    return 0;
+-#endif
+-}
+-
+-#endif /* SCHEMAS or XPATH */
+-
+-#ifdef LIBXML_XPATH_ENABLED
+-
+-/*
+- * TODO: when compatibility allows remove all "fake node libxslt" strings
+- *       the test should just be name[0] = ' '
+- */
+-#ifdef DEBUG_XPATH_EXPRESSION
+-#define DEBUG_STEP
+-#define DEBUG_EXPR
+-#define DEBUG_EVAL_COUNTS
+-#endif
+-
+-static xmlNs xmlXPathXMLNamespaceStruct = {
+-    NULL,
+-    XML_NAMESPACE_DECL,
+-    XML_XML_NAMESPACE,
+-    BAD_CAST "xml",
+-    NULL,
+-    NULL
+-};
+-static xmlNsPtr xmlXPathXMLNamespace = &xmlXPathXMLNamespaceStruct;
+-#ifndef LIBXML_THREAD_ENABLED
+-/*
+- * Optimizer is disabled only when threaded apps are detected while
+- * the library ain't compiled for thread safety.
+- */
+-static int xmlXPathDisableOptimizer = 0;
+-#endif
+-
+ /************************************************************************
+  *									*
+  *			Error handling routines				*
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0004-huge-push.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0004-huge-push.patch
new file mode 100644
index 0000000000..5f3d060382
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0004-huge-push.patch
@@ -0,0 +1,27 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/7c14859d0779797a93ea75744266425028599944
+
+From 7c14859d0779797a93ea75744266425028599944 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 9 May 2023 13:28:06 +0200
+Subject: [PATCH] parser: Fix "huge input lookup" error with push parser
+
+Fix parsing of larger documents without XML_PARSE_HUGE.
+
+Should fix #538.
+--- a/parserInternals.c
++++ b/parserInternals.c
+@@ -418,9 +418,10 @@ xmlParserShrink(xmlParserCtxtPtr ctxt) {
+     xmlParserInputBufferPtr buf = in->buf;
+     size_t used;
+ 
+-    /* Don't shrink memory buffers. */
++    /* Don't shrink pull parser memory buffers. */
+     if ((buf == NULL) ||
+-        ((buf->encoder == NULL) && (buf->readcallback == NULL)))
++        ((ctxt->progressive == 0) &&
++         (buf->encoder == NULL) && (buf->readcallback == NULL)))
+         return;
+ 
+     used = in->cur - in->base;
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0005-icu-detection.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0005-icu-detection.patch
new file mode 100644
index 0000000000..6fffb156ea
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/files/libxml2-2.11.2-0005-icu-detection.patch
@@ -0,0 +1,21 @@
+https://gitlab.gnome.org/GNOME/libxml2/-/commit/55f221a4c57903ced5721008607d4133d6eb51cf
+
+From 55f221a4c57903ced5721008607d4133d6eb51cf Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Wed, 10 May 2023 18:13:47 +0200
+Subject: [PATCH] autotools: Fix ICU detection
+
+Fixes #540.
+--- a/configure.ac
++++ b/configure.ac
+@@ -1096,7 +1096,7 @@ else
+             fi
+ 
+             AC_CHECK_HEADER(unicode/ucnv.h, [
+-                AC_CHECK_LIB([icucore], [uconv_open], [
++                AC_CHECK_LIB([icucore], [ucnv_open], [
+                     WITH_ICU=1
+                     ICU_LIBS=-licucore
+                     if test "$ICU_DIR" != ""; then
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.4.ebuild
index ee48fb701f..dde6d39580 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.4.ebuild
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit autotools git-r3
 else
 	inherit gnome.org libtool
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 SRC_URI+="
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
similarity index 85%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
index dde6d39580..c04a7cb51a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.10.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.4.ebuild
@@ -5,9 +5,9 @@ EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal toolchain-funcs
+inherit flag-o-matic python-r1 multilib-minimal
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -23,7 +23,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit autotools git-r3
 else
 	inherit gnome.org libtool
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 SRC_URI+="
@@ -31,7 +31,8 @@ SRC_URI+="
 		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
 		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
 		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)"
+	)
+"
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
@@ -40,11 +41,13 @@ IUSE="debug examples +ftp icu lzma +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
-RDEPEND=">=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
+RDEPEND="
+	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
 	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )"
+	readline? ( sys-libs/readline:= )
+"
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
@@ -56,10 +59,6 @@ MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
 
-PATCHES=( "${FILESDIR}"/${PN}-2.10.3-python3-unicode-errors.patch )
-
-DOCS=( NEWS README.md TODO TODO_SCHEMAS python/TODO )
-
 src_unpack() {
 	if [[ ${PV} == 9999 ]] ; then
 		git-r3_src_unpack
@@ -102,13 +101,6 @@ multilib_src_configure() {
 	# Filter seemingly problematic CFLAGS (bug #26320)
 	filter-flags -fprefetch-loop-arrays -funroll-loops
 
-	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
-	# https://github.com/gentoo/gentoo/pull/28355
-	# mold needs this too but right now tc-ld-is-mold is also not available
-	if tc-ld-is-lld; then
-		append-ldflags -Wl,--undefined-version
-	fi
-
 	# Notes:
 	# The meaning of the 'debug' USE flag does not apply to the --with-debug
 	# switch (enabling the libxml2 debug module). See bug #100898.
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
index 007c90de1c..c04a7cb51a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-9999.ebuild
@@ -5,9 +5,9 @@ EAPI=8
 
 # Note: Please bump in sync with dev-libs/libxslt
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="xml(+)"
-inherit flag-o-matic python-r1 multilib-minimal toolchain-funcs
+inherit flag-o-matic python-r1 multilib-minimal
 
 XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
 XSTS_NAME_1="xmlschema2002-01-16"
@@ -31,7 +31,8 @@ SRC_URI+="
 		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
 		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
 		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
-	)"
+	)
+"
 S="${WORKDIR}/${PN}-${PV%_rc*}"
 
 LICENSE="MIT"
@@ -40,11 +41,13 @@ IUSE="debug examples +ftp icu lzma +python readline static-libs test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
-RDEPEND=">=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
+RDEPEND="
+	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
 	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
 	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
 	python? ( ${PYTHON_DEPS} )
-	readline? ( sys-libs/readline:= )"
+	readline? ( sys-libs/readline:= )
+"
 DEPEND="${RDEPEND}"
 BDEPEND="virtual/pkgconfig"
 
@@ -56,8 +59,6 @@ MULTILIB_CHOST_TOOLS=(
 	/usr/bin/xml2-config
 )
 
-DOCS=( NEWS README.md TODO TODO_SCHEMAS python/TODO )
-
 src_unpack() {
 	if [[ ${PV} == 9999 ]] ; then
 		git-r3_src_unpack
@@ -100,13 +101,6 @@ multilib_src_configure() {
 	# Filter seemingly problematic CFLAGS (bug #26320)
 	filter-flags -fprefetch-loop-arrays -funroll-loops
 
-	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
-	# https://github.com/gentoo/gentoo/pull/28355
-	# mold needs this too but right now tc-ld-is-mold is also not available
-	if tc-ld-is-lld; then
-		append-ldflags -Wl,--undefined-version
-	fi
-
 	# Notes:
 	# The meaning of the 'debug' USE flag does not apply to the --with-debug
 	# switch (enabling the libxml2 debug module). See bug #100898.
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
index a7b594461f..4885a6ef3c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest
@@ -1 +1,2 @@
 DIST libxslt-1.1.37.tar.xz 1588572 BLAKE2B 096d93dd7178bf4483207514b1435f5bf426eea4952ffab7cc00c3e85aa736534c4acb5377af9647aa77a0cd793205194509d997a7bb5cae692f65e326566cd8 SHA512 a4e477d2bb918b7d01945e2c7491c3a4aae799dc1602bbd13de55c8a5052e210a20bc45115347eae44473c8b1d03dbc5e4a2aa18c2218f1fdfd376d87cd501ca
+DIST libxslt-1.1.38.tar.xz 1576676 BLAKE2B 9397be8b223bd68b326b954fe6a749a269e969b4669747678715728f553916c23475232fc2894a5e4230e15b031981423adeb8f83407f4db8075a784c7e6a55b SHA512 2836bd2990b95680db0960ac4c465d0c6c28a293ad095a224c05021a1c8d2576a45e41da8947a31f4ef3e6ef368cbda65243661e311c9886c19694be5a7c9a8e
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.38.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.38.ebuild
new file mode 100644
index 0000000000..79e567f3d6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.38.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Note: Please bump this in sync with dev-libs/libxml2.
+
+PYTHON_COMPAT=( python3_{10..11} )
+inherit flag-o-matic python-r1 multilib-minimal
+
+DESCRIPTION="XSLT libraries and tools"
+HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
+	inherit autotools git-r3
+else
+	inherit libtool gnome.org
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE="crypt debug examples python static-libs"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+BDEPEND=">=virtual/pkgconfig-1"
+RDEPEND="
+	>=dev-libs/libxml2-2.9.11:2[${MULTILIB_USEDEP}]
+	crypt? ( >=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+"
+DEPEND="${RDEPEND}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/xslt-config
+)
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/libxslt/xsltconfig.h
+)
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		# Prefix always needs elibtoolize if not eautoreconf'd.
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	# Remove this after upstream merge request to add AC_SYS_LARGEFILE lands:
+	# https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/55
+	append-lfs-flags
+
+	libxslt_configure() {
+		ECONF_SOURCE="${S}" econf \
+			--without-python \
+			$(use_with crypt crypto) \
+			$(use_with debug) \
+			$(use_with debug mem-debug) \
+			$(use_enable static-libs static) \
+			"$@"
+	}
+
+	# Build Python bindings separately
+	libxslt_configure --without-python
+
+	if multilib_is_native_abi && use python ; then
+		NATIVE_BUILD_DIR="${BUILD_DIR}"
+		python_foreach_impl run_in_build_dir libxslt_configure --with-python
+	fi
+}
+
+libxslt_py_emake() {
+	pushd "${BUILD_DIR}"/python >/dev/null || die
+
+	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+
+	popd >/dev/null || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake all
+	fi
+}
+
+multilib_src_test() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake test
+	fi
+}
+
+multilib_src_install() {
+	# "default" does not work here - docs are installed by multilib_src_install_all
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi && use python; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake \
+			DESTDIR="${D}" \
+			install
+
+		# Hack until automake release is made for the optimise fix
+		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
+		python_foreach_impl python_optimize
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use examples ; then
+		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
+		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
index cec46e76ee..827b9edd55 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 # Note: Please bump this in sync with dev-libs/libxml2.
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 inherit python-r1 multilib-minimal
 
 DESCRIPTION="XSLT libraries and tools"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/Manifest
index e7503051d5..1729d02bfa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/Manifest
@@ -1,2 +1,4 @@
 DIST nettle-3.8.1.tar.gz 2406251 BLAKE2B 22b4ec81645b579504356597ba87b637e46285682020c90e03ecaea386ac9b48eaf91ee76ae3b86b6060be355de20c320ab3b74958074ad23fc08ad9ab6a4cbb SHA512 a405da3438d185d96917b03b00abb9ab43e04f58f770f657f716c25d64bb258ee170a71328e74736caa7121f50c0c89d3cc840c1201d2a92cfaf1357d24bdc6a
 DIST nettle-3.8.1.tar.gz.sig 374 BLAKE2B e2bfce4aaa1be114fb9bf8724f25db75c69c3b98538df46e9b1428ce615f7db3b9e9f9240d232fddac195db4568439b3f58989c20beca82aa6db79f4956db547 SHA512 978304b1faa5adc3b0d6ea7e9597af6154ad5d6e328913ac19184ece94771fdb2a7d5ce0af535ae8d28cb6ccd94fb3d4ef2613c0356df9e08b5d4c26ea646e09
+DIST nettle-3.9.tar.gz 2393838 BLAKE2B 80885fa380de58765155a5d4b209e524f4bd0336156ba6f5189702007438998094df0e4e801370fd0a74251b8cf91f46638b0c0139388c2c2098b1207ed3415c SHA512 5e44f59b37ec1e92345fce0b963151d1f2aabf01b3a197b8d931067c51af4ba025059c6a07f2bcd19b17eb49d6ede98f5c200e58d340959826cda473459d2fba
+DIST nettle-3.9.tar.gz.sig 374 BLAKE2B 4fb9fbdafd01712db2506e070a64b6821dcc0c3ff3cea83011662ee4cdd5120ed10c6fa7b41d556069fe2d8827a312e94bb3586be845284fa7a7ac75f000a750 SHA512 8cf060e9f8e0dc0a70a7d324cf2366e0fc990fca2d8a1c677e66382f6853f96146fe30ea9b8629030991f4799430c7660ae7867c94167760bb945abb526b5bda
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.ebuild
new file mode 100644
index 0000000000..3bdb6aaa7a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/nettle.asc
+inherit multilib-build multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Low-level cryptographic library"
+HOMEPAGE="http://www.lysator.liu.se/~nisse/nettle/"
+SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
+SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
+
+LICENSE="|| ( LGPL-3 LGPL-2.1 )"
+# Subslot = libnettle - libhogweed soname version
+SLOT="0/8-6"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
+# The arm64 crypto option controls AES, SHA1, and SHA2 usage.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+"
+
+DEPEND="gmp? ( >=dev-libs/gmp-6.1:=[static-libs?,${MULTILIB_USEDEP}] )"
+RDEPEND="${DEPEND}"
+BDEPEND="
+	sys-devel/m4
+	doc? ( sys-apps/texinfo )
+	verify-sig? ( sec-keys/openpgp-keys-nettle )
+"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/nettle/version.h
+)
+
+DOCS=()
+HTML_DOCS=()
+
+src_prepare() {
+	default
+
+	# I do not see in config.sub reference to sunldsolaris.
+	# if someone complains readd
+	# -e 's/solaris\*)/sunldsolaris*)/' \
+	sed -e '/CFLAGS=/s: -ggdb3::' \
+		-i configure.ac configure || die
+
+	if use doc ; then
+		DOCS+=( nettle.pdf )
+		HTML_DOCS+=( nettle.html )
+	fi
+}
+
+multilib_src_configure() {
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		$(tc-is-static-only && echo --disable-shared)
+
+		# Intrinsics
+		$(use_enable cpu_flags_arm_neon arm-neon)
+		$(use_enable cpu_flags_arm_aes arm64-crypto)
+		$(use_enable cpu_flags_ppc_altivec power-altivec)
+		$(use_enable cpu_flags_x86_aes x86-aesni)
+		$(use_enable cpu_flags_x86_sha x86-sha-ni)
+		$(use_enable cpu_flags_x86_pclmul x86-pclmul)
+		# TODO: PPC crypto flag?
+		--disable-power-crypto-ext
+		# TODO: How do we detect this in ebuilds reliably?
+		--disable-power9
+		$([[ ${CHOST} == *-solaris* ]] && echo '--disable-symbol-versions')
+		# TODO: cpu_flags_s390?
+		--disable-s390x-vf
+		--disable-s390x-msa
+
+		$(use_enable asm assembler)
+		$(multilib_native_use_enable doc documentation)
+		$(use_enable gmp public-key)
+		$(use_enable static-libs static)
+		--disable-fat
+
+		# openssl is just used for benchmarks (bug #427526)
+		--disable-openssl
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/autocommand/autocommand-2.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/autocommand/autocommand-2.2.2.ebuild
index dd01be7233..1b6674a1e2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/autocommand/autocommand-2.2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/autocommand/autocommand-2.2.2.ebuild
@@ -20,6 +20,6 @@ SRC_URI="
 
 LICENSE="LGPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
index b2168118a1..b991cf2ed1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/crcmod/crcmod-1.7-r5.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{9..11} )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-0.29.34.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-0.29.34.ebuild
index 1c030e3fca..72900e9aaf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-0.29.34.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-0.29.34.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{9..11} pypy3 )
 PYTHON_REQ_USE="threads(+)"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta2.ebuild
index 7837d43a0e..a662c30596 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0_beta2.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{9..11} pypy3 )
 PYTHON_REQ_USE="threads(+)"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index d944a1b12a..fc6c809c69 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,2 +1,3 @@
 DIST docutils-0.17.1.tar.gz 2016138 BLAKE2B aa0b6525ba2e3eaebc17010806952ed5f40919876fcb813f50cc05b628dfd22e6073a9a4b2bfe989089ae68d9b7111ae3a97dda2bde5c0536f8fb76c0942fe29 SHA512 5ec2087116bd5356fdffc54f07f6b0355aac5fa9d6caeefa77e8d201fd4706c0d419193c4d9a3964ae493da3091fe2c7dc36b74f81a1e1b9282173658b06e71b
 DIST docutils-0.19.tar.gz 2056383 BLAKE2B 9983a905642de4e81ca118578671b503ddfda4bef1afcc0524de40543e1f9617fd8d768ef467da49d2f01076683400bad6a0fe15f6b5a3a1e202c42b2e34ab1b SHA512 fb904a899f2b6f3c07c5079577bd7c52a3182cb85f6a4149391e523498df15bfa317f0c04095b890beeb3f89c2b444875a2a609d880ac4d7fbc3125e46b37ea5
+DIST docutils-0.20.1.tar.gz 2058365 BLAKE2B 73fb8302599ffe57b0840c898b0b2e3ccd39ff9ea6eec2b5d345d02c950e1a8357bd821e62733b0484e82bc30e71d30fab381390b0edaef4375b02bcd9eeeb40 SHA512 a0ddca315d03677003036d6a8052ac96fbd3fcc4508564938ea684d79bedb4d322d83449c7b26e55b19b0aadd6e46ca9ac409bb16279a20f06c70e9c15ef5eb0
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild
index 94e3e8ca91..7aa4477abb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.17.1-r1.ebuild
@@ -6,14 +6,13 @@ EAPI=8
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{9..11} pypy3 )
 
-inherit distutils-r1
+inherit distutils-r1 pypi
 
 DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
 HOMEPAGE="
 	https://docutils.sourceforge.io/
 	https://pypi.org/project/docutils/
 "
-SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
 
 LICENSE="BSD-2 GPL-3 public-domain"
 SLOT="0"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1.ebuild
new file mode 100644
index 0000000000..b93993c2b7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.20.1.ebuild
@@ -0,0 +1,72 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
+HOMEPAGE="
+	https://docutils.sourceforge.io/
+	https://pypi.org/project/docutils/
+"
+
+LICENSE="BSD-2 GPL-3 public-domain"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+RDEPEND="
+	dev-python/pygments[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+"
+
+python_compile_all() {
+	# Generate html docs from reStructured text sources.
+
+	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
+	cp docutils/writers/html4css1/html4css1.css . || die
+
+	cd tools || die
+	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 \
+		--stylesheet-path=../html4css1.css, --traceback ../docs || die
+}
+
+src_test() {
+	cd test || die
+	distutils-r1_src_test
+}
+
+python_test() {
+	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
+}
+
+python_install() {
+	distutils-r1_python_install
+
+	# Install tools.
+	python_doscript tools/buildhtml.py
+}
+
+install_txt_doc() {
+	local doc="${1}"
+	local dir="txt/$(dirname ${doc})"
+	docinto "${dir}"
+	dodoc "${doc}"
+}
+
+python_install_all() {
+	local DOCS=( *.txt )
+	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
+
+	distutils-r1_python_install_all
+
+	local doc
+	while IFS= read -r -d '' doc; do
+		install_txt_doc "${doc}"
+	done < <(find docs tools -name '*.txt' -print0)
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit_core/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
similarity index 50%
rename from sdk_container/src/third_party/portage-stable/dev-python/flit_core/Manifest
rename to sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
index 836007983c..b951ff5fec 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/flit_core/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/Manifest
@@ -1 +1,2 @@
 DIST flit_core-3.8.0.tar.gz 41224 BLAKE2B 20d0b1e245280938b1edfa83531907775af9da30cc6e1446d578eafc7e14184d3c8fb80f446d265456ea5ea587c51edfdb706793a8894916525b3ebba322b3b0 SHA512 914804e3f2040762381afe039272d9d6fdbcd3f3cf8b9eea854f2f1d95edcb01718fd6685476bc1cdc251dfc46ef80b40f087df881d8b963dcc3f3332fd32a46
+DIST flit_core-3.9.0.tar.gz 41917 BLAKE2B 2fb053655a494736f5f9ce2d2c193d5d98622e410c0c0f18c92eb62d32ff98cbe830a1728461ed7e7e087d2fcf5f6a0c912717c2d534be688d688c4714c6865b SHA512 1205589930d2c51d6aa6b2533a122a912e63b157e94adba2a0649a58d324fa98a5b84609d9b53e9d236f1cdb6a6984de2cefcf2f11abc2cd83956df21f269ad6
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit_core/flit_core-3.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.8.0.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/flit_core/flit_core-3.8.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.8.0.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.9.0.ebuild
new file mode 100644
index 0000000000..020992e541
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/flit-core-3.9.0.ebuild
@@ -0,0 +1,35 @@
+# Copyright 2019-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_COMPAT=( python3_{10..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Simplified packaging of Python modules (core module)"
+HOMEPAGE="
+	https://pypi.org/project/flit-core/
+	https://github.com/pypa/flit/
+"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+
+RDEPEND="
+	dev-python/tomli[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? ( dev-python/testpath[${PYTHON_USEDEP}] )
+"
+
+distutils_enable_tests pytest
+
+src_prepare() {
+	rm -r flit_core/vendor || die
+	sed -i -e 's:from \.vendor ::' flit_core/*.py || die
+	distutils-r1_src_prepare
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/flit_core/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/flit-core/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/flit_core/metadata.xml
rename to sdk_container/src/third_party/portage-stable/dev-python/flit-core/metadata.xml
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/gentoo-common/gentoo-common-1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/gentoo-common/gentoo-common-1.ebuild
index c09fd9e6d2..2a8a5a6748 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/gentoo-common/gentoo-common-1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/gentoo-common/gentoo-common-1.ebuild
@@ -9,7 +9,7 @@ S=${WORKDIR}
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 src_install() {
 	insinto /usr/lib/python
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-6.0.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-6.0.4.ebuild
index e63aa05239..d8559bd91a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-6.0.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-6.0.4.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 RDEPEND="
 	>=dev-python/pydantic-1.9.1[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
index 5f070c043e..bf60d9f2be 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-text/jaraco-text-3.11.1.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 RDEPEND="
 	>=dev-python/jaraco-context-4.1.1-r1[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.9.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.9.0.ebuild
index 73480ddc15..bb2b12995a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.9.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lazy-object-proxy/lazy-object-proxy-1.9.0.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYPI_NO_NORMALIZE=1
 PYTHON_COMPAT=( python3_{9..11} pypy3 )
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.2.ebuild
index ffa5dfcbf7..6d7db74809 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.2.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( python3_{9..11} pypy3 )
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/Manifest
index 24d2598de7..b1844af9f7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/Manifest
@@ -1,2 +1 @@
-DIST MarkupSafe-1.1.1.tar.gz 19151 BLAKE2B 184ab0bc42f8d254ef4239f700f019c0a380bdf2117dfe1abe2eb4dfa0f037158d181a120d8654a6971e9c8badb078f997e3a8bf231898e0f4bb3e8496d9abd3 SHA512 f3014e6131a3ab866914c5635b5397ef71906bffb1b6f8c5f2ed2acf167429ff7914236d38943e872683a57a9be9669f4c5aace6274f3307ab21ef25373db0b6
 DIST MarkupSafe-2.1.2.tar.gz 19080 BLAKE2B 560cc052c105c3d9f2690c3e5a2a597dd36848080e3c7d6f8273dcd03bdb613ed54cfe6e53b9ec8053deb38d0d055123da7204a671c1fff3295596d44a63b317 SHA512 84dbeddaf2df713b3cce94eb64876fea8f80c608e25130c18e4691be2b1dea56df8b772d26c0caca88231ef795125eb9678210c33bf20518c18e3047912ddb4b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-1.1.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-1.1.1-r1.ebuild
deleted file mode 100644
index 731f52bbd4..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/markupsafe-1.1.1-r1.ebuild
+++ /dev/null
@@ -1,22 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python3_{9..10} pypy3 )
-
-inherit distutils-r1
-
-MY_PN="MarkupSafe"
-MY_P="${MY_PN}-${PV}"
-
-DESCRIPTION="Implements a XML/HTML/XHTML Markup safe string for Python"
-HOMEPAGE="https://pypi.org/project/MarkupSafe/"
-SRC_URI="mirror://pypi/${MY_PN:0:1}/${MY_PN}/${MY_P}.tar.gz"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="BSD"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris"
-
-distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/metadata.xml
index 8686ebe8cc..4677d7eddd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-python/markupsafe/metadata.xml
@@ -6,6 +6,7 @@
 		<name>Python</name>
 	</maintainer>
 	<upstream>
+		<remote-id type="github">pallets/markupsafe</remote-id>
 		<remote-id type="pypi">MarkupSafe</remote-id>
 	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
index 65c013231f..4e9786ade2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest
@@ -1 +1,5 @@
 DIST platformdirs-3.2.0.tar.gz 15017 BLAKE2B ce9f180965e0736ae83170b3a055dbb58e2ce59b84a414cd212f0f2f27a6a0a194636d315a30e344046ee1da85f2de3d2e7c58c02a329c4a36129fa617d8feb6 SHA512 2e4613f563b7014b526e1f81f561726a0060983b0e998ce46d070b2f4f4ec26ad46d6a3cd242fb14a420e6439207b9c9eeb31daac7ec65005abc3a74131e5cf8
+DIST platformdirs-3.3.0.tar.gz 15459 BLAKE2B 46b59ce32b262feef1e045803b79c64ade18917dac34b11bd34ec8a6c872e9871df948532e10a8c4ebfbfddf2592243d8f8be6b24a84e75c08c5948068337f94 SHA512 c7530daf27072b0dea2d9bdb2fd764fb1f19daa735b199d3361579ffed709ba55392502600f73b8433e2651d36711dc264cf60a6fa50f29d9249b1e9808e35a3
+DIST platformdirs-3.4.0.tar.gz 15735 BLAKE2B 6297b04dd8720ffa0af1899c2c8081c836d23d0526e6510a81fa727ca42d5006709d6e8bd583f09aade09f603c4489e21468b8c66d848220c8c6f1de37535e97 SHA512 e98648b5065cdb3b75c183548b4143c6564292e4ec283710490fd019a2e72f6207ac6af6617e192aadf17b521eebc18126bf4b69fac227ac3cda4b768ce109da
+DIST platformdirs-3.5.0.tar.gz 16037 BLAKE2B eef04e650c8028b87cc90fce02aed9259a6e4317b8445c429bbef1cb2ff1e6e6aae3c6dba38be2fed2e443cb4a7dc8c783345435ae922d0632e14823d7b80bfc SHA512 2c454a760b3045f4824b1c436ac85533e7a6809e4525d70cee4d98289f9efc5a882384347a1992aaa237dc29ea8e778515eadeca208a2d058f9e574f5175ce20
+DIST platformdirs-3.5.1.tar.gz 17164 BLAKE2B 7d9aeff02000b75a028e6f75dc4793e53bbe72b5fc069482d5790d9280a92b801dffca847fe64513b8ee3d24b5639681cb1cfcb1f97d85e8e996c7f6cbca2f71 SHA512 e3aa38bc943f9dc709dfaa3c6fe9e11f3b33d4263d1d41f7349d9926db2e41a36dd43c74ea2175ad89b107601f2dffded0f45e7703b9cb8ca9739945dee3c6fb
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.3.0.ebuild
new file mode 100644
index 0000000000..58e26b5de9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.3.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{9..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.4.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.4.0.ebuild
new file mode 100644
index 0000000000..58e26b5de9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.4.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{9..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.0.ebuild
new file mode 100644
index 0000000000..58e26b5de9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.0.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{9..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.1.ebuild
new file mode 100644
index 0000000000..58e26b5de9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-3.5.1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{9..11} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest
index 391179a2a7..e7a07de2a6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/Manifest
@@ -1,2 +1 @@
-DIST pydantic-1.10.6.gh.tar.gz 902014 BLAKE2B ba3a3896cdcd2eecc7bd4e6ad979846de377c94d939519889752b36827eba7b3d245943ba192dd80925c2aa09ef02243aaae5e990a6f7b1ab9a8d0b5ba9830c4 SHA512 094fda0158faeb6021632f7ce3ea2570c19ddb288260d4e0f5a4361ab2684a68b0e6212264b37a4a75166746570098d1c4aa0311797d2cf1a22cef2c1e1f0137
 DIST pydantic-1.10.7.gh.tar.gz 903379 BLAKE2B b2dd75a640ca54024a2bf141117a1d738a30a4630bed8f4d0169fc5a6a55ded719727d88c7e78b9a2acc3aec68482e9be8c8bf4776fef668fe4acc3e1fd775df SHA512 948a7935b374719773df50243aed708b3c6789243b9aa0ba239cf1502ddd0e0cec4d701e108f1cc78090c088f3cb1c78b840c39f5e7ad0e61739776f552f284d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.6.ebuild
deleted file mode 100644
index f7eed6cd5d..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.6.ebuild
+++ /dev/null
@@ -1,82 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 python3_{9..11} )
-
-inherit distutils-r1
-
-MY_P=${P/_beta/b}
-DESCRIPTION="Data parsing and validation using Python type hints"
-HOMEPAGE="
-	https://github.com/pydantic/pydantic/
-	https://pypi.org/project/pydantic/
-"
-SRC_URI="
-	https://github.com/pydantic/pydantic/archive/v${PV/_beta/b}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
-IUSE="+native-extensions"
-
-RDEPEND="
-	>=dev-python/typing-extensions-4.1.0[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	native-extensions? (
-		dev-python/cython[${PYTHON_USEDEP}]
-	)
-	test? (
-		dev-python/hypothesis[${PYTHON_USEDEP}]
-		dev-python/pytest-mock[${PYTHON_USEDEP}]
-		dev-python/python-dotenv[${PYTHON_USEDEP}]
-		>=dev-python/python-email-validator-1.2.1[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	sed -i -e '/CFLAGS/d' setup.py || die
-	distutils-r1_src_prepare
-}
-
-python_compile() {
-	if [[ ${EPYTHON} == pypy3 ]] || ! use native-extensions; then
-		# do not build extensions on PyPy to workaround
-		# https://github.com/cython/cython/issues/4763
-		local -x SKIP_CYTHON=1
-	fi
-	distutils-r1_python_compile
-}
-
-python_test() {
-	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
-	local -x PYTEST_PLUGINS=pytest_mock
-
-	local EPYTEST_DESELECT=(
-		# flaky test, known upstream
-		tests/test_hypothesis_plugin.py::test_can_construct_models_with_all_fields
-		# mypy linting causes regressions with new mypy versions
-		tests/mypy
-	)
-	case ${EPYTHON} in
-		pypy3)
-			EPYTEST_DESELECT+=(
-				tests/test_private_attributes.py::test_private_attribute
-				tests/test_private_attributes.py::test_private_attribute_annotation
-				tests/test_private_attributes.py::test_private_attribute_factory
-				tests/test_private_attributes.py::test_private_attribute_multiple_inheritance
-				tests/test_private_attributes.py::test_underscore_attrs_are_private
-			)
-			;;
-	esac
-	rm -rf pydantic || die
-	epytest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.7.ebuild
index 1189c74a6b..4c4bf70203 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pydantic/pydantic-1.10.7.ebuild
@@ -3,6 +3,7 @@
 
 EAPI=8
 
+DISTUTILS_EXT=1
 DISTUTILS_USE_PEP517=setuptools
 PYTHON_COMPAT=( pypy3 python3_{9..11} )
 
@@ -22,7 +23,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="+native-extensions"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
index 368079cb8b..9d82f24750 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest
@@ -1,3 +1 @@
-DIST Pygments-2.14.0.tar.gz 4434562 BLAKE2B a3050bae96a8ae044f803e7964b5dede7a73b04f04f6af9d4b9e4d24e3ae0185138d0d68801ee5ac81cdaf74e50c7fea303913470c23182adb30ff2c08c332a8 SHA512 51416a8e2a8d0288cbbf6fd81e6870ffe9d999da255c43d0f870eb5cb4d01660416d136d39fad38b76c4bace3c3aa648fb306519e85e340545a87fc657aaeb15
-DIST Pygments-2.15.0.tar.gz 4818485 BLAKE2B c7890910d3c62803f48e52192ffec636343302bdb54f82fd0863bdd1b1fd9f437a4e714f39e955f8666f3ed50ee9b576373aabfde9231c9b3bb6d41453a6252c SHA512 5b9ca24ded1a16ea68d77d727ead635b3555c4c3dece735fb6c122aaef49b9f50bb8ef462cd60aac43eff88ed32415ec8e432e0ac5677bc02c14670f2aef97e4
 DIST Pygments-2.15.1.tar.gz 4819591 BLAKE2B f42d3342b88c5b5745fbfbd1f76913f7d17745d396311a39627aca8e968445b19983e7c633583097c495ce6f43a6a7224262a7c35645751803b6c1172062d8c0 SHA512 408f0bbbc8226ee91b82ed084d178f114657150bcf9381dd34debb704399ccdb2e78cb5578ff297797771660d7263c51c305d03b2a27ae29269110be0bca50a9
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.14.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.14.0.ebuild
deleted file mode 100644
index 6a612a3384..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.14.0.ebuild
+++ /dev/null
@@ -1,38 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYPI_NO_NORMALIZE=1
-PYPI_PN=${PN^}
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
-
-inherit distutils-r1 bash-completion-r1 pypi
-
-DESCRIPTION="Pygments is a syntax highlighting package written in Python"
-HOMEPAGE="
-	https://pygments.org/
-	https://github.com/pygments/pygments/
-	https://pypi.org/project/Pygments/
-"
-
-LICENSE="BSD-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-BDEPEND="
-	test? (
-		dev-python/lxml[${PYTHON_USEDEP}]
-		dev-python/pillow[${PYTHON_USEDEP}]
-		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
-		virtual/ttf-fonts
-	)
-"
-
-distutils_enable_tests pytest
-
-src_install() {
-	distutils-r1_src_install
-	newbashcomp external/pygments.bashcomp pygmentize
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.0.ebuild
deleted file mode 100644
index 18d730b243..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.0.ebuild
+++ /dev/null
@@ -1,43 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYPI_NO_NORMALIZE=1
-PYPI_PN=${PN^}
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
-
-inherit distutils-r1 bash-completion-r1 pypi
-
-DESCRIPTION="Pygments is a syntax highlighting package written in Python"
-HOMEPAGE="
-	https://pygments.org/
-	https://github.com/pygments/pygments/
-	https://pypi.org/project/Pygments/
-"
-
-LICENSE="BSD-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-
-BDEPEND="
-	test? (
-		dev-python/lxml[${PYTHON_USEDEP}]
-		dev-python/pillow[${PYTHON_USEDEP}]
-		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
-		virtual/ttf-fonts
-	)
-"
-
-EPYTEST_DESELECT=(
-	# fuzzing tests, very slow
-	tests/test_basic_api.py::test_random_input
-)
-
-distutils_enable_tests pytest
-
-src_install() {
-	distutils-r1_src_install
-	newbashcomp external/pygments.bashcomp pygmentize
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.1.ebuild
index 18d730b243..7ee548a6c8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.15.1.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="BSD-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 BDEPEND="
 	test? (
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 3c8d70f364..7393c222a0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,3 +1,5 @@
 DIST setuptools-67.6.1.tar.gz 2486256 BLAKE2B 7827eec689b6a4463888137660489a29cd6aa67a14f0cf42ece78463788d74b97bd951b75c48c185c5c33d5bea29c44c8660649bf79035012bc75b915e9d0a42 SHA512 197910ad4c4058af0107e240d2e27bc2c1ff373cb3fba33af09eb3cc42614c45e4bb73a65802f253466eafd94517e08b51e98f50213817ad03d88ee0ccf9adbc
 DIST setuptools-67.7.0.tar.gz 2491327 BLAKE2B 3d1e89cf5b2753883397ff3a668dbfcef41c57775bd1871ada69c11a7deffe53fd4c4036b5c98146ec0496b1be86df1522c64cc981acb5ec192bd93bd800c2de SHA512 39502337b5d7f710c55219ab970a5cab23e8987598af722ad231d2dea2e1dfaaddb09dc698a5746a719b36e5e3065c48ecee2ac428e4d41470bec6ad3c99daf6
 DIST setuptools-67.7.1.tar.gz 2491346 BLAKE2B 2eb89badcbfec51fb3deca5f4267036305569bf42677b87c9eeb7cecd902c121ffc6725506bfa0ba3ac50e06c036a520dd14b6193ff048e21ed80dfeb1c93602 SHA512 c90a6ad0c215540dfd93d5c88126dab15499deb80ed601f4a90c92dfdff5fed6ff168fb8e6b9dc5ba8b1f067114d383400df390b2eebd934e2e728c3b56886af
+DIST setuptools-67.7.2.tar.gz 2491608 BLAKE2B bd77a85081e95813cdd8fc1f63b768c73036b2f49103defcfd09ba9df7b2c5dba84d4f1aca553e0642ab8d764ae390310f1c6bebbae31736d1b5c16802cdc0e5 SHA512 06db096193ef52111f064c327daefb12ea2bb2ebc6712436bae01f986165455fe89a1d2220cbaaa6391a182e2aee19b9cf7a709c158af8c5ab6232dfbc258bd9
+DIST setuptools-67.8.0.tar.gz 2492475 BLAKE2B 37c34605a58b41e14300e389402fe6debf9eeed20c72ddf53fa798b41484d1522d2b5313c74eb69a687eaf32c225f0931f901f452aebf6f7023b2419d127b808 SHA512 5dda7082fc563ce73d810efc9cdbccb8649fef2eac52f1a902c76ab5ec67a87ff64e36e918d0e3b168f5214d787bdc22e8ef9adeccb77d8d368dcbb48f5fb35d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.7.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.7.2.ebuild
new file mode 100644
index 0000000000..874467a94f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.7.2.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{9..11} pypy3 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 multiprocessing pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/nspektr-0.3.0[${PYTHON_USEDEP}]
+	>=dev-python/ordered-set-4.0.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-21.3-r2[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/importlib-metadata-4.11.1[${PYTHON_USEDEP}]
+	' 3.9)
+"
+BDEPEND="
+	${RDEPEND}
+	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/build[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.9[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-fixture-config[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-virtualenv[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+			dev-python/wheel[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+PDEPEND="
+	>=dev-python/certifi-2016.9.26[${PYTHON_USEDEP}]
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+"
+
+DOCS=( {CHANGES,README}.rst )
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}"/setuptools-62.4.0-py-compile.patch
+	)
+
+	distutils-r1_src_prepare
+
+	# remove bundled dependencies, setuptools will switch to system deps
+	# automatically
+	rm -r */_vendor || die
+
+	# remove the ugly */extern hack that breaks on unvendored deps
+	rm -r */extern || die
+	find -name '*.py' -exec sed \
+		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
+		-i {} + || die
+}
+
+python_test() {
+	local -x SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
+		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
+		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
+		setuptools/tests/test_virtualenv.py::test_clean_env_install
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		setuptools/tests/test_extern.py::test_distribution_picklable
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		setuptools/tests/test_editable_install.py::test_editable_with_pyproject
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# fails with importlib-metadata-6.6.0
+		setuptools/tests/test_egg_info.py::TestWriteEntries::test_invalid_entry_point
+	)
+
+	if has_version "<dev-python/packaging-22"; then
+		EPYTEST_DESELECT+=(
+			# old packaging is more lenient
+			setuptools/tests/config/test_setupcfg.py::TestOptions::test_raises_accidental_env_marker_misconfig
+		)
+	fi
+
+	epytest -n "$(makeopts_jobs)" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0.ebuild
new file mode 100644
index 0000000000..d60048548d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-67.8.0.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..11} pypy3 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 multiprocessing pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/nspektr-0.3.0[${PYTHON_USEDEP}]
+	>=dev-python/ordered-set-4.0.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-21.3-r2[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/importlib-metadata-4.11.1[${PYTHON_USEDEP}]
+	' 3.9)
+"
+BDEPEND="
+	${RDEPEND}
+	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/build[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.9[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-fixture-config[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-virtualenv[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+			dev-python/wheel[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+PDEPEND="
+	>=dev-python/certifi-2016.9.26[${PYTHON_USEDEP}]
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+"
+
+DOCS=( {CHANGES,README}.rst )
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}"/setuptools-62.4.0-py-compile.patch
+	)
+
+	distutils-r1_src_prepare
+
+	# remove bundled dependencies, setuptools will switch to system deps
+	# automatically
+	rm -r */_vendor || die
+
+	# remove the ugly */extern hack that breaks on unvendored deps
+	rm -r */extern || die
+	find -name '*.py' -exec sed \
+		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
+		-i {} + || die
+}
+
+python_test() {
+	local -x SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
+		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
+		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
+		setuptools/tests/test_virtualenv.py::test_clean_env_install
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		setuptools/tests/test_extern.py::test_distribution_picklable
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		setuptools/tests/test_editable_install.py::test_editable_with_pyproject
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# fails with importlib-metadata-6.6.0
+		setuptools/tests/test_egg_info.py::TestWriteEntries::test_invalid_entry_point
+	)
+
+	if has_version "<dev-python/packaging-22"; then
+		EPYTEST_DESELECT+=(
+			# old packaging is more lenient
+			setuptools/tests/config/test_setupcfg.py::TestOptions::test_raises_accidental_env_marker_misconfig
+		)
+	fi
+
+	epytest -n "$(makeopts_jobs)" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild
index 2aad99caa0..482fefe4c7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild
@@ -27,7 +27,7 @@ RDEPEND="
 	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
 "
 BDEPEND="
-	>=dev-python/flit_core-3.8[${PYTHON_USEDEP}]
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
 "
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
index fece6e6a0b..74a0f38c31 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-9999.ebuild
@@ -27,7 +27,7 @@ RDEPEND="
 	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
 "
 BDEPEND="
-	>=dev-python/flit_core-3.8[${PYTHON_USEDEP}]
+	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
 "
 
 distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.1-r1.ebuild
index 5d9dfe5d02..c16784aaae 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/tomli/tomli-2.0.1-r1.ebuild
@@ -22,7 +22,7 @@ SRC_URI="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 BDEPEND="
 	app-arch/unzip
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.5.0.ebuild
index b725951f59..7210d9e348 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.5.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.5.0.ebuild
@@ -22,7 +22,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="PSF-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 distutils_enable_tests unittest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
index 2083bea69d..62b3436b26 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/Manifest
@@ -1,3 +1,4 @@
 DIST linux-6.2.tar.xz 136430892 BLAKE2B 05b63254734ea685db437cb1c00a6da63eee74d7e99f4ed2d074aaa01ac4487813ab297d337a6855cdbcbb33346b631c4256ee3b06191adfb1be3615a56bdd6d SHA512 a01bee0b968b95183934fe3504516be7ef5811944a061f5aed05ecebaa27b5eb64e33232fd0a8dd622b3c8743bfe462ef7e464d381734d111a0ad6a6d9f66ddd
+DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
 DIST patch-6.2.1.xz 5688 BLAKE2B 383ad7820e2b581b35c7b33e272782c1ea9588e050b2e306b7a31e82984c49f6da55dd10908c6c2d5cf0b524a7cfacc08b3ce0279e4ccd96286463ae28cb5e90 SHA512 e5777e2cb124ba5899c330135b25aaa4d612fed4af2230214c2311fe6ca03825e9c3f9be7ed84ac3712db6a4aad4fed43e88cbbf3d7b33d8d98000cba78f9085
-DIST patch-6.2.11.xz 683356 BLAKE2B e77dabcfb28aa22afcfd57c80508d345497ae95c176e49112136e67f914013d9480c55395992a0a8ee4c02f61354af78de2db13ea92d0f0b8bd220b2404c8cda SHA512 86fb459cd07b023014ec82f030189c732bb3717715b644f3b6012537465a26b9bda164b8f4a57e121a914ae7cae8209473505300ecd8c14d035266e7cf22dac6
+DIST patch-6.3.xz 8617176 BLAKE2B cab9b9b3e3a97c425e186e2390b7753e77740a8a7286ba8f8fd88527c1d2e6ee22b0d27510c5ea065e73161ac1f9a178251585ffa8d2648595c92e831cf1fee3 SHA512 4a7228e9d89633d3cb14af2dd7419eb625b765b70b95e4149ff1aff6367fb2490d5bd16d6399da33a0b85c32a8dafa2c2cb2e3695aec335f4d3a2813ca52c9f4
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.2.11.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.3.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.2.11.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.3.ebuild
index 5e04ebcc3c..7df12a6556 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.2.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/bpftool/bpftool-6.3.ebuild
@@ -86,11 +86,6 @@ src_prepare() {
 		popd || die
 	fi
 
-	pushd "${S_K}" >/dev/null || die
-	# bug #890638
-	eapply "${FILESDIR}"/5.19.12-no-stack-protector.patch
-	popd || die
-
 	# dev-python/docutils installs rst2man.py, not rst2man
 	sed -i -e 's/rst2man/rst2man.py/g' Documentation/Makefile || die
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.22-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.22-r1.ebuild
index fee73e953a..116f53d905 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.22-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-3.0.22-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -9,10 +9,10 @@ if [[ ${PV} == *9999* ]]; then
 	EGIT_BRANCH="master"
 else
 	SRC_URI="https://gitweb.gentoo.org/proj/catalyst.git/snapshot/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
-PYTHON_COMPAT=( python3_{9..10} )
+PYTHON_COMPAT=( python3_{9..11} )
 DISTUTILS_USE_SETUPTOOLS=no
 
 inherit distutils-r1 ${SRC_ECLASS}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-9999.ebuild
index 537719e862..75ea55a47e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/catalyst/catalyst-9999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 if [[ ${PV} == *9999* ]]; then
 	SRC_ECLASS="git-r3"
@@ -12,7 +12,7 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
-PYTHON_COMPAT=( python3_{9..10} )
+PYTHON_COMPAT=( python3_{9..11} )
 DISTUTILS_USE_SETUPTOOLS=no
 
 inherit distutils-r1 linux-info optfeature tmpfiles ${SRC_ECLASS}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
index d51df51889..2de6263de2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
@@ -2,19 +2,15 @@ DIST cmake-3.24.3-SHA-256.txt 1646 BLAKE2B 739503a16c2e333c9b05a3232e2dcc56105f6
 DIST cmake-3.24.3-SHA-256.txt.asc 833 BLAKE2B f8797072c2d30facfbbebc972c68cd1a6510331e63c67e6b665bd97dd9013e354bab68e03d578698d2f9e50c173ff8e1cac40751c7a3645be294a717f4bfee3a SHA512 bc67eaf6dba935df85ae3d7c37600259b032579813b275087332d5cc4c72dd6bdf44762260729a15f237f69f772670291bb2f2dcc4b155fb17112e0e8fa01d6b
 DIST cmake-3.24.3-docs.tar.xz 492156 BLAKE2B 92edd031189673c46e8e13a5e1200917734b918651dc01d982c25602e48cd5d5f014fa8563bdc79b3d09d90ef07a52c9d5a570a5181c59c233ba5bf450cdd5df SHA512 75806743fca976098b9b7ee777c494478142ab5686dc8ccb18510b5938c7e88cf8b3bc47321022f55f33c04bb0a7f549d70be8c765d1ec143467e679c8863132
 DIST cmake-3.24.3.tar.gz 10399876 BLAKE2B 24e2ff8cf4f63ba182dd305c14367fa0163f6187da84f7ec10b1ad6241c7df5b48f329b67ba5f7b5d3b644cba89c7adb848a3ae7196bf5b4dbfaedf178dba250 SHA512 57edf2a8c1c9edeed7fd11271083f333d940b31e0e909d9c71671465961559c505e4e22f36e68bfe1a40a01eb05fe94bc8d37b062f9be613f959f864207e3764
-DIST cmake-3.25.2-SHA-256.txt 1646 BLAKE2B 10289acf1a74e45ad1109bb0759ce82024553947ff60c8358854f26d276e89155df9b44561adee4b838d95fb2fcb54b4d2ca1e957b35a90ee80ea56dc63d94be SHA512 75d6a0c4c9350ad466559f44f56f2d18308cdfbaba24da3c86950c9bfb4861f9486f031b41206de83019850944081f304953dbd04b55501ea7b3912aabfb1e00
-DIST cmake-3.25.2-SHA-256.txt.asc 833 BLAKE2B 823c1132836529c3ca1c9060f504ad9904169621e3284c489b92f6334454ffa82791d336c78a27e705eca686e63131aed249c44e61b5f7fb915e80cca0155edc SHA512 16d5f8e0071db7f29b2f502b8a26e71e73519980555f64a548f1b3d5e917ec377cdfa49a4750dffde952e6b818dd37d000992bf67b553902b2117809f02b9486
-DIST cmake-3.25.2-docs.tar.xz 500144 BLAKE2B 9f45daf51c3acddce8e273649cd7445d00324883f2feccc98632a35d2ba72e7f6fd286f65bc362969f41d13cd5f34881aac8a229c9f6533caf0d86e1092075a8 SHA512 191daffb9a244fac79700bb0d21b3d65c7b94685dafd589122d37017660d13768e3e3257170bbfe46871efc59da6e7e2fcad0ce860cf87f1dc149c80df73cf91
-DIST cmake-3.25.2.tar.gz 10561266 BLAKE2B ca093cf0b2a0254494965c8b46ab188024b6d745cd56461451f4fa023fbb4f2cca7077877f1698c082d8a3b52c898d6f793657d8da3879f19f7b24139cbab7f0 SHA512 20146d06a1722c36249192944a58e4780aad334d2bc5ce2a3d8c4f24656630c5b71ca0ae7ed53587e3d46f488bd773452fa60c3fc7045fe54db2dbc6ffd86390
 DIST cmake-3.25.3-SHA-256.txt 1646 BLAKE2B 2b4febaa4c486f42c773621efe5ab3ff903578373c3df3ed060add6b42f1d16fe760a4b8825bf753ef0f72fe4584ffb3130a2ffc9397b12a93e1f14d5fba6128 SHA512 8d2f39c50206f6912ad575507f3172fb87b425f461990ba0f703c85b152aaa0bccb9d72a2e7dd38449b3c40bb7a1664ba9f4d5879d96c1928bb77effdcf25ada
 DIST cmake-3.25.3-SHA-256.txt.asc 833 BLAKE2B 7db637e3383915cb659b176ffc72508460ef73a245dc5ff99d9ba2649d8db0666e04ff2d428fefaa86cd14a07047bc7b7df0e0bed91ac80d9a8bb993f1d70102 SHA512 26f6c584d8f8bb44fc10b227f81ef3655d35140a1825270877e2be5460e4f0bfa92ca7d7186f55ef08085814c7f79e50cfc9cd7ba9880620aba25661ed1f75ac
 DIST cmake-3.25.3-docs.tar.xz 500216 BLAKE2B 5c6474328e2bfa17f5aa39693dabb19f33ac1f6875119e41d60f97c94bf1441b9d9528e96e4dd36d5d68e711c4bf4d32fe84a454df796755eccb1483fa55e3c8 SHA512 6e9ce5fc545324c327d8216dbbc316bbd5966640ae2b3e17ada00926004d55df75c5d25e6590ed53a8033d9638c5b6282bedd115ddf28b27980a80e40a3cba0c
 DIST cmake-3.25.3.tar.gz 10562254 BLAKE2B b7ae9f129731da30f89967eac20bdfcebd9c4f6ca3b28decc2016ab18292e4b51eb5a43b5797f874e23e64e1d01eeb98b18a927035aab8edc63a069f1bfce32b SHA512 ebcb5616ca418fe164863b157f67cff6e8c49b0f8f723c0bd219466211f3cfe8b93c4b3ad0fe6d2d3772881fd867b0905340945156f6d70a9ea08bfb7eb98550
-DIST cmake-3.26.2-SHA-256.txt 1646 BLAKE2B 8b82cc9b837363e2522f4d984b7be53d795475e8f3f0e0c796dbca6da7e8b61121175efd736c437afff46656416988f83abdbb9a98cfaff8dfb65fc256c1b8cb SHA512 5227027f386ac9adaf6cad7638c424a4e4ed99fa04fa53634e462e88a93b2b14dc99e0a7c18162fe438327197f9df185e83cf9e09d06d7bc4575ae11d67a7ac6
-DIST cmake-3.26.2-SHA-256.txt.asc 833 BLAKE2B f59a215131314c9d0a5c6659e8e287b749da4fba5de08b965734192e7787e9439e0566fd3e61b3091d7ff678bd2a8ec66e0e87f74938e77a25a34e3a7f20f07e SHA512 b9187ac43687caf9bcd8d3ed3922efe4ffc30d5c9d282d0549d0f22aedd1c23d2aab158117c212febc4917d74eed89836ebdd9948cf20318dcb021ce71acb049
-DIST cmake-3.26.2-docs.tar.xz 507664 BLAKE2B 7f73c18e9e3d22a0e9f0d9fdfae3c35fd8e92aec1cccd4fecb552e6b42187b8eb4ab16977233f5536fca62dc91064d857f1e7b076ec8547b1ec283fe404ed381 SHA512 1130301ecaa608df3b927052c06d18b2ef67b1de1b2011a06072f70255204fb40928325c15c2cd3363dd88fe27b66e2805763eb9cb58bc3474d6d05d436f3b36
-DIST cmake-3.26.2.tar.gz 10669169 BLAKE2B 7d77de6d44af0f26f299fdfdfa100a1d45af63996d704c8b76e40e3860ef08cc7864b05ebaad2e59844326856ff54984f505eb2d195d68d88acb98e5a72977bb SHA512 7f4eefbffce2bad241261583b0b8962519dc266fa0c6c5ea6917a785eb2b81ebeda637ed9035965a43e9f89f072bc509d4583b5d595a7b72f5e54bb5170f7c9c
 DIST cmake-3.26.3-SHA-256.txt 1646 BLAKE2B 687b488818da6ae557e3b4f297fa560bfdca34fa61d57ccabe0469ce5110c8c134f4f705a33258677dc9073c685844aed5b6dc586b774041662a759c55674720 SHA512 14b37bfb4cff8c05d4e715e752c8f2cc2e32a09eaadf1b587549e91937a97bddb3d16654466052a5a5f8a43a790c24266d87add2a37e86040fb3416fe6042a58
 DIST cmake-3.26.3-SHA-256.txt.asc 833 BLAKE2B 247689511e634d6383b1a3b6fc8c2fe5977dad21375c79bfd9541ab8fdf6a50fa0b2008018acae85593ce1513fe2d582e30c37ba1a8f380729d68c9e6077dcdc SHA512 623dba2d086ab03e3fd4b8b6e57704eb60774a6b5f2944089d9a2f0c9052345a781b9f8b93b782b00ebe3c4cf65c142ce20d0882c3d516c05e05271507073431
 DIST cmake-3.26.3-docs.tar.xz 507560 BLAKE2B 1859321d884d518c849082fcbd293656c32a0b1abc40da577be342b5bf165a6ae9a8d9316a1fe937f83a566db7732725dc9eb10de076eedd7a368564e26859b2 SHA512 30cbba92d46437b2daa2390321eb4b34f46330baa80e536b947bb5200b1b30512873aa90052208e4bb181ad6181e671d9ab883637a0dbaeb73601840b5355c69
 DIST cmake-3.26.3.tar.gz 10668855 BLAKE2B c105b19d49ac47d0a9fdfee7908c64db3bfe82d57cfb342c76938fa824a1413d7215b56a7407ac35dfcbd0d7a9e47dd631bd52d45aa097ac7d96b493bcfa64b4 SHA512 b09447318512b91c772e36c764049789224032c6c650289a94f6311f999ca104b617bf2dced57b723da23472f015549affabd9c8c076857490c47a1aee7eb7a0
+DIST cmake-3.26.4-SHA-256.txt 1646 BLAKE2B a92cecbe635cb7a01be338ca9554de5603124d5f2acaf6882090cab40af0cfbce4c6d95046262f00dc5f2ab730a32669d8d0199da9979e8adf7c81b162652950 SHA512 a7f141f75695b3594b8f5f834edf777e7877b8a33cdca602f9645568426043e634457e6ea5720ed019288e8900960c83f08789a9db7f6e9053416b235bb64e0c
+DIST cmake-3.26.4-SHA-256.txt.asc 833 BLAKE2B c33f4d8cc1ba271a06b427e4bb5cb39e38f768c497aec6df07ffe9f7be997c5df88024e0de09902e6169cbad9020b20f024ef277cefc45b5cd172ed7a819e1bb SHA512 d3ddbe0c31a1093dfd4bed26dae7959e5682d367695fd4f6f021e327b8335d33fcf7b0259149f449be82da224ee74c276b135ac2860917535fb5a19b4f0f6334
+DIST cmake-3.26.4-docs.tar.xz 507352 BLAKE2B 9d7e4bb2292d22f93c5435e30317cb0701dc9c6ad6b397fc9108050217917f48ded84b2d6094782e2e8a502e693a8e45c5c659e65db3857dbcac261910890861 SHA512 95ef908381501bd8189113a7a520e70d81dbb4e1f416cfe38cbf7005e76f3571b964496d33980975835ff02634f85e1eb170a575e0ea30bfa749043cad84c605
+DIST cmake-3.26.4.tar.gz 10669686 BLAKE2B 34508c724e0d4967e010917f6fac6f426b0d835c38cd197b64e70a18febee1c3efff5f5edc5cd7c5080881bd5c1d77d03243b5dcf8b47f238fa4ac4e5996072f SHA512 fe817c8d5e247db3f0a9a58ee37c466a47220100d9e90711cd5d06c223cef87e41d1a756e75d1537e5f8cd010dcb8971cbeab4684b1ac12bcecf84bf7b720167
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.2.ebuild
deleted file mode 100644
index 35212b661e..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.2.ebuild
+++ /dev/null
@@ -1,293 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake elisp-common flag-o-matic multiprocessing \
-	toolchain-funcs virtualx xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == 9999 ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-
-		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="CMake"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} emacs ncurses qt5 test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.16.0_rc4-darwin-bundle.patch
-	"${FILESDIR}"/${PN}-3.14.0_rc3-prefix-dirs.patch
-	"${FILESDIR}"/${PN}-3.19.1-darwin-gcc.patch
-
-	# Handle gentoo packaging in find modules
-	"${FILESDIR}"/${PN}-3.17.0_rc1-FindBLAS.patch
-	# Next patch needs to be reworked
-	#"${FILESDIR}"/${PN}-3.17.0_rc1-FindLAPACK.patch
-	"${FILESDIR}"/${PN}-3.5.2-FindQt4.patch
-
-	# Respect python eclasses
-	"${FILESDIR}"/${PN}-2.8.10.2-FindPythonLibs.patch
-	"${FILESDIR}"/${PN}-3.9.0_rc2-FindPythonInterp.patch
-
-	"${FILESDIR}"/${PN}-3.18.0-filter_distcc_warning.patch # bug 691544
-
-	# upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif ! use verify-sig || [[ ${PV} == *_rc* ]] ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
-
-	cmake_src_configure
-}
-
-src_compile() {
-	cmake_src_compile
-	use emacs && elisp-compile Auxiliary/cmake-mode.el
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actualy bootstrap it every time so why test it.
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	virtx cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	if use emacs; then
-		elisp-install ${PN} Auxiliary/cmake-mode.el Auxiliary/cmake-mode.elc
-		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.3.ebuild
index f2777145da..35212b661e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.25.3.ebuild
@@ -47,7 +47,7 @@ else
 			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
 		)"
 
-		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.3.ebuild
index a2b661bbcd..da765ef9cb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.3.ebuild
@@ -48,7 +48,7 @@ else
 			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
 		)"
 
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
 	fi
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.2.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.26.4-r1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
index ccac97275a..37d2aa1b2b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
@@ -1,3 +1 @@
-DIST glib-2.74.6.tar.xz 5217312 BLAKE2B 07b0a5cb74c1451ba863d5f9a781a122d3d20af1f1227177025de114279277cacada3dd6ab5eb5ad5c0bff5ac7abab6fdfbe0551f44d07b2ddc9141a0640a8c8 SHA512 6b6d113012ec90f6cf77513ec0132668c49aa7224c806181ad662388701004667cdf6d263050d6f896b8688c085abf461aa3e659eb288e6ba93ba4970a2f181b
-DIST glib-2.76.1.tar.xz 5270936 BLAKE2B 6e6d15bda7ca6365d5f33e197cad41043f17c2f505997953e4f5222121571dabfa07ac88d0a1e298313021c63ef97e7560128c3f8ddf7f518afba98692555e81 SHA512 7ab8740925fa4ed2d860a35544c475ae905df5fa7fc0cc64ffa8c543df6073794e44c8ff39e3e1de1d677016ef9d27e9bc709d2505d13090faa8d6c47cd64bd0
 DIST glib-2.76.2.tar.xz 5273836 BLAKE2B db5d5e45fe4a17bade7f5bf923ac0e5541237d19146ede33b4d52f05b82e4ecb94519393f49ac3b04e17d0f56bfd5dd99b8e81ae80956cfdb5cb2396cd5ec8cc SHA512 5a99723d72ae987999bdf3eac4f3cabe2e014616038f2006e84060b97d6d290b7d44a20d700e9c0f4572a6defed56169f624bcd21b0337f32832b311aa2737e6
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.74.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.74.6.ebuild
deleted file mode 100644
index d4ca839d30..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.74.6.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-GNOME_ORG_MODULE="glib"
-PYTHON_COMPAT=( python3_{9..11} )
-PYTHON_REQ_USE="xml(+)"
-DISTUTILS_USE_PEP517=setuptools
-DISTUTILS_SINGLE_IMPL=1
-
-inherit gnome.org distutils-r1
-
-DESCRIPTION="GDBus code and documentation generator"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2+"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-S="${WORKDIR}/glib-${PV}/gio/gdbus-2.0/codegen"
-
-python_prepare_all() {
-	PATCHES=(
-		"${FILESDIR}/${PN}-2.56.1-sitedir.patch"
-	)
-	distutils-r1_python_prepare_all
-
-	local MAJOR_VERSION=$(ver_cut 1)
-	local MINOR_VERSION=$(ver_cut 2)
-	sed -e 's:@PYTHON@:python:' gdbus-codegen.in > gdbus-codegen || die
-	sed -e "s:@VERSION@:${PV}:" \
-		-e "s:@MAJOR_VERSION@:${MAJOR_VERSION}:" \
-		-e "s:@MINOR_VERSION@:${MINOR_VERSION}:" config.py.in > config.py || die
-	cp "${FILESDIR}/setup.py-2.32.4" setup.py || die "cp failed"
-	sed -e "s/@PV@/${PV}/" -i setup.py || die "sed setup.py failed"
-}
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/glib-utils)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	distutils-r1_src_compile
-	do_xsltproc_command "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.xml" "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
-
-src_test() {
-	einfo "Skipping tests. This package is tested by dev-libs/glib"
-	einfo "when merged with FEATURES=test"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all # no-op, but prevents QA warning
-	doman "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.1.ebuild
deleted file mode 100644
index 787dfc5d3d..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.1.ebuild
+++ /dev/null
@@ -1,72 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-GNOME_ORG_MODULE="glib"
-PYTHON_COMPAT=( python3_{9..11} )
-PYTHON_REQ_USE="xml(+)"
-DISTUTILS_USE_PEP517=setuptools
-DISTUTILS_SINGLE_IMPL=1
-
-inherit gnome.org distutils-r1
-
-DESCRIPTION="GDBus code and documentation generator"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2+"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-S="${WORKDIR}/glib-${PV}/gio/gdbus-2.0/codegen"
-
-python_prepare_all() {
-	PATCHES=(
-		"${FILESDIR}/${PN}-2.56.1-sitedir.patch"
-	)
-	distutils-r1_python_prepare_all
-
-	local MAJOR_VERSION=$(ver_cut 1)
-	local MINOR_VERSION=$(ver_cut 2)
-	sed -e 's:@PYTHON@:python:' gdbus-codegen.in > gdbus-codegen || die
-	sed -e "s:@VERSION@:${PV}:" \
-		-e "s:@MAJOR_VERSION@:${MAJOR_VERSION}:" \
-		-e "s:@MINOR_VERSION@:${MINOR_VERSION}:" config.py.in > config.py || die
-	cp "${FILESDIR}/setup.py-2.32.4" setup.py || die "cp failed"
-	sed -e "s/@PV@/${PV}/" -i setup.py || die "sed setup.py failed"
-}
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/glib-utils)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	distutils-r1_src_compile
-	do_xsltproc_command "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.xml" "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
-
-src_test() {
-	einfo "Skipping tests. This package is tested by dev-libs/glib"
-	einfo "when merged with FEATURES=test"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all # no-op, but prevents QA warning
-	doman "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.2.ebuild
index 787dfc5d3d..d4ca839d30 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.76.2.ebuild
@@ -15,7 +15,7 @@ HOMEPAGE="https://www.gtk.org/"
 
 LICENSE="LGPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
 
 RDEPEND="${PYTHON_DEPS}"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
index ccac97275a..37d2aa1b2b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
@@ -1,3 +1 @@
-DIST glib-2.74.6.tar.xz 5217312 BLAKE2B 07b0a5cb74c1451ba863d5f9a781a122d3d20af1f1227177025de114279277cacada3dd6ab5eb5ad5c0bff5ac7abab6fdfbe0551f44d07b2ddc9141a0640a8c8 SHA512 6b6d113012ec90f6cf77513ec0132668c49aa7224c806181ad662388701004667cdf6d263050d6f896b8688c085abf461aa3e659eb288e6ba93ba4970a2f181b
-DIST glib-2.76.1.tar.xz 5270936 BLAKE2B 6e6d15bda7ca6365d5f33e197cad41043f17c2f505997953e4f5222121571dabfa07ac88d0a1e298313021c63ef97e7560128c3f8ddf7f518afba98692555e81 SHA512 7ab8740925fa4ed2d860a35544c475ae905df5fa7fc0cc64ffa8c543df6073794e44c8ff39e3e1de1d677016ef9d27e9bc709d2505d13090faa8d6c47cd64bd0
 DIST glib-2.76.2.tar.xz 5273836 BLAKE2B db5d5e45fe4a17bade7f5bf923ac0e5541237d19146ede33b4d52f05b82e4ecb94519393f49ac3b04e17d0f56bfd5dd99b8e81ae80956cfdb5cb2396cd5ec8cc SHA512 5a99723d72ae987999bdf3eac4f3cabe2e014616038f2006e84060b97d6d290b7d44a20d700e9c0f4572a6defed56169f624bcd21b0337f32832b311aa2737e6
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.74.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.74.6.ebuild
deleted file mode 100644
index d94a24e0b1..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.74.6.ebuild
+++ /dev/null
@@ -1,62 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_COMPAT=( python3_{9..11} )
-GNOME_ORG_MODULE="glib"
-
-inherit gnome.org python-single-r1
-
-DESCRIPTION="Build utilities for GLib using projects"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-src_configure() { :; }
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/gdbus-codegen)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-genmarshal.in > gobject/glib-genmarshal || die
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-mkenums.in > gobject/glib-mkenums || die
-	sed -e "s:@GLIB_VERSION@:${PV}:g;s:@PYTHON@:python:g" glib/gtester-report.in > glib/gtester-report || die
-	do_xsltproc_command docs/reference/gobject/glib-genmarshal.xml docs/reference/gobject/glib-genmarshal.1
-	do_xsltproc_command docs/reference/gobject/glib-mkenums.xml docs/reference/gobject/glib-mkenums.1
-	do_xsltproc_command docs/reference/glib/gtester-report.xml docs/reference/glib/gtester-report.1
-}
-
-src_install() {
-	python_fix_shebang gobject/glib-genmarshal
-	python_fix_shebang gobject/glib-mkenums
-	python_fix_shebang glib/gtester-report
-	exeinto /usr/bin
-	doexe gobject/glib-genmarshal
-	doexe gobject/glib-mkenums
-	doexe glib/gtester-report
-	doman docs/reference/gobject/glib-genmarshal.1
-	doman docs/reference/gobject/glib-mkenums.1
-	doman docs/reference/glib/gtester-report.1
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.1.ebuild
deleted file mode 100644
index 33bfee268b..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.1.ebuild
+++ /dev/null
@@ -1,62 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_COMPAT=( python3_{9..11} )
-GNOME_ORG_MODULE="glib"
-
-inherit gnome.org python-single-r1
-
-DESCRIPTION="Build utilities for GLib using projects"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-src_configure() { :; }
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/gdbus-codegen)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-genmarshal.in > gobject/glib-genmarshal || die
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-mkenums.in > gobject/glib-mkenums || die
-	sed -e "s:@GLIB_VERSION@:${PV}:g;s:@PYTHON@:python:g" glib/gtester-report.in > glib/gtester-report || die
-	do_xsltproc_command docs/reference/gobject/glib-genmarshal.xml docs/reference/gobject/glib-genmarshal.1
-	do_xsltproc_command docs/reference/gobject/glib-mkenums.xml docs/reference/gobject/glib-mkenums.1
-	do_xsltproc_command docs/reference/glib/gtester-report.xml docs/reference/glib/gtester-report.1
-}
-
-src_install() {
-	python_fix_shebang gobject/glib-genmarshal
-	python_fix_shebang gobject/glib-mkenums
-	python_fix_shebang glib/gtester-report
-	exeinto /usr/bin
-	doexe gobject/glib-genmarshal
-	doexe gobject/glib-mkenums
-	doexe glib/gtester-report
-	doman docs/reference/gobject/glib-genmarshal.1
-	doman docs/reference/gobject/glib-mkenums.1
-	doman docs/reference/glib/gtester-report.1
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.2.ebuild
index 33bfee268b..d94a24e0b1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.76.2.ebuild
@@ -14,7 +14,7 @@ LICENSE="LGPL-2.1+"
 SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
 
 RDEPEND="${PYTHON_DEPS}"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/patchelf/files/patchelf-glibc-dt-mips-xhash.patch b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/files/patchelf-glibc-dt-mips-xhash.patch
new file mode 100644
index 0000000000..fd92c803ac
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/files/patchelf-glibc-dt-mips-xhash.patch
@@ -0,0 +1,9 @@
+Add define for DT_MIPS_XHASH (MIPS gnu hash support) using system elf.h header.
+Bug: https://bugs.gentoo.org/860888
+--- /dev/null
++++ b/src/elf.h
+@@ -0,0 +1,4 @@
++#include_next <elf.h>
++#ifndef DT_MIPS_XHASH
++#define DT_MIPS_XHASH 0x70000036
++#endif
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
index cbc25bb40a..b0778e8b72 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/patchelf/patchelf-0.18.0.ebuild
@@ -12,9 +12,13 @@ SLOT="0"
 KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~riscv-linux ~x86-linux"
 LICENSE="GPL-3"
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-glibc-dt-mips-xhash.patch
+)
+
 src_prepare() {
-	default
 	rm src/elf.h || die
+	default
 
 	sed -i \
 		-e 's:-Werror::g' \
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index c3a52f5a74..46a7ae78c6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,4 +1,5 @@
 DIST linux-5.19.tar.xz 131581464 BLAKE2B 4db03a6830a3b3bbf0837e1912182a443d9a4aa8af20a12e6ec814ed708038452d3c0ccee1258cca671c464d76461536363a8adc56e9d098c9a44ae3484a297a SHA512 00313b2f9b82d2dc3fb8294007cf7d7599d254b717ed2de23c81fa7a1bbcbc2798ad286cb94e2f7f5bd54132d1d764facd90d30f79dbcc6616cc7f926adc2623
 DIST linux-6.0.tar.xz 133886176 BLAKE2B c09a9c877ac0fac83dc31d2d04d96f0a3331d4ed78e3ad4edfd4dc077e1c11d0c49f419fdac4008b5c93d1b09c2b724e12ef0b38371ad0962908abf85dfa95fa SHA512 bac41a7aeb6e809616cee2f13dcd1c45e829dfd1ccf60aee1dc4c46b1e28532f4485c7d819a32940de84fdfbf89db80a4e919bce8a74b2948c5a01551771b714
 DIST linux-6.2.tar.xz 136430892 BLAKE2B 05b63254734ea685db437cb1c00a6da63eee74d7e99f4ed2d074aaa01ac4487813ab297d337a6855cdbcbb33346b631c4256ee3b06191adfb1be3615a56bdd6d SHA512 a01bee0b968b95183934fe3504516be7ef5811944a061f5aed05ecebaa27b5eb64e33232fd0a8dd622b3c8743bfe462ef7e464d381734d111a0ad6a6d9f66ddd
+DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
 DIST perf-5.19-binutils-2.39-patches.tar.xz 5612 BLAKE2B ec3aeadc3e2508f33dddbb419f434885b39b8220d294f3845f0bc96282923ff46dca126a04c732b8286752e56087ba5b2c5ad9526884f6d0b8b6df5665121e5e SHA512 af676e5a600e227d85f89a5ee0cfacfe1845aa56c27ef9da3ebaf578362d7e741375d30565759123b33b86d36bc9981c8c4cda113af32745cc59cf4a9275e73b
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild
new file mode 100644
index 0000000000..8a46cf6733
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.3.ebuild
@@ -0,0 +1,268 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{9..11} )
+inherit bash-completion-r1 estack llvm toolchain-funcs python-r1 linux-info
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perf.wiki.kernel.org/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+	SRC_URI=""
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="audit babeltrace clang crypt debug +doc gtk java libpfm lzma numa perl python slang systemtap unwind zlib zstd"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="audit? ( sys-process/audit )
+	babeltrace? ( dev-util/babeltrace )
+	crypt? ( virtual/libcrypt:= )
+	clang? (
+		sys-devel/clang:=
+		sys-devel/llvm:=
+	)
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-util/systemtap )
+	unwind? ( sys-libs/libunwind )
+	zlib? ( sys-libs/zlib )
+	zstd? ( app-arch/zstd )
+	dev-libs/elfutils
+	sys-libs/binutils-libs:="
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+CONFIG_CHECK="~PERF_EVENTS ~KALLSYMS"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	use clang && llvm_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		tools/arch tools/build tools/include tools/lib tools/perf tools/scripts
+		scripts include lib "arch/*/lib"
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		filterdiff -p1 ${paths[@]/#/-i } -z "${DISTDIR}"/${LINUX_PATCH} \
+			> ${P}.patch
+		eend $? || die "filterdiff failed"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	eapply "${FILESDIR}"/perf-6.0-clang.patch
+	eapply "${FILESDIR}"/perf-6.0-c++17.patch
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" no; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+	# FIXME: NO_CORESIGHT
+	emake V=1 VF=1 \
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)" \
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="$(tc-getLD)" NM="$(tc-getNM)" \
+		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+		prefix="${EPREFIX}/usr" bindir_relative="bin" \
+		tipdir="share/doc/${PF}" \
+		EXTRA_CFLAGS="${CFLAGS}" \
+		EXTRA_LDFLAGS="${LDFLAGS}" \
+		ARCH="${arch}" \
+		JDIR="${java_dir}" \
+		LIBCLANGLLVM=$(usex clang 1 "") \
+		LIBPFM4=$(usex libpfm 1 "") \
+		NO_AUXTRACE="" \
+		NO_BACKTRACE="" \
+		NO_CORESIGHT=1 \
+		NO_DEMANGLE= \
+		GTK2=$(usex gtk 1 "") \
+		feature-gtk2-infobar=$(usex gtk 1 "") \
+		NO_JVMTI=$(puse java) \
+		NO_LIBAUDIT=$(puse audit) \
+		NO_LIBBABELTRACE=$(puse babeltrace) \
+		NO_LIBBIONIC=1 \
+		NO_LIBBPF= \
+		NO_LIBCRYPTO=$(puse crypt) \
+		NO_LIBDW_DWARF_UNWIND= \
+		NO_LIBELF= \
+		NO_LIBNUMA=$(puse numa) \
+		NO_LIBPERL=$(puse perl) \
+		NO_LIBPYTHON=$(puse python) \
+		NO_LIBUNWIND=$(puse unwind) \
+		NO_LIBZSTD=$(puse zstd) \
+		NO_SDT=$(puse systemtap) \
+		NO_SLANG=$(puse slang) \
+		NO_LZMA=$(puse lzma) \
+		NO_ZLIB=$(puse zlib) \
+		WERROR=0 \
+		LIBDIR="/usr/libexec/perf-core" \
+		libdir="${EPREFIX}/usr/$(get_libdir)" \
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins" \
+		"$@"
+}
+
+src_compile() {
+	# test-clang.bin not build with g++
+	if use clang; then
+		make -C "${S_K}/tools/build/feature" V=1 CXX=${CHOST}-clang++ test-clang.bin || die
+	fi
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
index 2c24c060f0..e0985acad3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/Manifest
@@ -1,3 +1,3 @@
-DIST pkgconf-1.8.0.tar.xz 296304 BLAKE2B 6585a855a313406f77d26fba3cc3cef798b27c4b7ece81738bdba12f36ee93fbcaf838e1065406c28adc20852e34e2de14bc5f4837982f9cc35360d9a3ac83a5 SHA512 58204006408ad5ce91222ed3c93c2e0b61c04fa83c0a8ad337b747b583744578dbebd4ad5ccbc577689637caa1c5dc246b7795ac46e39c6666b1aa78199b7c28
 DIST pkgconf-1.8.1.tar.xz 302372 BLAKE2B 591961f0b1fd185834fd8e2a672199cffc035139599817b1d56d571300d2aa800a719c9477aac4023dfade597ad3cc3b45360babe57498977568ee57077c7bbe SHA512 7a7d5204c1c9bfb6578bda56f299d1fa0300e69a133a65730b10ad77aefbf26fceb74ae77cecda326b3ed5db5736f27fcce94764b3a56d40f4bb99fecdc80bba
 DIST pkgconf-1.9.4.tar.xz 309164 BLAKE2B f0a99f9c7aaf571b14aa24b6dae441fb041d794294e560601232c03254e521a49a5724e41c5ada537f7933bb4831b63482896c8569a9502c8c5d841190e1d091 SHA512 079436244f3942161f91c961c96d382a85082079c9843fec5ddd7fb245ba7500a9f7a201b5ef2c70a7a079fe1aacf3a52b73de5402a6f061df87bcdcf0a90755
+DIST pkgconf-1.9.5.tar.xz 310068 BLAKE2B 196babfccbf34c10bf08eb52fe1a4366273e07fcc97fb42d117295bb1cb141811e6a0453597b4aab31dc2bfc06baf9b2507484c68cd6c7474c94e5676a743d0e SHA512 604853d8bb1c3ca14e696f83ac5b161e2592defb921d53e1c16cc949d4b9ecac2b12983c1fbbb3c89898323bda18c8749bff3946e049c8305a1a39a773265f09
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.8.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild
similarity index 68%
rename from sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.8.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild
index 2ec0b2d88a..1a62309a9c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.8.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/pkgconf/pkgconf-1.9.5.ebuild
@@ -1,26 +1,26 @@
 # Copyright 2012-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit multilib multilib-minimal
 
-if [[ ${PV} == "9999" ]] ; then
+if [[ ${PV} == 9999 ]] ; then
 	inherit autotools git-r3
 	EGIT_REPO_URI="https://gitea.treehouse.systems/ariadne/pkgconf.git"
 else
 	SRC_URI="https://distfiles.dereferenced.org/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	# Per release notes, 1.9.x is a testing/development release.
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 DESCRIPTION="pkg-config compatible replacement with no dependencies other than C99"
 HOMEPAGE="https://gitea.treehouse.systems/ariadne/pkgconf"
 
 LICENSE="ISC"
-SLOT="0/3"
+SLOT="0/4"
 IUSE="test"
 
-# tests require 'kyua'
 RESTRICT="!test? ( test )"
 
 BDEPEND="
@@ -29,31 +29,26 @@ BDEPEND="
 		dev-util/kyua
 	)
 "
-RDEPEND="
-	!dev-util/pkgconfig
-"
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/pkgconf$(get_exeext)
-)
+RDEPEND="!dev-util/pkgconfig"
 
 src_prepare() {
 	default
 
-	[[ ${PV} == "9999" ]] && eautoreconf
-	MULTILIB_CHOST_TOOLS+=(
+	[[ ${PV} == 9999 ]] && eautoreconf
+
+	MULTILIB_CHOST_TOOLS=(
+		/usr/bin/pkgconf
 		/usr/bin/pkg-config$(get_exeext)
 	)
 }
 
 multilib_src_configure() {
-	local ECONF_SOURCE="${S}"
-	local args=(
-		--disable-static
+	local myeconfargs=(
 		--with-system-includedir="${EPREFIX}/usr/include"
 		--with-system-libdir="${EPREFIX}/$(get_libdir):${EPREFIX}/usr/$(get_libdir)"
 	)
-	econf "${args[@]}"
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
 }
 
 multilib_src_test() {
@@ -70,5 +65,6 @@ multilib_src_install() {
 
 multilib_src_install_all() {
 	einstalldocs
+
 	find "${ED}" -type f -name '*.la' -delete || die
 }
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/re2c/re2c-2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/re2c/re2c-2.2.ebuild
index 76c6e9d75f..e0e45d5d87 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/re2c/re2c-2.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/re2c/re2c-2.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9,10} )
+PYTHON_COMPAT=( python3_{9..11} )
 
 inherit python-any-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/strace/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/strace/Manifest
index 4ce7d382a6..9d8b193e98 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/strace/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/strace/Manifest
@@ -4,3 +4,4 @@ DIST strace-5.19.tar.xz 2353276 BLAKE2B 44b9a87f36e66481d8ac2107efbc389fa64c47b2
 DIST strace-6.0.tar.xz 2367144 BLAKE2B ab9cb1f81b01068de5af5125ec2901b57a2f2b24fc01f4f68a284d74eb9fc0f4d583510a353554327845e7c157ea71ca4042ce3c27b3d2b0469d65a13aabfab1 SHA512 2f5aa18949b9f64769eee4e7720e41bf4a61e3b552acad693ff7baed2e662407a7b5e8bfba94ac49bb71639d21cd54084de902fb4337904f48480b25b8e72b54
 DIST strace-6.1.tar.xz 2351272 BLAKE2B f11bdddcc23d9bbe7196a102165ac40d3f39e0dec8b9c727e226d99ae0b6f22865bd0582d4e9c15fdce87dd405e0e9c68b60041bd2b90bc8480557f82ca6dcb8 SHA512 3f0678d74c5c3e6b30c4dc4ed7ee4cb0829d3b7142dc014fcd887db3a68133bf7fedc623bae381dfe4305bd6cd15d4ca6776c6491009c2a053bb8c6ca1ae8e12
 DIST strace-6.2.tar.xz 2364280 BLAKE2B 8e51cb3e426e9b99d598b4fcece21ba7873e81468cddae04c2f0b1a48dc40643c626acadd226389c33dbef5350b502817d3459d445fc17cce149f7e501c15ae2 SHA512 56708faa3f73c0673c98a5b8b8fe35289ecf2870f4f775bcb7a6be59451ef84685564c0129aca15b576d851f8efa1ff760e27658b914d1f31adf4de3b1ad721f
+DIST strace-6.3.tar.xz 2382284 BLAKE2B 7373ebddd6f23713b752ed91598e536d61e08865907c7825dd3492574c7feb0ad6d56bea0e144e1082ac1882d68bb5f160f25e70bfc6e2fd47571ef2c40403fb SHA512 2b0a57e3ee8a23eb3882123149cd732c568322614bf8fde69fabcea64d0d4e3c46c71d63183e0e8d9f8744a7b1cebc823cc67023660c37547f5b854fcc1ca9df
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/strace/strace-6.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/strace/strace-6.3.ebuild
new file mode 100644
index 0000000000..24526a0eb2
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/strace/strace-6.3.ebuild
@@ -0,0 +1,108 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools edo flag-o-matic toolchain-funcs
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/strace/strace.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+fi
+
+DESCRIPTION="A useful diagnostic, instructional, and debugging tool"
+HOMEPAGE="https://strace.io/"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="aio perl selinux static unwind elfutils"
+REQUIRED_USE="?? ( unwind elfutils )"
+
+BDEPEND="virtual/pkgconfig"
+LIB_DEPEND="
+	unwind? ( sys-libs/libunwind[static-libs(+)] )
+	elfutils? ( dev-libs/elfutils[static-libs(+)] )
+	selinux? ( sys-libs/libselinux[static-libs(+)] )
+"
+# strace only uses the header from libaio to decode structs
+DEPEND="
+	static? ( ${LIB_DEPEND} )
+	aio? ( >=dev-libs/libaio-0.3.106 )
+	sys-kernel/linux-headers
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+	perl? ( dev-lang/perl )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-5.11-static.patch"
+)
+
+src_prepare() {
+	default
+
+	if [[ ! -e configure ]] ; then
+		# git generation
+		sed /autoreconf/d -i bootstrap || die
+		edo ./bootstrap
+		[[ ! -e CREDITS ]] && cp CREDITS{.in,}
+	fi
+
+	eautoreconf
+
+	# Stub out the -k test since it's known to be flaky. bug #545812
+	sed -i '1iexit 77' tests*/strace-k.test || die
+}
+
+src_configure() {
+	# Set up the default build settings, and then use the names strace expects.
+	tc-export_build_env BUILD_{CC,CPP}
+	local v bv
+	for v in CC CPP {C,CPP,LD}FLAGS ; do
+		bv="BUILD_${v}"
+		export "${v}_FOR_BUILD=${!bv}"
+	done
+
+	filter-lfs-flags # configure handles this sanely
+
+	export ac_cv_header_libaio_h=$(usex aio)
+	use elibc_musl && export ac_cv_header_stdc=no
+
+	local myeconfargs=(
+		--disable-gcc-Werror
+
+		# Don't require mpers support on non-multilib systems. #649560
+		--enable-mpers=check
+
+		$(use_enable static)
+		$(use_with unwind libunwind)
+		$(use_with elfutils libdw)
+		$(use_with selinux libselinux)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	if has usersandbox ${FEATURES} ; then
+		# bug #643044
+		ewarn "Test suite is known to fail with FEATURES=usersandbox -- skipping ..."
+		return 0
+	fi
+
+	default
+}
+
+src_install() {
+	default
+
+	if use perl ; then
+		exeinto /usr/bin
+		doexe src/strace-graph
+	fi
+
+	dodoc CREDITS
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest b/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
index 17e1af7b51..cb84a7820d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/Manifest
@@ -1,9 +1,9 @@
-DIST git-2.39.1.tar.xz 7160744 BLAKE2B 5ebf583232da9f6a937ebba17858b9fa8b550e3d0d981ff5603f77673cce69bf9a3c1c18c61d4c5e6b2f629a8173eaef8a09c913961d175571e4e6b00d2b194d SHA512 b1821a814947f01adf98206a7e9a01da9daa617b1192e8ef6968b05af8d874f028fb26b5f828a9c48f734ef2c276f4d23bdc898ba46fb7aaa96dbe68081037e9
 DIST git-2.39.2.tar.xz 7163224 BLAKE2B bcd9abdaf8ce626de7aec2da666395f80212772aa17516f903459d683597184efeeb1d6aad536e0bf722a9bf63df98549fdeaab5b0a48e5500faf83ebf5d7516 SHA512 fdca70bee19401c5c7a6d2f3d70bd80b6ba99f6a9f97947de31d4366ee3a78a18d5298abb25727ec8ef67131bca673e48dff2a5a050b6e032884ab04066b20cb
-DIST git-2.40.0.tar.xz 7183692 BLAKE2B e2687ceb7e341170f063013c8c0e8be81456cda786981f36170aefb714687d78cf850287e5fb35d98e7326f611881ffd27d380728c87b9306fbbe46c1b989d69 SHA512 a2720f8f9a0258c0bb5e23badcfd68a147682e45a5d039a42c47128296c508109d5039029db89311a35db97a9008585e84ed11b400846502c9be913d67f0fd90
-DIST git-htmldocs-2.39.1.tar.xz 1504172 BLAKE2B 64a73a2b04e99b0bf18ab2153076bcbae9c114a31c9ab998c5e068f0ce6c0f5140e9db79008b1b01688db6a6d53e84fde8b2319eb45394aa6bc2df361be78520 SHA512 9b67b0464acd5651ef5871f724c59c910195cdd7020ecdcadced6e8e1275269ee1ca5808881e67e908114cb4ef27c959320f1e3d718b6699d3761281b6179600
+DIST git-2.39.3.tar.xz 7166100 BLAKE2B 862a5636df681e46797034bf22ca7712d70ead94ac0a911b81e4eeb3c83e67fdc56b839055b3b54bdab0ffceabe9fa2efb9e2870b1c0f40590ddb33e7427cd2a SHA512 ddd9f41df9d59aedaddb3a3cd551c105903b5f8c86455d4d05a8342920d67754b358b6ab0d6c10cca743b8e0e621baea16f71a9d6290f4d37297a9c45e8b3763
+DIST git-2.40.1.tar.xz 7185260 BLAKE2B 50957227a572db54b931976d4c22edeaf0d5678d05d37f9478e736487d3e0755c1d70775cea9e3ce82e07f228fa809f3b461fb5b7f267117cc5aeffff915c096 SHA512 9ab41c64c6e666c314683bc4925535e037d43f947b8d327ff7d0379ac12899f4effcc2fe4e47b1ce652ad7140aa4f01f3b99f9cc0cf854cfeface1a5d3e1893e
 DIST git-htmldocs-2.39.2.tar.xz 1505352 BLAKE2B 8b60f9bae9585aab8782f38ff64391a9c8fddeed47d84a989b4f65db87c14e927d1d975fa5239435e921dbc74a75c600d6f0485defa1a235a66355c0f8d9060d SHA512 fe0982e653784285bce7f158956892900ae9c88aa986261de4184e3349e34ee54f92d7280e143031b107872fc1729814489f6e355aa12dc415d724da65ec3716
-DIST git-htmldocs-2.40.0.tar.xz 1517292 BLAKE2B 1baa47344e8c41c529e6ea21fa9ab406d146e128c2154beceb1d2ddf993cebdfeca132ed86811ef062df38e1ecc541dd2285bca0d985e7cc8ce185422d53f9b4 SHA512 3295e6b5e69430b3900ade93484cc357dd69d59ffccef0b62648d4aefc5d3e0820bd81dde2ec5ad0f3983c9c3a3648fa6edea508e870ebc0194cf6d42137aee2
-DIST git-manpages-2.39.1.tar.xz 557012 BLAKE2B 1a39a1192443eac0d12da059e0146d286272054192810d12f53f627bd341c3dc50bea2078cccac0d46c5e95502a1d669f072ab387e1662c890e5c38d46ad3f31 SHA512 4f1fdd7abf53dd60478ffc5f926777cd00446a3799ad9a2129814adfe7d3d63e13dd9bcdcea699fd139c9e134cf45857f0585ce2772e4fb93e4930c8f86a08bb
+DIST git-htmldocs-2.39.3.tar.xz 1506828 BLAKE2B 732e86ee004a44230d8f10eac16a14fbfb348d4278001011a0d22ba91240fbe65cad341b0547b649db3ce7fc67fc6fb544c896e7ba4bd7f1fa3c9b42371febf9 SHA512 7616c9c6600759f06973d36d5233b3909da72f39318410f5522b890d282a74e7585433c7195fed4792d5b7955292a466abcc2185ffdc23d0e8928ad58d7db1bf
+DIST git-htmldocs-2.40.1.tar.xz 1517900 BLAKE2B 864edd5b2389362dcf5d0c9f08cbf3bac6303cf6505b2d5446e73aeb591ac9212948b6f68434671e3bfba6f64d6aff02d315848d08647d22177292775411e5b3 SHA512 770c9765bab1f0773615d67f4eb817c42e1a946da205381ac0c208c4b2d4185c351aebbd7294afe66ef794b65cc9123b255a585a3df2990b5dfe779aaacb0800
 DIST git-manpages-2.39.2.tar.xz 557080 BLAKE2B 6b2dbb33f1041ba802582f529638b8b4574309efbf5af94add5c676efed7314743d5b326ec18a95ba85a4fe818e95913069717034a9863879e1d03ee32b839ba SHA512 6326ff43564fc42ca0a424edd17896434e11c09ce21f4bfd4d4975aaaf7f2c0d823da0e89b267557b0b7799c342db88d84685d24f589f53edfe486208c1f15b1
-DIST git-manpages-2.40.0.tar.xz 562824 BLAKE2B 9e57d39c2111fc3a109d355773bc191110ac421bc1b0b9bdeeb13e84d8934ad4bdb8c7439bc7fe8f1ffea505e4ea6d14ab4fdf689e828e841cf0af8d2eb3cd12 SHA512 7415db5fd30239c7f5a51c40c3e94870ef6896df0d78a88bbe91c38d58e4d9802e12e1de2cb03634a52ad4a5877c9d7e1194c284567288ed4263788c48c8cff0
+DIST git-manpages-2.39.3.tar.xz 557428 BLAKE2B 4eb85035f7056a12c3f1276d26f99b3337b97721f8f4b0b3c74d2a484171bfdf74f566a03e175ba32b389c940ed7be66ce2933442ec77089d5db3aaeb2ed2557 SHA512 06414741667b990ff3a28f7cb29b502df3d4cc757d525438994af005c71d429ca969563a74d1d2b44185e5c40107ac8838b390835a8a947e542ce3636b43f98b
+DIST git-manpages-2.40.1.tar.xz 562772 BLAKE2B 091c907195b37ed4152698515528d7da27f8dbf2516915ae66ba6f81a64bbd9f2042544889fe655ea7447bd6f32adaf8daec9c02743587a84b090554ad58796b SHA512 4e75f5ae3786658d284ce8eae3133c01115e357cc0bd2c4c5bf4261196411da632f51c87ff6e4c1f4bc7adf7b7b4a33c4debe52bcd9b5d735aa70dd9614ad5bd
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.2.ebuild
index 26e5cfe14e..dcf4921993 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.2.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild
index 26e5cfe14e..dcf4921993 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.39.3.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.1.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.1.ebuild
index ce146cc613..867bbd70fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-2.40.1.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
index ce146cc613..867bbd70fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r1.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
index ce146cc613..867bbd70fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r2.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
index ce146cc613..867bbd70fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999-r3.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
index ce146cc613..867bbd70fc 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/git/git-9999.ebuild
@@ -58,7 +58,7 @@ S="${WORKDIR}"/${MY_P}
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="+blksha1 +curl cgi doc gnome-keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
+IUSE="+blksha1 +curl cgi doc keyring +gpg highlight +iconv mediawiki +nls +pcre perforce +perl +safe-directory selinux subversion tk +webdav xinetd cvs test"
 
 # Common to both DEPEND and RDEPEND
 DEPEND="
@@ -68,7 +68,7 @@ DEPEND="
 		net-misc/curl
 		webdav? ( dev-libs/expat )
 	)
-	gnome-keyring? (
+	keyring? (
 		app-crypt/libsecret
 		dev-libs/glib:2
 	)
@@ -120,7 +120,7 @@ BDEPEND="
 		app-text/xmlto
 		sys-apps/texinfo
 	)
-	gnome-keyring? ( virtual/pkgconfig )
+	keyring? ( virtual/pkgconfig )
 	nls? ( sys-devel/gettext )
 	test? (	app-crypt/gnupg	)
 "
@@ -343,7 +343,7 @@ src_compile() {
 	fi
 	popd &>/dev/null || die
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		git_emake -C contrib/credential/libsecret
 	fi
 
@@ -543,7 +543,7 @@ src_install() {
 	doexe contrib/contacts/git-contacts
 	dodoc contrib/contacts/git-contacts.txt
 
-	if use gnome-keyring ; then
+	if use keyring ; then
 		pushd contrib/credential/libsecret &>/dev/null || die
 		dobin git-credential-libsecret
 		popd &>/dev/null || die
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/Manifest b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/Manifest
index 70a20a9848..63773d7369 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/Manifest
@@ -1,3 +1,4 @@
-DIST repo-2.29.tar.gz 248253 BLAKE2B 6b51a0416634eab52f44410fe156c736a6c69234345b4cf5115692a9b56d479c0bce780583fb2ee6b9ca206e5163adbf6ded85ff5d7f2b174a7e7cd6dc37dd57 SHA512 7323b52709164999a80172bc39398ad9989c3eb97bcfda66a675c3f94792cdd742068d47bbcc66dc8fffbe3b661c2fb19332a72a7f889a249f73fa448fcb32d1
 DIST repo-2.30 45769 BLAKE2B 46e8f37b138f1ebfa3109962f2690cc3bc6c38a2dd4333cd5be6fc1168476945cbd73f142486141a00552b8a998d4a765e54fce605d1872a670a3043fb213b05 SHA512 e8ad4e35417992f15bfa081ce282e1e518dcb885c04176f18ff2859ccb1dd397087224980f441020be12083c9847fcce661370119fe08f17be04718eff4a7a96
 DIST repo-2.30.tar.gz 252945 BLAKE2B ebaadc1f624941139c14417e86e1a4960fbba9da7b9053bab8f2cb1647c40a6f1f63951bcbb6d9162803066f9b05d1fb469e82b7d3b2bea31215b97b1bddf84f SHA512 7d184605e8d8e30bc48a4d3f2345c7ee9a8075711729108b5d487242c9311dc1cf22595f9ba09192a28460d6127e8cbe96a70fcdaf7c6baeb1e26a8ac15a7cae
+DIST repo-2.32 45787 BLAKE2B 658b9b343a5c5dc9a850cde62e24c942c72bab807dc94ccf55f92d51e9ff8d5a3d57ca818dca7512a3a7b073fc1fac9f22c533dcc71a9dbd918fdd63bc42fda3 SHA512 1ded71a8e5e052c012a131b914f9ce0f92a3846b29f76c167583196a5efb6fda913c944a8bcf40d41dc206cc529e780df0c6da7f3d4c21302105885dc3061093
+DIST repo-2.32.tar.gz 255696 BLAKE2B b63fa70b2fdcd02460216d3b4c5f04a7c334f3f52ceddc69ece5f3f9c239c3f5f6eaf2617d96d60ec838766ce1b6170e8906c5ddc787c90918d5e38fd90a8a23 SHA512 4ac7be6ecd865d3823d21baa8b96d76194ed648139088bc53685463b4a3d62696005881f53e9cc5f34d8457a0bb8b8cb1a0dd2e2e547d0432f21a5aee9bba9a0
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/metadata.xml
index 7517f8d97d..0885b487b6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/metadata.xml
@@ -5,4 +5,7 @@
 		<name>Mike Frysinger</name>
 		<email>vapier@gentoo.org</email>
 	</maintainer>
+	<upstream>
+		<remote-id type="github">GerritCodeReview/git-repo</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.30.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.30.ebuild
index a758514924..25394f1e60 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.30.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.30.ebuild
@@ -7,7 +7,7 @@
 
 EAPI="7"
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 
 inherit bash-completion-r1 python-r1
 
@@ -18,7 +18,7 @@ SRC_URI="https://storage.googleapis.com/git-repo-downloads/${P}
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE=""
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.29.ebuild b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.32.ebuild
similarity index 65%
rename from sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.29.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.32.ebuild
index 1a47a8ee8c..c008c0bbe3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.29.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-vcs/repo/repo-2.32.ebuild
@@ -7,28 +7,29 @@
 
 EAPI="7"
 
-PYTHON_COMPAT=( python3_{9..10} )
+PYTHON_COMPAT=( python3_{10..11} )
 
 inherit bash-completion-r1 python-r1
 
 DESCRIPTION="Google tool for managing git, particularly multiple repos"
 HOMEPAGE="https://gerrit.googlesource.com/git-repo"
-SRC_URI="https://github.com/GerritCodeReview/git-repo/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI="https://storage.googleapis.com/git-repo-downloads/${P}
+	https://github.com/GerritCodeReview/git-repo/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE=""
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
 RDEPEND="${PYTHON_DEPS}
 	!app-admin/radmind
-	!dev-util/repo"
+"
 
 S="${WORKDIR}/git-${P}"
 
 src_install() {
-	python_foreach_impl python_doscript ${PN}
+	python_foreach_impl python_newscript "${DISTDIR}/${P}" ${PN}
 	newbashcomp completion.bash ${PN}
 	doman man/*.[0-9]
 }
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index cef9d71e55..f4ef89ee79 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -107,7 +107,7 @@ esac
 # The variable specifies the build system used.  Currently,
 # the following values are supported:
 #
-# - flit - flit_core backend
+# - flit - flit-core backend
 #
 # - flit_scm - flit_scm backend
 #
@@ -210,7 +210,7 @@ _distutils_set_globals() {
 		case ${DISTUTILS_USE_PEP517} in
 			flit)
 				bdep+='
-					>=dev-python/flit_core-3.8.0[${PYTHON_USEDEP}]
+					>=dev-python/flit-core-3.8.0[${PYTHON_USEDEP}]
 				'
 				;;
 			flit_scm)
@@ -225,7 +225,7 @@ _distutils_set_globals() {
 				;;
 			jupyter)
 				bdep+='
-					>=dev-python/jupyter_packaging-0.12.3[${PYTHON_USEDEP}]
+					>=dev-python/jupyter-packaging-0.12.3[${PYTHON_USEDEP}]
 				'
 				;;
 			maturin)
@@ -330,9 +330,12 @@ _distutils_set_globals() {
 
 		if [[ ${DISTUTILS_EXT} ]]; then
 			DEPEND="${PYTHON_DEPS}"
-			IUSE="debug"
 		fi
 	fi
+
+	if [[ ${DISTUTILS_EXT} ]]; then
+		IUSE="debug"
+	fi
 }
 _distutils_set_globals
 unset -f _distutils_set_globals
@@ -918,12 +921,12 @@ _distutils-r1_print_package_versions() {
 		case ${DISTUTILS_USE_PEP517} in
 			flit)
 				packages+=(
-					dev-python/flit_core
+					dev-python/flit-core
 				)
 				;;
 			flit_scm)
 				packages+=(
-					dev-python/flit_core
+					dev-python/flit-core
 					dev-python/flit_scm
 					dev-python/setuptools-scm
 				)
@@ -937,7 +940,7 @@ _distutils-r1_print_package_versions() {
 				;;
 			jupyter)
 				packages+=(
-					dev-python/jupyter_packaging
+					dev-python/jupyter-packaging
 					dev-python/setuptools
 					dev-python/setuptools-scm
 					dev-python/wheel
@@ -1305,6 +1308,7 @@ distutils_pep517_install() {
 	fi
 
 	local root=${1}
+	export BUILD_DIR
 	local -x WHEEL_BUILD_DIR=${BUILD_DIR}/wheel
 	mkdir -p "${WHEEL_BUILD_DIR}" || die
 
@@ -1316,23 +1320,42 @@ distutils_pep517_install() {
 	case ${DISTUTILS_USE_PEP517} in
 		meson-python)
 			local -x NINJAOPTS=$(get_NINJAOPTS)
-			config_settings=$(
-				"${EPYTHON}" - "${DISTUTILS_ARGS[@]}" <<-EOF || die
-					import json
-					import os
-					import shlex
-					import sys
+			if has_version -b '>=dev-python/meson-python-0.13'; then
+				config_settings=$(
+					"${EPYTHON}" - "${DISTUTILS_ARGS[@]}" <<-EOF || die
+						import json
+						import os
+						import shlex
+						import sys
 
-					ninjaopts = shlex.split(os.environ["NINJAOPTS"])
-					print(json.dumps({
-						"setup-args": sys.argv[1:],
-						"compile-args": [
-							"-v",
-							f"--ninja-args={ninjaopts!r}",
-						],
-					}))
-				EOF
-			)
+						ninjaopts = shlex.split(os.environ["NINJAOPTS"])
+						print(json.dumps({
+							"builddir": "${BUILD_DIR}",
+							"setup-args": sys.argv[1:],
+							"compile-args": ["-v"] + ninjaopts,
+						}))
+					EOF
+				)
+			else
+				config_settings=$(
+					"${EPYTHON}" - "${DISTUTILS_ARGS[@]}" <<-EOF || die
+						import json
+						import os
+						import shlex
+						import sys
+
+						ninjaopts = shlex.split(os.environ["NINJAOPTS"])
+						print(json.dumps({
+							"builddir": "${BUILD_DIR}",
+							"setup-args": sys.argv[1:],
+							"compile-args": [
+								"-v",
+								f"--ninja-args={ninjaopts!r}",
+							],
+						}))
+					EOF
+				)
+			fi
 			;;
 		setuptools)
 			if [[ -n ${DISTUTILS_ARGS[@]} ]]; then
diff --git a/sdk_container/src/third_party/portage-stable/eclass/elisp-common.eclass b/sdk_container/src/third_party/portage-stable/eclass/elisp-common.eclass
index 0462f022d1..1f60d3c337 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/elisp-common.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/elisp-common.eclass
@@ -11,7 +11,7 @@
 # Christian Faulhammer <fauli@gentoo.org>
 # Ulrich Müller <ulm@gentoo.org>
 # Maciej Barć <xgqt@gentoo.org>
-# @SUPPORTED_EAPIS: 6 7 8
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: Emacs-related installation utilities
 # @DESCRIPTION:
 #
@@ -167,7 +167,6 @@
 # to above calls of elisp-site-regen().
 
 case ${EAPI} in
-	6) inherit eapi7-ver ;;
 	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
diff --git a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
index 6bec3df308..bef3abf69d 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/flag-o-matic.eclass
@@ -47,11 +47,11 @@ setup-allowed-flags() {
 # Note: shell globs and character lists are allowed
 _setup-allowed-flags() {
 	ALLOWED_FLAGS=(
-		-pipe -O '-O[12sg]' '-mcpu=*' '-march=*' '-mtune=*'
+		-pipe -O '-O[123szg]' '-mcpu=*' '-march=*' '-mtune=*'
+		-flto '-flto=*' -fno-lto
 
 		# Hardening flags
 		'-fstack-protector*'
-		'-fstack-check*' -fno-stack-check
 		-fstack-clash-protection
 		'-fcf-protection=*'
 		-fbounds-check -fbounds-checking
diff --git a/sdk_container/src/third_party/portage-stable/eclass/linux-mod.eclass b/sdk_container/src/third_party/portage-stable/eclass/linux-mod.eclass
index 0098dbcfc2..0fe8d7da4f 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/linux-mod.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/linux-mod.eclass
@@ -149,6 +149,12 @@
 # @DESCRIPTION:
 # It's a read-only variable. It contains the extension of the kernel modules.
 
+# @ECLASS_VARIABLE: KV_OBJ_COMPRESS_EXT
+# @INTERNAL
+# @DESCRIPTION:
+# Read-only variable. It contains the compression extension of the kernel
+# modules (.xz, .gz, .zst)
+
 case ${EAPI} in
 	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
@@ -385,7 +391,7 @@ generate_modulesd() {
 
 		# OK so now if we have got this far, then we know we want to continue
 		# and generate the modprobe.d file.
-		module_modinfo="$(modinfo -p ${currm_path}.${KV_OBJ})"
+		module_modinfo="$(modinfo -p ${currm_path}.${KV_OBJ}${KV_OBJ_COMPRESS_EXT})"
 		module_config="${T}/modulesd-${currm}"
 
 		ebegin "Preparing file for modprobe.d"
@@ -684,6 +690,7 @@ linux-mod_src_install() {
 		if linux_chkconfig_present MODULE_COMPRESS_XZ; then
 			xz -T$(makeopts_jobs) --memlimit-compress=50% -q ${modulename}.${KV_OBJ} || die "Compressing ${modulename}.${KV_OBJ} with xz failed"
 			doins ${modulename}.${KV_OBJ}.xz
+			KV_OBJ_COMPRESS_EXT=".xz"
 		elif linux_chkconfig_present MODULE_COMPRESS_GZIP; then
 			if type -P pigz &>/dev/null ; then
 				pigz -p$(makeopts_jobs) ${modulename}.${KV_OBJ} || die "Compressing ${modulename}.${KV_OBJ} with pigz failed"
@@ -691,9 +698,11 @@ linux-mod_src_install() {
 				gzip ${modulename}.${KV_OBJ} || die "Compressing ${modulename}.${KV_OBJ} with gzip failed"
 			fi
 			doins ${modulename}.${KV_OBJ}.gz
+			KV_OBJ_COMPRESS_EXT=".gz"
 		elif linux_chkconfig_present MODULE_COMPRESS_ZSTD; then
 			zstd -T$(makeopts_jobs) ${modulename}.${KV_OBJ} || "Compressing ${modulename}.${KV_OBJ} with zstd failed"
 			doins ${modulename}.${KV_OBJ}.zst
+			KV_OBJ_COMPRESS_EXT=".zst"
 		else
 			doins ${modulename}.${KV_OBJ}
 		fi
diff --git a/sdk_container/src/third_party/portage-stable/eclass/multilib.eclass b/sdk_container/src/third_party/portage-stable/eclass/multilib.eclass
index 4a6e4160d5..77340a23e3 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/multilib.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/multilib.eclass
@@ -26,7 +26,7 @@ export CFLAGS_default
 export LDFLAGS_default
 export CHOST_default=${CHOST_default:-${CHOST}}
 export CTARGET_default=${CTARGET_default:-${CTARGET:-${CHOST_default}}}
-export LIBDIR_default=${CONF_LIBDIR:-"lib"}
+export LIBDIR_default="lib"
 export KERNEL_ABI=${KERNEL_ABI:-${DEFAULT_ABI}}
 
 # @FUNCTION: has_multilib_profile
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index be21834635..040d374bbf 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -40,7 +40,7 @@ inherit multiprocessing toolchain-funcs
 # All supported Python implementations, most preferred last.
 _PYTHON_ALL_IMPLS=(
 	pypy3
-	python3_{9..11}
+	python3_{10..11}
 )
 readonly _PYTHON_ALL_IMPLS
 
@@ -52,7 +52,7 @@ _PYTHON_HISTORICAL_IMPLS=(
 	jython2_7
 	pypy pypy1_{8,9} pypy2_0
 	python2_{5..7}
-	python3_{1..8}
+	python3_{1..9}
 )
 readonly _PYTHON_HISTORICAL_IMPLS
 
@@ -131,7 +131,7 @@ _python_set_impls() {
 			case ${i} in
 				pypy3|python3_9|python3_1[01])
 					;;
-				jython2_7|pypy|pypy1_[89]|pypy2_0|python2_[5-7]|python3_[1-8])
+				jython2_7|pypy|pypy1_[89]|pypy2_0|python2_[5-7]|python3_[1-9])
 					obsolete+=( "${i}" )
 					;;
 				*)
@@ -440,8 +440,6 @@ _python_export() {
 			PYTHON_PKG_DEP)
 				local d
 				case ${impl} in
-					python3.9)
-						PYTHON_PKG_DEP=">=dev-lang/python-3.9.16-r1:3.9";;
 					python3.10)
 						PYTHON_PKG_DEP=">=dev-lang/python-3.10.9-r1:3.10";;
 					python3.11)
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index ba83cad72c..87da1fba73 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -242,7 +242,14 @@ if [[ ${PN} != kgcc64 && ${PN} != gcc-* ]] ; then
 	IUSE+=" pgo"
 	IUSE+=" objc-gc" TC_FEATURES+=( objc-gc )
 	IUSE+=" libssp objc++"
-	IUSE+=" +openmp"
+
+	# Stop forcing openmp on by default in the eclass. Gradually phase it out.
+	# See bug #890999.
+	if tc_version_is_at_least 13.0.0_pre20221218 ; then
+		IUSE+=" openmp"
+	else
+		IUSE+=" +openmp"
+	fi
 
 	tc_version_is_at_least 4.3 && IUSE+=" fixed-point"
 	tc_version_is_at_least 4.7 && IUSE+=" go"
@@ -281,6 +288,9 @@ if [[ ${PN} != kgcc64 && ${PN} != gcc-* ]] ; then
 	tc_version_is_at_least 12.2.1_p20221203 ${PV} && IUSE+=" default-znow"
 	tc_version_is_at_least 12.2.1_p20221203 ${PV} && IUSE+=" default-stack-clash-protection"
 	tc_version_is_at_least 13.0.0_pre20221218 ${PV} && IUSE+=" modula2"
+	# See https://gcc.gnu.org/pipermail/gcc-patches/2023-April/615944.html
+	# and https://rust-gcc.github.io/2023/04/24/gccrs-and-gcc13-release.html for why
+	# it was disabled in 13.
 	tc_version_is_at_least 14.0.0_pre20230423 ${PV} && IUSE+=" rust"
 fi
 
@@ -642,6 +652,11 @@ toolchain_src_unpack() {
 	if tc_is_live ; then
 		git-r3_src_unpack
 
+		# Needed for gcc --version to include the upstream commit used
+		# rather than only the commit after we apply our patches.
+		# It includes both with this.
+		echo "${EGIT_VERSION}" > "${S}"/gcc/REVISION || die
+
 		if [[ -z ${PATCH_VER} ]] && ! use vanilla ; then
 			toolchain_fetch_git_patches
 		fi
@@ -719,12 +734,11 @@ toolchain_src_prepare() {
 			|| eerror "Please file a bug about this"
 		eend $?
 	done
-	# bug #215828
-	sed -i 's|A-Za-z0-9|[:alnum:]|g' "${S}"/gcc/*.awk || die
 
-	# Prevent new texinfo from breaking old versions (see #198182, bug #464008)
-	einfo "Remove texinfo (bug #198182, bug #464008)"
-	eapply "${FILESDIR}"/gcc-configure-texinfo.patch
+	# bug #215828
+	if ! tc_version_is_at_least 4.6.0 ; then
+		sed -i 's|A-Za-z0-9|[:alnum:]|g' "${S}"/gcc/*.awk || die
+	fi
 
 	if ! use prefix-guest && [[ -n ${EPREFIX} ]] ; then
 		einfo "Prefixifying dynamic linkers..."
@@ -1550,21 +1564,11 @@ toolchain_src_configure() {
 		)
 	fi
 
-	if [[ ${PV} != *_p* && -f "${S}"/gcc/doc/gcc.info ]] ; then
-		# Disable gcc info regeneration -- it ships with generated info pages
-		# already.  Our custom version/urls/etc... trigger it. bug #464008
-		export gcc_cv_prog_makeinfo_modern=no
-	else
-		# Allow a fallback so we don't accidentally install no docs
-		# bug #834845
-		ewarn "No pre-generated info pages in tarball. Allowing regeneration with texinfo..."
-
-		if [[ ${PV} == *_p* && -f "${S}"/gcc/doc/gcc.info ]] ; then
-			# Safeguard against https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106899 being fixed
-			# without corresponding ebuild changes.
-			eqawarn "Snapshot release with pre-generated info pages found!"
-			eqawarn "The BDEPEND in the ebuild should be updated to drop texinfo."
-		fi
+	if [[ ${PV} == *_p* && -f "${S}"/gcc/doc/gcc.info ]] ; then
+		# Safeguard against https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106899 being fixed
+		# without corresponding ebuild changes.
+		eqawarn "Snapshot release with pre-generated info pages found!"
+		eqawarn "The BDEPEND in the ebuild should be updated to drop texinfo."
 	fi
 
 	# Do not let the X detection get in our way.  We know things can be found
@@ -1757,6 +1761,9 @@ gcc_do_filter_flags() {
 		append-flags -O2
 	fi
 
+	# Please use USE=lto instead (bug #906007).
+	filter-lto
+
 	# Avoid shooting self in foot
 	filter-flags '-mabi*' -m31 -m32 -m64
 
@@ -1893,7 +1900,7 @@ toolchain_src_compile() {
 	touch "${S}"/gcc/c-gperf.h || die
 
 	# Do not make manpages if we do not have perl ...
-	[[ ! -x /usr/bin/perl ]] \
+	[[ ! -x "${BROOT}"/usr/bin/perl ]] \
 		&& find "${WORKDIR}"/build -name '*.[17]' -exec touch {} +
 
 	# To compile ada library standard files special compiler options are passed
@@ -2083,16 +2090,6 @@ toolchain_src_install() {
 	# Don't allow symlinks in private gcc include dir as this can break the build
 	find gcc/include*/ -type l -delete || die
 
-	# Copy over the info pages.  We disabled their generation earlier, but the
-	# build system only expects to install out of the build dir, not the source. bug #464008
-	mkdir -p gcc/doc || die
-	local x=
-	for x in "${S}"/gcc/doc/*.info* ; do
-		if [[ -f ${x} ]] ; then
-			cp "${x}" gcc/doc/ || die
-		fi
-	done
-
 	# Re-enable fixincludes for >= GCC 13
 	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107128
 	if [[ ${GCCMAJOR} -lt 13 ]] ; then
@@ -2119,7 +2116,7 @@ toolchain_src_install() {
 		#
 		# Do the 'make install' from the build directory
 		pushd "${WORKDIR}"/build-jit > /dev/null || die
-		S="${WORKDIR}"/build-jit emake DESTDIR="${D}" install
+		S="${WORKDIR}"/build-jit emake DESTDIR="${D}" -j1 install
 
 		# Punt some tools which are really only useful while building gcc
 		find "${ED}" -name install-tools -prune -type d -exec rm -rf "{}" \;
@@ -2133,7 +2130,17 @@ toolchain_src_install() {
 	fi
 
 	# Do the 'make install' from the build directory
-	S="${WORKDIR}"/build emake DESTDIR="${D}" install
+	#
+	# Unfortunately, we have to use -j1 for make install. Upstream
+	# don't really test it and there's not much appetite for fixing bugs
+	# with it. Several reported bugs exist where the resulting image
+	# was wrong, rather than a simple compile/install failure:
+	# - bug #906155
+	# - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42980
+	# - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=51814
+	# - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103656
+	# - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109898
+	S="${WORKDIR}"/build emake DESTDIR="${D}" -j1 install
 
 	# Punt some tools which are really only useful while building gcc
 	find "${ED}" -name install-tools -prune -type d -exec rm -rf "{}" \;
diff --git a/sdk_container/src/third_party/portage-stable/eclass/waf-utils.eclass b/sdk_container/src/third_party/portage-stable/eclass/waf-utils.eclass
index e2a23e66b9..f8d4b0aa94 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/waf-utils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/waf-utils.eclass
@@ -138,8 +138,9 @@ waf-utils_src_install() {
 
 	export PYTHONHASHSEED=1
 
-	echo "\"${WAF_BINARY}\" --jobs=1 --destdir=\"${D}\" ${*} install"
-	"${WAF_BINARY}" --jobs=1 --destdir="${D}" "${@}" install || die "Make install failed"
+	local jobs="--jobs=$(makeopts_jobs)"
+	echo "\"${WAF_BINARY}\" ${jobs} --destdir=\"${D}\" ${*} install"
+	"${WAF_BINARY}" ${jobs} --destdir="${D}" "${@}" install || die "Make install failed"
 
 	# Manual document installation
 	einstalldocs
diff --git a/sdk_container/src/third_party/portage-stable/licenses/GPL-2+-with-eCos-exception-2 b/sdk_container/src/third_party/portage-stable/licenses/GPL-2+-with-eCos-exception-2
new file mode 100644
index 0000000000..e5cceeaf5f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/GPL-2+-with-eCos-exception-2
@@ -0,0 +1,12 @@
+GNU General Public License, version 2 or any later version.
+See GPL-2 or GPL-3 for the full text of these licenses.
+
+As a special exception, if other files instantiate templates or use macros or
+inline functions from this file, or you compile this file and link it with
+other works to produce a work based on this file, this file does not by itself
+cause the resulting work to be covered by the GNU General Public License.
+However the source code for this file must still be made available in
+accordance with section (3) of the GNU General Public License v2.
+
+This exception does not invalidate any other reasons why a work based on this
+file might be covered by the GNU General Public License.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/GregoryRubin b/sdk_container/src/third_party/portage-stable/licenses/GregoryRubin
new file mode 100644
index 0000000000..1143d2f354
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/GregoryRubin
@@ -0,0 +1,2 @@
+Copyright 2006 Gregory Rubin grrubin@gmail.com
+Permission is given to use, modify, and or distribute this code so long as this message remains attached
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/Manifest b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/Manifest
index ba0eb83f06..05183fc01e 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/Manifest
@@ -2,3 +2,6 @@ DIST nmap-7.92.tar.bz2 10498200 BLAKE2B 0f3022e797ffca7d1d3497990c86bb60ac9a80bb
 DIST nmap-7.92.tar.bz2.asc 195 BLAKE2B a8052138e58cd8009341a5f3fb3a31f55af9383b9dbb6c7ce858d80541e000b17953c053e9a3a6d86a5551244cf13f181e6e3943095b86335cbb5dae96e20bdd SHA512 300a22ab097bbff67de354de6b22a8e3287f95dd6318fcabd546ba52158e9589b19ede175587c6e31518c47bc118c7dd05db43755def075d810b16945b65e05a
 DIST nmap-7.93.tar.bz2 10823114 BLAKE2B e9fa0fe0f219258ab29cf59a98f09142ce1e5e70395f6578d57e644d343ff95764a8208f2fd00a686a14217821adb038a1bb4cdf25f355696e68131773cc1995 SHA512 4ec9295e25bd7a215e718c3dbbf09bfe6339b60850f4a8d09b5ad0cbf41a0da8ece0168efc5ca91ba1ecbd83b1d31735d77dacd5f1ec1a9fd212454dd1f0f0fd
 DIST nmap-7.93.tar.bz2.asc 195 BLAKE2B 0c18200507c8c0901df6f0fa3230330eff72dd5e54f2d862d35a1df26b9ff3b189cebe0b91cdf47c4f87fef523cc6d9c3bcc36a42d8fcc8be7830fc861c64b5f SHA512 9bd8e436a6f7010ba2e3578affc4174fae12e2e7b78e523ceeb94ba44ccd928ac2cf5da52d02a00c4f190f71425671cc817b44a6a2f8d0b42b10d535bb1af3a9
+DIST nmap-7.94-patches.tar.xz 4112 BLAKE2B 0720242bf507f2a1502cf854592d94a57a33d5ac1e520c752e548092f91bbffeb0f6f762f4da27ff445419ff3845060242aa43aba53d0161ae2bebccf728cc97 SHA512 d47e2215e1923af65e3a392c3d990d650e68135f139013c311a26d12cfd0b27d9d5c3cbc27bb8583251a353a6284fb9d518373f17624db242be7060b8bfa0ba5
+DIST nmap-7.94.tar.bz2 11102195 BLAKE2B 5819b458b50e33f6a507ad3c32a731c13e730c40d31a61731c3cfcd41fad8e3fdfcbb721ef46b05a80e406d0a646d0966d4b645551711144822551ef374a443a SHA512 a55cddf9c1d9272243d01251eb3315b26f232d0596818857083222a385398618b428dc2bd8282c3e832527e135a74aeb020ca8609d83d8337342f5d8a04d7f2c
+DIST nmap-7.94.tar.bz2.asc 198 BLAKE2B 38a363499fe236f675238ecf015a7e597d66cdd84eef13bed4986b4081c4f1f7a288121e3666e0f31a9282fd84f30cbceb65341f1c173086c7421a8ea719afe9 SHA512 dcbaf88e9ead21f303a7ee5390de0d2bd67477c2628858dc3380b0ac7d73d4d1b330f3b303ff32b0cb9a22eaa37af535bd7aa622531451e404a8c9a256a98eec
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-7.94.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-7.94.ebuild
new file mode 100644
index 0000000000..246e6bb067
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-7.94.ebuild
@@ -0,0 +1,187 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LUA_COMPAT=( lua5-4 )
+LUA_REQ_USE="deprecated"
+PYTHON_COMPAT=( python3_{10..11} )
+PLOCALES="de es fr hi hr hu id it ja pl pt_BR pt_PR ro ru sk zh"
+PLOCALE_BACKUP="en"
+inherit autotools lua-single plocale python-single-r1 toolchain-funcs
+
+DESCRIPTION="Network exploration tool and security / port scanner"
+HOMEPAGE="https://nmap.org/"
+if [[ ${PV} == *9999* ]] ; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/nmap/nmap"
+
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/nmap.asc
+	inherit verify-sig
+
+	SRC_URI="https://nmap.org/dist/${P}.tar.bz2"
+	SRC_URI+=" verify-sig? ( https://nmap.org/dist/sigs/${P}.tar.bz2.asc )"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+fi
+
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-7.94-patches.tar.xz"
+
+# https://github.com/nmap/nmap/issues/2199
+LICENSE="NPSL-0.95"
+SLOT="0"
+IUSE="ipv6 libssh2 ncat ndiff nping nls +nse ssl symlink zenmap"
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	nse? ( ${LUA_REQUIRED_USE} )
+	symlink? ( ncat )
+"
+
+RDEPEND="
+	dev-libs/liblinear:=
+	dev-libs/libpcre
+	net-libs/libpcap
+	ndiff? ( ${PYTHON_DEPS} )
+	libssh2? (
+		net-libs/libssh2[zlib]
+		sys-libs/zlib
+	)
+	nls? ( virtual/libintl )
+	nse? (
+		${LUA_DEPS}
+		sys-libs/zlib
+	)
+	ssl? ( dev-libs/openssl:= )
+	symlink? (
+		ncat? (
+			!net-analyzer/netcat
+			!net-analyzer/openbsd-netcat
+		)
+	)
+	zenmap? (
+		${PYTHON_DEPS}
+		$(python_gen_cond_dep '
+			dev-python/pygobject:3[${PYTHON_USEDEP}]
+		')
+	)
+"
+DEPEND="${RDEPEND}"
+# Python is always needed at build time for some scripts
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+"
+
+if [[ ${PV} != *9999* ]] ; then
+	BDEPEND+=" verify-sig? ( sec-keys/openpgp-keys-nmap )"
+fi
+
+PATCHES=(
+	"${WORKDIR}"/${PN}-7.94-patches
+)
+
+pkg_setup() {
+	python-single-r1_pkg_setup
+
+	use nse && lua-single_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.bz2{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	# Drop bundled libraries
+	rm -r liblinear/ libpcap/ libpcre/ libssh2/ libz/ || die
+
+	cat "${FILESDIR}"/nls.m4 >> "${S}"/acinclude.m4 || die
+
+	delete_disabled_locale() {
+		# Force here as PLOCALES contains supported locales for man
+		# pages and zenmap doesn't have all of those
+		rm -rf zenmap/share/zenmap/locale/${1} || die
+		rm -f zenmap/share/zenmap/locale/${1}.po || die
+	}
+	plocale_for_each_disabled_locale delete_disabled_locale
+
+	sed -i \
+		-e '/^ALL_LINGUAS =/{s|$| id|g;s|jp|ja|g}' \
+		Makefile.in || die
+
+	cp libdnet-stripped/include/config.h.in{,.nmap-orig} || die
+
+	eautoreconf
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# We need the original for a Darwin-specific fix, bug #604432
+		mv libdnet-stripped/include/config.h.in{.nmap-orig,} || die
+	fi
+}
+
+src_configure() {
+	export ac_cv_path_PYTHON="${PYTHON}"
+	export am_cv_pathless_PYTHON="${EPYTHON}"
+
+	local myeconfargs=(
+		$(use_enable ipv6)
+		$(use_enable nls)
+		$(use_with libssh2)
+		$(use_with ncat)
+		$(use_with ndiff)
+		$(use_with nping)
+		$(use_with nse liblua)
+		$(use_with ssl openssl)
+		$(use_with zenmap)
+		$(usex libssh2 --with-zlib)
+		$(usex nse --with-zlib)
+		--cache-file="${S}"/config.cache
+		# The bundled libdnet is incompatible with the version available in the
+		# tree, so we cannot use the system library here.
+		--with-libdnet=included
+		--with-pcre="${ESYSROOT}"/usr
+		--without-dpdk
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	local directory
+	for directory in . libnetutil nsock/src $(usev ncat) $(usev nping) ; do
+		emake -C "${directory}" makefile.dep
+	done
+
+	emake \
+		AR="$(tc-getAR)" \
+		RANLIB="$(tc-getRANLIB)"
+}
+
+src_install() {
+	# See bug #831713 for return of -j1
+	LC_ALL=C emake \
+		-j1 \
+		DESTDIR="${D}" \
+		STRIP=: \
+		nmapdatadir="${EPREFIX}"/usr/share/nmap \
+		install
+
+	dodoc CHANGELOG HACKING docs/README docs/*.txt
+
+	if use ndiff || use zenmap ; then
+		python_optimize
+	fi
+
+	use symlink && dosym /usr/bin/ncat /usr/bin/nc
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-9999.ebuild
index f18840ef88..246e6bb067 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/nmap/nmap-9999.ebuild
@@ -3,9 +3,9 @@
 
 EAPI=8
 
-LUA_COMPAT=( lua5-3 )
+LUA_COMPAT=( lua5-4 )
 LUA_REQ_USE="deprecated"
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..11} )
 PLOCALES="de es fr hi hr hu id it ja pl pt_BR pt_PR ro ru sk zh"
 PLOCALE_BACKUP="en"
 inherit autotools lua-single plocale python-single-r1 toolchain-funcs
@@ -27,6 +27,8 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 fi
 
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-7.94-patches.tar.xz"
+
 # https://github.com/nmap/nmap/issues/2199
 LICENSE="NPSL-0.95"
 SLOT="0"
@@ -78,16 +80,7 @@ if [[ ${PV} != *9999* ]] ; then
 fi
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-5.10_beta1-string.patch
-	"${FILESDIR}"/${PN}-5.21-python.patch
-	"${FILESDIR}"/${PN}-6.46-uninstaller.patch
-	"${FILESDIR}"/${PN}-6.25-liblua-ar.patch
-	"${FILESDIR}"/${PN}-7.25-CXXFLAGS.patch
-	"${FILESDIR}"/${PN}-7.25-libpcre.patch
-	"${FILESDIR}"/${PN}-7.31-libnl.patch
-	"${FILESDIR}"/${PN}-7.80-ac-config-subdirs.patch
-	"${FILESDIR}"/${PN}-7.91-no-FORTIFY_SOURCE.patch
-	"${FILESDIR}"/${PN}-9999-netutil-else.patch
+	"${WORKDIR}"/${PN}-7.94-patches
 )
 
 pkg_setup() {
@@ -96,6 +89,17 @@ pkg_setup() {
 	use nse && lua-single_pkg_setup
 }
 
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.bz2{,.asc}
+	fi
+
+	default
+}
+
 src_prepare() {
 	default
 
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
index 3d4b366886..364f0ae0ad 100644
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/Manifest
@@ -1,2 +1 @@
-DIST traceroute-2.1.0.tar.gz 71460 BLAKE2B 4c2126fa98625d525d0a1b0075d16a6ff37836e18d2ce8319f58c89bfa22a6a5e3bbe2ded22fa98d5128c7bb58578327db08120a5b78c1c4ff5673dcc0dea7e6 SHA512 3578007c734091ea0c906637c03fd133a8b0154fbf2e6b5c0c881184947918196bc03aeaf872d3bd53777b9b771cba5cf97f73fb5916bb53b75037f429b40ed3
 DIST traceroute-2.1.1.tar.gz 73063 BLAKE2B 89a828f7a0fec30ece599ee7fdd13fd93db0668f6c9f930f1d6d7d94140bcfdf0c75d2d8c5cc52d699e5c4377239f1a4123ad73a98b619968955d029d0842d9f SHA512 f3358e57ffb4a8dc40650e941da879c60407414e44f9887ae65820d1089491dbfac579bd06c1df296738af89a6c61c1e7944ae4495464f8c9ae21afb19b8f296
diff --git a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.0-r2.ebuild
deleted file mode 100644
index ca9e2e6708..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-analyzer/traceroute/traceroute-2.1.0-r2.ebuild
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic toolchain-funcs
-
-DESCRIPTION="Utility to trace the route of IP packets"
-HOMEPAGE="http://traceroute.sourceforge.net/"
-SRC_URI="mirror://sourceforge/traceroute/${P}.tar.gz"
-
-LICENSE="GPL-2 LGPL-2.1"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="static"
-
-RDEPEND="!net-misc/iputils[traceroute6(-)]"
-
-src_compile() {
-	use static && append-ldflags -static
-	append-ldflags -L../libsupp #432116
-	tc-export AR CC RANLIB
-	emake env=yes
-}
-
-src_install() {
-	emake DESTDIR="${D}" prefix="${EPREFIX}/usr" install
-	dodoc ChangeLog CREDITS README TODO
-	dosym traceroute /usr/bin/traceroute6
-	dosym traceroute.8 /usr/share/man/man8/traceroute6.8
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/Manifest
index 7d7eaf0fa8..be60bddc34 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/Manifest
@@ -1,4 +1,3 @@
-DIST bind-9.16.33.tar.xz 5092516 BLAKE2B 4246b61ce91af3d494ace4b8065b4c0043b2cfaf28c6de326691a969837e7d1cfbc0dac6b1e1a5182fc32af68048abcfa1202d00022951f3caa13afb03ebeb69 SHA512 43fd2cea52dfd1115a4cca83830ab5b93208be401cdbbdff2bbf204b8f0d99fb434ad3156d3a21649488cc904ae09f145feba97b9b6918b0cf063ff5e2b10af5
-DIST bind-9.16.36.tar.xz 5105696 BLAKE2B 3f506198b038ee96d9c6d5b20d629bc8cf44eadc1d86a0a0cf7126f615a929fa95fa27a63db3a5bcbff2af6aebc74a734ed5abcdfd38c9488ca89ebeb536875a SHA512 521a021456b6daf260fead75efc298dd964ff00947fd95fadb3c13d52f4c07fb61b74861601d22722e8d546dca284524fd4d770cc5cf347d9659b6df9654ed95
 DIST bind-9.16.37.tar.xz 5109440 BLAKE2B 3b18f7c780ce04e296498e30c09628ad8eb89f38afdb032700455f193a3f8556029cd2e3d3c42861965d5fc776f56f761b8d21a74a0f95d82338e65fb519acfb SHA512 2c4b01f6cc598849688b5b2710caf48db47e1e860df785783ef2b140a25507b48357a9becf7911ba0feda285c4bca87764e21128fac5cf17efa47fd5134dc59f
 DIST bind-9.16.39.tar.xz 5120164 BLAKE2B d9fb51435dce11c8854084cc21de79df3ae6529baead76dcf27711bcff33469d1fd6fbd3366b61bc921f92850620c9b7464d4dbe08dd0c7e2f3e5e1c1100cb79 SHA512 6e2e30815222a289e94f6857fdb6b142558ca56ecf5f8291f843f8476da8e4011042f1dd2bed031e5d9924370ae0705ce5b3ea2ce10ae830f8980b669eb26328
+DIST bind-9.16.41.tar.xz 5121884 BLAKE2B 53ccc399acc98f79930f51314c1f4e1135370347f05c7a293ac416669c6125b2d56edda20b9ecd86e6ec3ccf05a95c3eb0b836c26b14cf7ee3d1869f578280e5 SHA512 93c374ef82ff36e222a790161942635d0b977813b5040f8895e1c032b4ca1925addc8ef3a06417445036dc35aeb708cc61bd589c6a9cb78980f77ab402c44bee
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.36-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.36-r1.ebuild
deleted file mode 100644
index a0e03ab006..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.36-r1.ebuild
+++ /dev/null
@@ -1,160 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools flag-o-matic multiprocessing toolchain-funcs
-
-MY_PN=${PN//-tools}
-MY_PV=${PV/_p/-P}
-MY_PV=${MY_PV/_rc/rc}
-MY_P="${MY_PN}-${MY_PV}"
-
-DESCRIPTION="bind tools: dig, nslookup, host, nsupdate, dnssec-keygen"
-HOMEPAGE="https://www.isc.org/software/bind https://gitlab.isc.org/isc-projects/bind9"
-SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
-
-LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+caps doc gssapi idn libedit readline test xml"
-# no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
-RESTRICT="!test? ( test )"
-
-# libuv lower bound should be the highest value seen at
-# https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_16/lib/isc/netmgr/netmgr.c#L244
-# to avoid issues with matching stable/testing, etc
-COMMON_DEPEND="
-	>=dev-libs/libuv-1.42.0:=
-	dev-libs/openssl:=
-	caps? ( sys-libs/libcap )
-	xml? ( dev-libs/libxml2 )
-	idn? ( net-dns/libidn2:= )
-	gssapi? ( virtual/krb5 )
-	libedit? ( dev-libs/libedit )
-	!libedit? (
-		readline? ( sys-libs/readline:= )
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-
-# sphinx required for man-page and html creation
-BDEPEND="
-	virtual/pkgconfig
-	doc? ( dev-python/sphinx )
-	test? (
-		dev-util/cmocka
-		dev-util/kyua
-	)
-"
-
-S="${WORKDIR}/${MY_P}"
-
-src_prepare() {
-	default
-
-	append-ldflags "-L${ESYSROOT}/usr/$(get_libdir)"
-
-	# Do not disable thread local storage on Solaris, it works with our
-	# toolchain, and it breaks further configure checks
-	sed -i -e '/LDFLAGS=/s/-zrelax=transtls//' configure.ac configure || die
-
-	# bug #220361
-	rm aclocal.m4 || die
-	rm -rf libtool.m4/ || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}"/var
-		--without-python
-		--without-libjson
-		--without-zlib
-		--without-lmdb
-		--without-maxminddb
-		--disable-geoip
-		--with-openssl="${ESYSROOT}"/usr
-		$(use_with idn libidn2 "${ESYSROOT}"/usr)
-		$(use_with xml libxml2)
-		$(use_with gssapi)
-		$(use_with readline)
-		$(use_enable caps linux-caps)
-		AR="$(type -P $(tc-getAR))"
-	)
-
-	# bug 607400
-	if use libedit ; then
-		myeconfargs+=( --with-readline=-ledit )
-	elif use readline ; then
-		myeconfargs+=( --with-readline=-lreadline )
-	else
-		myeconfargs+=( --without-readline )
-	fi
-
-	# bug #344029
-	append-cflags "-DDIG_SIGCHASE"
-
-	# to expose CMSG_* macros from sys/sockets.h
-	[[ ${CHOST} == *-solaris* ]] && append-cflags "-D_XOPEN_SOURCE=600"
-
-	# localstatedir for nsupdate -l, bug #395785
-	tc-export BUILD_CC
-	econf "${myeconfargs[@]}"
-
-	# bug #151839
-	echo '#undef SO_BSDCOMPAT' >> config.h || die
-}
-
-src_compile() {
-	local AR="$(tc-getAR)"
-
-	emake AR="${AR}" -C lib/
-	emake AR="${AR}" -C bin/delv/
-	emake AR="${AR}" -C bin/dig/
-	emake AR="${AR}" -C bin/nsupdate/
-	emake AR="${AR}" -C bin/dnssec/
-	emake -C doc/man/ man $(usev doc)
-}
-
-src_test() {
-	# system tests ('emake test') require network configuration for IPs etc
-	# so we run the unit tests instead.
-	TEST_PARALLEL_JOBS="$(makeopts_jobs)" emake unit
-}
-
-src_install() {
-	local man_dir="${S}/doc/man"
-	local html_dir="${man_dir}/_build/html"
-
-	dodoc README CHANGES
-
-	cd "${S}"/bin/delv || die
-	dobin delv
-	doman ${man_dir}/delv.1
-
-	cd "${S}"/bin/dig || die
-	dobin dig host nslookup
-	doman ${man_dir}/{dig,host,nslookup}.1
-
-	cd "${S}"/bin/nsupdate || die
-	dobin nsupdate
-	doman ${man_dir}/nsupdate.1
-	if use doc; then
-		docinto html
-		dodoc ${html_dir}/nsupdate.html
-	fi
-
-	cd "${S}"/bin/dnssec || die
-	for tool in dsfromkey importkey keyfromlabel keygen \
-		revoke settime signzone verify; do
-		dobin dnssec-"${tool}"
-		doman ${man_dir}/dnssec-"${tool}".8
-		if use doc; then
-			docinto html
-			dodoc ${html_dir}/dnssec-"${tool}".html
-		fi
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.33-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.41.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.33-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.41.ebuild
index a0e03ab006..da4c92eb0d 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.33-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.41.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
 
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="+caps doc gssapi idn libedit readline test xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/Manifest
index adae5f578d..072eb7b53c 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/Manifest
@@ -1,5 +1 @@
-DIST dnsmasq-2.85.tar.xz 518316 BLAKE2B b7c081132c65d67b65f797bdbc603930c1509717bc1b5209b12f72fa3f01b4bae2f26a5387f95ef20317cd3d60e097c0b8bef5e019a35013f3ed2acce9fe9e89 SHA512 8beefe76b46f7d561f40d0900ba68b260a199cb62ab5b653746e3a1104c04fb8899b9e7a160a1be4fe8782bfb1607b556e9ffb9c25c4e99653e4bc74fcc03b09
-DIST dnsmasq-2.86.tar.xz 531404 BLAKE2B 27307c70cc90d6e27dbf8e87589b8c72622e93f402c3a431e06facc58a62af46a478d1fdbfb9808a91ff3d2f5da88a8d12de9755009b558d685903e4d2a34de3 SHA512 487eae0afbc8bb3d5282a729ffb0cb2c9bdc7d8e46e2e8aa114cd7c5d82e0fd66f49926e7fa4028577548d6f57e8a865aca17f33963a589874584d608ab2deaf
-DIST dnsmasq-2.87.tar.xz 540528 BLAKE2B 9d348f1746f819ea5da90ac341bd82254ec83acd8193732f99312d5c56073c8f3f374bf89cecec4fe58632c9e9f84e312a5474c561420dfd8537e221ecf68e2f SHA512 965071ff35aed558a661e7f57ff82de170f4ad7fcdd6a4070ce7915c9f5e41450d8d86b2a0c2c30bf52ddc3aaeb22af18bb6da71a1cccb3c409429ef0ef308f3
-DIST dnsmasq-2.88.tar.xz 560640 BLAKE2B e7e11a77b6ecbdcfba08677f41767f1c8330bc762dd308637923f198f4bde255660a78dfe181014ce08268d7eb9c8554e0409a3b691fee67e5b20e2344bd8d8e SHA512 109ee4513cb25fb0c9ff6f81d696c195a24ffa013847fdc3a507757137fff098248e2b907a87695075405039c4dc0eda40803395a52306ce673ca593cc4f4e00
 DIST dnsmasq-2.89.tar.xz 562700 BLAKE2B d8be39697ce7d4e7beacf6d94a9ba1842fe0099f7ed7ebb243a7e6e5af8c83195e4723e60841705aee70a43510279be8484a9474191ddcf17eac1ff4edc5389f SHA512 4384ed5b673e10eaf6532e6eaeb5c0a6b817581433cc28c632bdcbadbfc050a0ab73bc5b73c98d708cd39515bb3f72168714b0aa5f16436cebdd18020648d428
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.85.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.85.ebuild
deleted file mode 100644
index bf8a17f1d9..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.85.ebuild
+++ /dev/null
@@ -1,217 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-
-inherit toolchain-funcs flag-o-matic lua-single systemd
-
-DESCRIPTION="Small forwarding DNS server"
-HOMEPAGE="https://thekelleys.org.uk/dnsmasq/doc.html"
-SRC_URI="https://thekelleys.org.uk/dnsmasq/${P}.tar.xz"
-
-LICENSE="|| ( GPL-2 GPL-3 )"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-IUSE="auth-dns conntrack dbus +dhcp dhcp-tools dnssec +dumpfile id idn libidn2"
-IUSE+=" +inotify ipv6 lua nettlehash nls script selinux static tftp"
-
-DM_LINGUAS=(de es fi fr id it no pl pt_BR ro)
-
-BDEPEND="
-	app-arch/xz-utils
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-"
-
-COMMON_DEPEND="
-	acct-group/dnsmasq
-	acct-user/dnsmasq
-	dbus? ( sys-apps/dbus:= )
-	idn? (
-		!libidn2? ( net-dns/libidn:0= )
-		libidn2? ( >=net-dns/libidn2-2.0:= )
-	)
-	lua? ( ${LUA_DEPS} )
-	conntrack? ( net-libs/libnetfilter_conntrack:= )
-	nls? ( sys-devel/gettext )
-"
-
-DEPEND="${COMMON_DEPEND}
-	dnssec? (
-		dev-libs/nettle:=[gmp]
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-"
-
-RDEPEND="${COMMON_DEPEND}
-	dnssec? (
-		!static? ( >=dev-libs/nettle-3.4:=[gmp] )
-	)
-	selinux? ( sec-policy/selinux-dnsmasq )
-"
-
-REQUIRED_USE="
-	dhcp-tools? ( dhcp )
-	dnssec? ( !nettlehash )
-	lua? (
-		script
-		${LUA_REQUIRED_USE}
-	)
-	libidn2? ( idn )
-"
-
-use_have() {
-	local no_only
-	if [[ ${1} == '-n' ]]; then
-		no_only=1
-		shift
-	fi
-	local useflag="${1}"
-	shift
-
-	local uword="${1:-${useflag}}"
-	shift
-
-	while [[ ${uword} ]]; do
-		uword="${uword^^}"
-
-		if ! use "${useflag}"; then
-			printf -- " -DNO_%s" "${uword}"
-		elif [[ -z "${no_only}" ]]; then
-			printf -- " -DHAVE_%s" "${uword}"
-		fi
-		uword="${1}"
-		shift
-	done
-}
-
-pkg_setup() {
-	use lua && lua-single_pkg_setup
-}
-
-pkg_pretend() {
-	if use static; then
-		einfo "Only sys-libs/gmp and dev-libs/nettle are statically linked."
-		use dnssec || einfo "Thus, ${P}[!dnssec,static] makes no sense;" \
-			"in this case the static USE flag does nothing."
-	fi
-}
-
-src_prepare() {
-	default
-
-	sed -i -r 's:lua5.[0-9]+:lua:' Makefile || die
-	sed -i "s:%%PREFIX%%:${EPREFIX}/usr:" \
-		dnsmasq.conf.example || die
-}
-
-src_configure() {
-	COPTS=(
-		$(use_have -n auth-dns auth)
-		$(use_have conntrack)
-		$(use_have dbus)
-		$(use libidn2 || use_have idn)
-		$(use_have libidn2)
-		$(use_have -n inotify)
-		$(use_have -n dhcp dhcp dhcp6)
-		$(use_have -n ipv6 ipv6 dhcp6)
-		$(use_have -n id id)
-		$(use_have lua luascript)
-		$(use_have -n script)
-		$(use_have -n tftp)
-		$(use_have dnssec)
-		$(use_have nettlehash)
-		$(use_have static dnssec_static)
-		$(use_have -n dumpfile)
-	)
-}
-
-src_compile() {
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		COPTS="${COPTS[*]}" \
-		CONFFILE="/etc/${PN}.conf" \
-		all$(use nls && printf -- "-i18n\n")
-
-	use dhcp-tools && emake -C contrib/lease-tools \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		all
-}
-
-src_install() {
-	local lingua puid
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		COPTS="${COPTS[*]}" \
-		DESTDIR="${ED}" \
-		install$(use nls && printf -- "-i18n\n")
-
-	for lingua in "${DM_LINGUAS[@]}"; do
-		has ${lingua} ${LINGUAS-${lingua}} \
-			|| rm -rf "${ED}"/usr/share/locale/${lingua}
-	done
-	[[ -d "${D}"/usr/share/locale/ ]] && \
-		rmdir --ignore-fail-on-non-empty "${ED}"/usr/share/locale/
-
-	dodoc CHANGELOG CHANGELOG.archive FAQ dnsmasq.conf.example
-	dodoc -r logo
-
-	docinto html/
-	dodoc *.html
-
-	newinitd "${FILESDIR}"/dnsmasq-init-r4 ${PN}
-	newconfd "${FILESDIR}"/dnsmasq.confd-r1 ${PN}
-
-	insinto /etc/logrotate.d
-	newins "${FILESDIR}"/dnsmasq.logrotate ${PN}
-
-	insinto /etc
-	newins dnsmasq.conf.example dnsmasq.conf
-
-	insinto /usr/share/dnsmasq
-	doins trust-anchors.conf
-
-	if use dhcp; then
-		keepdir /var/lib/misc
-		newinitd "${FILESDIR}"/dnsmasq-init-dhcp-r3 ${PN}
-	fi
-	if use dbus; then
-		insinto /etc/dbus-1/system.d
-		doins dbus/dnsmasq.conf
-	fi
-
-	if use dhcp-tools; then
-		dosbin contrib/lease-tools/{dhcp_release,dhcp_lease_time}
-		doman contrib/lease-tools/{dhcp_release,dhcp_lease_time}.1
-		if use ipv6; then
-			dosbin contrib/lease-tools/dhcp_release6
-			doman contrib/lease-tools/dhcp_release6.1
-		fi
-	fi
-
-	systemd_newunit "${FILESDIR}"/${PN}.service-r1 ${PN}.service
-}
-
-pkg_preinst() {
-	[[ -f /var/lib/misc/dnsmasq.leases ]] && \
-		cp /var/lib/misc/dnsmasq.leases "${T}"
-}
-
-pkg_postinst() {
-	[[ -f "${T}"/dnsmasq.leases ]] && \
-		cp "${T}"/dnsmasq.leases /var/lib/misc/dnsmasq.leases
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.86-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.86-r1.ebuild
deleted file mode 100644
index 2dedc9efdc..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.86-r1.ebuild
+++ /dev/null
@@ -1,224 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-
-inherit toolchain-funcs lua-single systemd
-
-DESCRIPTION="Small forwarding DNS server"
-HOMEPAGE="https://thekelleys.org.uk/dnsmasq/doc.html"
-SRC_URI="https://thekelleys.org.uk/dnsmasq/${P}.tar.xz"
-
-LICENSE="|| ( GPL-2 GPL-3 )"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-
-IUSE="auth-dns conntrack dbus +dhcp dhcp-tools dnssec +dumpfile id idn libidn2"
-IUSE+=" +loop +inotify ipv6 lua nettlehash nls script selinux static tftp"
-
-DM_LINGUAS=(de es fi fr id it no pl pt_BR ro)
-
-BDEPEND="
-	app-arch/xz-utils
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-"
-
-COMMON_DEPEND="
-	acct-group/dnsmasq
-	acct-user/dnsmasq
-	dbus? ( sys-apps/dbus:= )
-	idn? (
-		!libidn2? ( net-dns/libidn:0= )
-		libidn2? ( >=net-dns/libidn2-2.0:= )
-	)
-	lua? ( ${LUA_DEPS} )
-	conntrack? ( net-libs/libnetfilter_conntrack:= )
-	nls? ( sys-devel/gettext )
-"
-
-DEPEND="${COMMON_DEPEND}
-	dnssec? (
-		dev-libs/nettle:=[gmp]
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-	nettlehash? (
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-"
-
-RDEPEND="${COMMON_DEPEND}
-	dnssec? (
-		!static? ( >=dev-libs/nettle-3.4:=[gmp] )
-	)
-	nettlehash? (
-		!static? ( dev-libs/nettle:=[gmp] )
-	)
-	selinux? ( sec-policy/selinux-dnsmasq )
-"
-
-REQUIRED_USE="
-	dhcp-tools? ( dhcp )
-	dnssec? ( !nettlehash )
-	lua? (
-		script
-		${LUA_REQUIRED_USE}
-	)
-	libidn2? ( idn )
-"
-
-use_have() {
-	local no_only
-	if [[ ${1} == '-n' ]]; then
-		no_only=1
-		shift
-	fi
-	local useflag="${1}"
-	shift
-
-	local uword="${1:-${useflag}}"
-	shift
-
-	while [[ ${uword} ]]; do
-		uword="${uword^^}"
-
-		if ! use "${useflag}"; then
-			printf -- " -DNO_%s" "${uword}"
-		elif [[ -z "${no_only}" ]]; then
-			printf -- " -DHAVE_%s" "${uword}"
-		fi
-		uword="${1}"
-		shift
-	done
-}
-
-pkg_setup() {
-	use lua && lua-single_pkg_setup
-}
-
-pkg_pretend() {
-	if use static; then
-		einfo "Only sys-libs/gmp and dev-libs/nettle are statically linked."
-		use dnssec || einfo "Thus, ${P}[!dnssec,static] makes no sense;" \
-			"in this case the static USE flag does nothing."
-	fi
-}
-
-src_prepare() {
-	default
-
-	sed -i -r 's:lua5.[0-9]+:lua:' Makefile || die
-	sed -i "s:%%PREFIX%%:${EPREFIX}/usr:" \
-		dnsmasq.conf.example || die
-}
-
-src_configure() {
-	COPTS=(
-		$(use_have -n auth-dns auth)
-		$(use_have conntrack)
-		$(use_have dbus)
-		$(use libidn2 || use_have idn)
-		$(use_have libidn2)
-		$(use_have -n inotify)
-		$(use_have -n dhcp dhcp dhcp6)
-		$(use_have -n ipv6 ipv6 dhcp6)
-		$(use_have -n id id)
-		$(use_have -n loop)
-		$(use_have lua luascript)
-		$(use_have -n script)
-		$(use_have -n tftp)
-		$(use_have dnssec)
-		$(use_have nettlehash)
-		$(use_have static dnssec_static)
-		$(use_have -n dumpfile)
-	)
-}
-
-src_compile() {
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		COPTS="${COPTS[*]}" \
-		CONFFILE="/etc/${PN}.conf" \
-		all$(use nls && printf -- "-i18n\n")
-
-	use dhcp-tools && emake -C contrib/lease-tools \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		all
-}
-
-src_install() {
-	local lingua puid
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		COPTS="${COPTS[*]}" \
-		DESTDIR="${ED}" \
-		install$(use nls && printf -- "-i18n\n")
-
-	for lingua in "${DM_LINGUAS[@]}"; do
-		has ${lingua} ${LINGUAS-${lingua}} \
-			|| rm -rf "${ED}"/usr/share/locale/${lingua}
-	done
-	[[ -d "${D}"/usr/share/locale/ ]] && \
-		rmdir --ignore-fail-on-non-empty "${ED}"/usr/share/locale/
-
-	dodoc CHANGELOG CHANGELOG.archive FAQ dnsmasq.conf.example
-	dodoc -r logo
-
-	docinto html/
-	dodoc *.html
-
-	newinitd "${FILESDIR}"/dnsmasq-init-r4 ${PN}
-	newconfd "${FILESDIR}"/dnsmasq.confd-r1 ${PN}
-
-	insinto /etc/logrotate.d
-	newins "${FILESDIR}"/dnsmasq.logrotate ${PN}
-
-	insinto /etc
-	newins dnsmasq.conf.example dnsmasq.conf
-
-	insinto /usr/share/dnsmasq
-	doins trust-anchors.conf
-
-	if use dhcp; then
-		keepdir /var/lib/misc
-		newinitd "${FILESDIR}"/dnsmasq-init-dhcp-r3 ${PN}
-	fi
-	if use dbus; then
-		insinto /etc/dbus-1/system.d
-		doins dbus/dnsmasq.conf
-	fi
-
-	if use dhcp-tools; then
-		dosbin contrib/lease-tools/{dhcp_release,dhcp_lease_time}
-		doman contrib/lease-tools/{dhcp_release,dhcp_lease_time}.1
-		if use ipv6; then
-			dosbin contrib/lease-tools/dhcp_release6
-			doman contrib/lease-tools/dhcp_release6.1
-		fi
-	fi
-
-	systemd_newunit "${FILESDIR}"/${PN}.service-r1 ${PN}.service
-}
-
-pkg_preinst() {
-	[[ -f /var/lib/misc/dnsmasq.leases ]] && \
-		cp /var/lib/misc/dnsmasq.leases "${T}"
-}
-
-pkg_postinst() {
-	[[ -f "${T}"/dnsmasq.leases ]] && \
-		cp "${T}"/dnsmasq.leases /var/lib/misc/dnsmasq.leases
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.87.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.87.ebuild
deleted file mode 100644
index 489169bb4a..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.87.ebuild
+++ /dev/null
@@ -1,224 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-
-inherit toolchain-funcs lua-single systemd
-
-DESCRIPTION="Small forwarding DNS server"
-HOMEPAGE="https://thekelleys.org.uk/dnsmasq/doc.html"
-SRC_URI="https://thekelleys.org.uk/dnsmasq/${P}.tar.xz"
-
-LICENSE="|| ( GPL-2 GPL-3 )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-
-IUSE="auth-dns conntrack dbus +dhcp dhcp-tools dnssec +dumpfile id idn libidn2"
-IUSE+=" +loop +inotify ipv6 lua nettlehash nls script selinux static tftp"
-
-DM_LINGUAS=(de es fi fr id it no pl pt_BR ro)
-
-BDEPEND="
-	app-arch/xz-utils
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-"
-
-COMMON_DEPEND="
-	acct-group/dnsmasq
-	acct-user/dnsmasq
-	dbus? ( sys-apps/dbus:= )
-	idn? (
-		!libidn2? ( net-dns/libidn:0= )
-		libidn2? ( >=net-dns/libidn2-2.0:= )
-	)
-	lua? ( ${LUA_DEPS} )
-	conntrack? ( net-libs/libnetfilter_conntrack:= )
-	nls? ( sys-devel/gettext )
-"
-
-DEPEND="${COMMON_DEPEND}
-	dnssec? (
-		dev-libs/nettle:=[gmp]
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-	nettlehash? (
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-"
-
-RDEPEND="${COMMON_DEPEND}
-	dnssec? (
-		!static? ( >=dev-libs/nettle-3.4:=[gmp] )
-	)
-	nettlehash? (
-		!static? ( dev-libs/nettle:=[gmp] )
-	)
-	selinux? ( sec-policy/selinux-dnsmasq )
-"
-
-REQUIRED_USE="
-	dhcp-tools? ( dhcp )
-	dnssec? ( !nettlehash )
-	lua? (
-		script
-		${LUA_REQUIRED_USE}
-	)
-	libidn2? ( idn )
-"
-
-use_have() {
-	local no_only
-	if [[ ${1} == '-n' ]]; then
-		no_only=1
-		shift
-	fi
-	local useflag="${1}"
-	shift
-
-	local uword="${1:-${useflag}}"
-	shift
-
-	while [[ ${uword} ]]; do
-		uword="${uword^^}"
-
-		if ! use "${useflag}"; then
-			printf -- " -DNO_%s" "${uword}"
-		elif [[ -z "${no_only}" ]]; then
-			printf -- " -DHAVE_%s" "${uword}"
-		fi
-		uword="${1}"
-		shift
-	done
-}
-
-pkg_setup() {
-	use lua && lua-single_pkg_setup
-}
-
-pkg_pretend() {
-	if use static; then
-		einfo "Only sys-libs/gmp and dev-libs/nettle are statically linked."
-		use dnssec || einfo "Thus, ${P}[!dnssec,static] makes no sense;" \
-			"in this case the static USE flag does nothing."
-	fi
-}
-
-src_prepare() {
-	default
-
-	sed -i -r 's:lua5.[0-9]+:lua:' Makefile || die
-	sed -i "s:%%PREFIX%%:${EPREFIX}/usr:" \
-		dnsmasq.conf.example || die
-}
-
-src_configure() {
-	COPTS=(
-		$(use_have -n auth-dns auth)
-		$(use_have conntrack)
-		$(use_have dbus)
-		$(use libidn2 || use_have idn)
-		$(use_have libidn2)
-		$(use_have -n inotify)
-		$(use_have -n dhcp dhcp dhcp6)
-		$(use_have -n ipv6 ipv6 dhcp6)
-		$(use_have -n id id)
-		$(use_have -n loop)
-		$(use_have lua luascript)
-		$(use_have -n script)
-		$(use_have -n tftp)
-		$(use_have dnssec)
-		$(use_have nettlehash)
-		$(use_have static dnssec_static)
-		$(use_have -n dumpfile)
-	)
-}
-
-src_compile() {
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		COPTS="${COPTS[*]}" \
-		CONFFILE="/etc/${PN}.conf" \
-		all$(use nls && printf -- "-i18n\n")
-
-	use dhcp-tools && emake -C contrib/lease-tools \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		all
-}
-
-src_install() {
-	local lingua puid
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		COPTS="${COPTS[*]}" \
-		DESTDIR="${ED}" \
-		install$(use nls && printf -- "-i18n\n")
-
-	for lingua in "${DM_LINGUAS[@]}"; do
-		has ${lingua} ${LINGUAS-${lingua}} \
-			|| rm -rf "${ED}"/usr/share/locale/${lingua}
-	done
-	[[ -d "${D}"/usr/share/locale/ ]] && \
-		rmdir --ignore-fail-on-non-empty "${ED}"/usr/share/locale/
-
-	dodoc CHANGELOG CHANGELOG.archive FAQ dnsmasq.conf.example
-	dodoc -r logo
-
-	docinto html/
-	dodoc *.html
-
-	newinitd "${FILESDIR}"/dnsmasq-init-r4 ${PN}
-	newconfd "${FILESDIR}"/dnsmasq.confd-r1 ${PN}
-
-	insinto /etc/logrotate.d
-	newins "${FILESDIR}"/dnsmasq.logrotate ${PN}
-
-	insinto /etc
-	newins dnsmasq.conf.example dnsmasq.conf
-
-	insinto /usr/share/dnsmasq
-	doins trust-anchors.conf
-
-	if use dhcp; then
-		keepdir /var/lib/misc
-		newinitd "${FILESDIR}"/dnsmasq-init-dhcp-r3 ${PN}
-	fi
-	if use dbus; then
-		insinto /etc/dbus-1/system.d
-		doins dbus/dnsmasq.conf
-	fi
-
-	if use dhcp-tools; then
-		dosbin contrib/lease-tools/{dhcp_release,dhcp_lease_time}
-		doman contrib/lease-tools/{dhcp_release,dhcp_lease_time}.1
-		if use ipv6; then
-			dosbin contrib/lease-tools/dhcp_release6
-			doman contrib/lease-tools/dhcp_release6.1
-		fi
-	fi
-
-	systemd_newunit "${FILESDIR}"/${PN}.service-r1 ${PN}.service
-}
-
-pkg_preinst() {
-	[[ -f /var/lib/misc/dnsmasq.leases ]] && \
-		cp /var/lib/misc/dnsmasq.leases "${T}"
-}
-
-pkg_postinst() {
-	[[ -f "${T}"/dnsmasq.leases ]] && \
-		cp "${T}"/dnsmasq.leases /var/lib/misc/dnsmasq.leases
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.88.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.88.ebuild
deleted file mode 100644
index a6125c0fe6..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-dns/dnsmasq/dnsmasq-2.88.ebuild
+++ /dev/null
@@ -1,224 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-
-inherit toolchain-funcs lua-single systemd
-
-DESCRIPTION="Small forwarding DNS server"
-HOMEPAGE="https://thekelleys.org.uk/dnsmasq/doc.html"
-SRC_URI="https://thekelleys.org.uk/dnsmasq/${P}.tar.xz"
-
-LICENSE="|| ( GPL-2 GPL-3 )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-
-IUSE="auth-dns conntrack dbus +dhcp dhcp-tools dnssec +dumpfile id idn libidn2"
-IUSE+=" +loop +inotify ipv6 lua nettlehash nls script selinux static tftp"
-
-DM_LINGUAS=(de es fi fr id it no pl pt_BR ro)
-
-BDEPEND="
-	app-arch/xz-utils
-	virtual/pkgconfig
-	nls? ( sys-devel/gettext )
-"
-
-COMMON_DEPEND="
-	acct-group/dnsmasq
-	acct-user/dnsmasq
-	dbus? ( sys-apps/dbus:= )
-	idn? (
-		!libidn2? ( net-dns/libidn:0= )
-		libidn2? ( >=net-dns/libidn2-2.0:= )
-	)
-	lua? ( ${LUA_DEPS} )
-	conntrack? ( net-libs/libnetfilter_conntrack:= )
-	nls? ( sys-devel/gettext )
-"
-
-DEPEND="${COMMON_DEPEND}
-	dnssec? (
-		dev-libs/nettle:=[gmp]
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-	nettlehash? (
-		static? ( >=dev-libs/nettle-3.4[static-libs(+)] )
-	)
-"
-
-RDEPEND="${COMMON_DEPEND}
-	dnssec? (
-		!static? ( >=dev-libs/nettle-3.4:=[gmp] )
-	)
-	nettlehash? (
-		!static? ( dev-libs/nettle:=[gmp] )
-	)
-	selinux? ( sec-policy/selinux-dnsmasq )
-"
-
-REQUIRED_USE="
-	dhcp-tools? ( dhcp )
-	dnssec? ( !nettlehash )
-	lua? (
-		script
-		${LUA_REQUIRED_USE}
-	)
-	libidn2? ( idn )
-"
-
-use_have() {
-	local no_only
-	if [[ ${1} == '-n' ]]; then
-		no_only=1
-		shift
-	fi
-	local useflag="${1}"
-	shift
-
-	local uword="${1:-${useflag}}"
-	shift
-
-	while [[ ${uword} ]]; do
-		uword="${uword^^}"
-
-		if ! use "${useflag}"; then
-			printf -- " -DNO_%s" "${uword}"
-		elif [[ -z "${no_only}" ]]; then
-			printf -- " -DHAVE_%s" "${uword}"
-		fi
-		uword="${1}"
-		shift
-	done
-}
-
-pkg_setup() {
-	use lua && lua-single_pkg_setup
-}
-
-pkg_pretend() {
-	if use static; then
-		einfo "Only sys-libs/gmp and dev-libs/nettle are statically linked."
-		use dnssec || einfo "Thus, ${P}[!dnssec,static] makes no sense;" \
-			"in this case the static USE flag does nothing."
-	fi
-}
-
-src_prepare() {
-	default
-
-	sed -i -r 's:lua5.[0-9]+:lua:' Makefile || die
-	sed -i "s:%%PREFIX%%:${EPREFIX}/usr:" \
-		dnsmasq.conf.example || die
-}
-
-src_configure() {
-	COPTS=(
-		$(use_have -n auth-dns auth)
-		$(use_have conntrack)
-		$(use_have dbus)
-		$(use libidn2 || use_have idn)
-		$(use_have libidn2)
-		$(use_have -n inotify)
-		$(use_have -n dhcp dhcp dhcp6)
-		$(use_have -n ipv6 ipv6 dhcp6)
-		$(use_have -n id id)
-		$(use_have -n loop)
-		$(use_have lua luascript)
-		$(use_have -n script)
-		$(use_have -n tftp)
-		$(use_have dnssec)
-		$(use_have nettlehash)
-		$(use_have static dnssec_static)
-		$(use_have -n dumpfile)
-	)
-}
-
-src_compile() {
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		COPTS="${COPTS[*]}" \
-		CONFFILE="/etc/${PN}.conf" \
-		all$(use nls && printf -- "-i18n\n")
-
-	use dhcp-tools && emake -C contrib/lease-tools \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		CC="$(tc-getCC)" \
-		PKG_CONFIG="$(tc-getPKG_CONFIG)" \
-		CFLAGS="${CFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		all
-}
-
-src_install() {
-	local lingua puid
-	emake \
-		PREFIX=/usr \
-		MANDIR=/usr/share/man \
-		COPTS="${COPTS[*]}" \
-		DESTDIR="${ED}" \
-		install$(use nls && printf -- "-i18n\n")
-
-	for lingua in "${DM_LINGUAS[@]}"; do
-		has ${lingua} ${LINGUAS-${lingua}} \
-			|| rm -rf "${ED}"/usr/share/locale/${lingua}
-	done
-	[[ -d "${D}"/usr/share/locale/ ]] && \
-		rmdir --ignore-fail-on-non-empty "${ED}"/usr/share/locale/
-
-	dodoc CHANGELOG CHANGELOG.archive FAQ dnsmasq.conf.example
-	dodoc -r logo
-
-	docinto html/
-	dodoc *.html
-
-	newinitd "${FILESDIR}"/dnsmasq-init-r4 ${PN}
-	newconfd "${FILESDIR}"/dnsmasq.confd-r1 ${PN}
-
-	insinto /etc/logrotate.d
-	newins "${FILESDIR}"/dnsmasq.logrotate ${PN}
-
-	insinto /etc
-	newins dnsmasq.conf.example dnsmasq.conf
-
-	insinto /usr/share/dnsmasq
-	doins trust-anchors.conf
-
-	if use dhcp; then
-		keepdir /var/lib/misc
-		newinitd "${FILESDIR}"/dnsmasq-init-dhcp-r3 ${PN}
-	fi
-	if use dbus; then
-		insinto /etc/dbus-1/system.d
-		doins dbus/dnsmasq.conf
-	fi
-
-	if use dhcp-tools; then
-		dosbin contrib/lease-tools/{dhcp_release,dhcp_lease_time}
-		doman contrib/lease-tools/{dhcp_release,dhcp_lease_time}.1
-		if use ipv6; then
-			dosbin contrib/lease-tools/dhcp_release6
-			doman contrib/lease-tools/dhcp_release6.1
-		fi
-	fi
-
-	systemd_newunit "${FILESDIR}"/${PN}.service-r1 ${PN}.service
-}
-
-pkg_preinst() {
-	[[ -f /var/lib/misc/dnsmasq.leases ]] && \
-		cp /var/lib/misc/dnsmasq.leases "${T}"
-}
-
-pkg_postinst() {
-	[[ -f "${T}"/dnsmasq.leases ]] && \
-		cp "${T}"/dnsmasq.leases /var/lib/misc/dnsmasq.leases
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15.ebuild
deleted file mode 100644
index bf70cf7a96..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15.ebuild
+++ /dev/null
@@ -1,138 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit autotools bash-completion-r1 linux-info pam python-single-r1
-
-DESCRIPTION="Tools for Managing Linux CIFS Client Filesystems"
-HOMEPAGE="https://wiki.samba.org/index.php/LinuxCIFS_utils"
-SRC_URI="https://ftp.samba.org/pub/linux-cifs/${PN}/${P}.tar.bz2"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
-IUSE="+acl +ads +caps creds pam +python systemd"
-
-RDEPEND="
-	sys-apps/keyutils:=
-	ads? (
-		sys-libs/talloc
-		virtual/krb5
-	)
-	caps? ( sys-libs/libcap-ng )
-	pam? ( sys-libs/pam )
-	python? ( ${PYTHON_DEPS} )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="dev-python/docutils"
-PDEPEND="
-	acl? ( >=net-fs/samba-4.0.0_alpha1 )
-"
-
-REQUIRED_USE="
-	acl? ( ads )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DOCS="doc/linux-cifs-client-guide.odt"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-6.12-ln_in_destdir.patch" #766594
-	"${FILESDIR}/${PN}-6.15-musl.patch"
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-
-	if ! linux_config_exists || ! linux_chkconfig_present CIFS; then
-		ewarn "You must enable CIFS support in your kernel config, "
-		ewarn "to be able to mount samba shares. You can find it at"
-		ewarn
-		ewarn "  File systems"
-		ewarn "	Network File Systems"
-		ewarn "			CIFS support"
-		ewarn
-		ewarn "and recompile your kernel ..."
-	fi
-
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	if has_version app-crypt/heimdal ; then
-		# https://bugs.gentoo.org/612584
-		eapply "${FILESDIR}/${PN}-6.7-heimdal.patch"
-	fi
-
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		--enable-man
-		--enable-smbinfo
-		$(use_enable acl cifsacl cifsidmap)
-		$(use_enable ads cifsupcall)
-		$(use_with caps libcap)
-		$(use_enable creds cifscreds)
-		$(use_enable pam)
-		$(use_with pam pamdir $(getpam_mod_dir))
-		$(use_enable python pythontools)
-		# mount.cifs can get passwords from systemd
-		$(use_enable systemd)
-	)
-	ROOTSBINDIR="${EPREFIX}"/sbin \
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	# remove empty directories
-	find "${ED}" -type d -empty -delete || die
-
-	if use acl ; then
-		dodir /etc/cifs-utils
-		dosym ../../usr/$(get_libdir)/cifs-utils/idmapwb.so \
-			/etc/cifs-utils/idmap-plugin
-		dodir /etc/request-key.d
-		echo 'create cifs.idmap * * /usr/sbin/cifs.idmap %k' \
-			> "${ED}/etc/request-key.d/cifs.idmap.conf"
-	fi
-
-	if use ads ; then
-		dodir /etc/request-key.d
-		echo 'create dns_resolver * * /usr/sbin/cifs.upcall %k' \
-			> "${ED}/etc/request-key.d/cifs.upcall.conf"
-		echo 'create cifs.spnego * * /usr/sbin/cifs.upcall %k' \
-			> "${ED}/etc/request-key.d/cifs.spnego.conf"
-	fi
-
-	dobashcomp bash-completion/smbinfo
-	use python && python_fix_shebang "${ED}"
-}
-
-pkg_postinst() {
-	# Inform about set-user-ID bit of mount.cifs
-	ewarn "setuid use flag was dropped due to multiple security implications"
-	ewarn "such as CVE-2009-2948, CVE-2011-3585 and CVE-2012-1586"
-	ewarn "You are free to set setuid flags by yourself"
-
-	# Inform about upcall usage
-	if use acl ; then
-		einfo "The cifs.idmap utility has been enabled by creating the"
-		einfo "configuration file /etc/request-key.d/cifs.idmap.conf"
-		einfo "This enables you to get and set CIFS acls."
-	fi
-
-	if use ads ; then
-		einfo "The cifs.upcall utility has been enabled by creating the"
-		einfo "configuration file /etc/request-key.d/cifs.upcall.conf"
-		einfo "This enables you to mount DFS shares."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.6.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.6.ebuild
index 6e50e19d7f..e63cbcf832 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.6.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )
 LICENSE="GPL-3 LGPL-2.1+"
 SLOT="0/30.30" # <libgnutls.so number>.<libgnutlsxx.so number>
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
+IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 
 REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
@@ -40,7 +40,6 @@ BDEPEND="
 	>=virtual/pkgconfig-0-r1
 	doc? ( dev-util/gtk-doc )
 	nls? ( sys-devel/gettext )
-	valgrind? ( dev-util/valgrind )
 	test-full? (
 		app-crypt/dieharder
 		>=app-misc/datefudge-1.22
@@ -101,6 +100,7 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(multilib_native_enable manpages)
 		$(multilib_native_use_enable doc gtk-doc)
 		$(multilib_native_use_enable doc)
@@ -109,7 +109,6 @@ multilib_src_configure() {
 		$(multilib_native_use_enable test tests)
 		$(multilib_native_use_enable test-full full-test-suite)
 		$(multilib_native_use_enable tools)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 		$(use_enable cxx)
 		$(use_enable dane libdane)
 		$(use_enable nls)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.7.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.7.ebuild
index 2882922ce9..a1bc18f35d 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.7.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )
 LICENSE="GPL-3 LGPL-2.1+"
 SLOT="0/30.30" # <libgnutls.so number>.<libgnutlsxx.so number>
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
+IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 
 REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
@@ -40,7 +40,6 @@ BDEPEND="
 	>=virtual/pkgconfig-0-r1
 	doc? ( dev-util/gtk-doc )
 	nls? ( sys-devel/gettext )
-	valgrind? ( dev-util/valgrind )
 	test-full? (
 		app-crypt/dieharder
 		>=app-misc/datefudge-1.22
@@ -101,6 +100,7 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(multilib_native_enable manpages)
 		$(multilib_native_use_enable doc gtk-doc)
 		$(multilib_native_use_enable doc)
@@ -109,7 +109,6 @@ multilib_src_configure() {
 		$(multilib_native_use_enable test tests)
 		$(multilib_native_use_enable test-full full-test-suite)
 		$(multilib_native_use_enable tools)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 		$(use_enable cxx)
 		$(use_enable dane libdane)
 		$(use_enable nls)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.8.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.8.ebuild
index e61c65b13e..dc7d2f811a 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.8.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )
 LICENSE="GPL-3 LGPL-2.1+"
 SLOT="0/30.30" # <libgnutls.so number>.<libgnutlsxx.so number>
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
+IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 
 REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
@@ -40,7 +40,6 @@ BDEPEND="
 	>=virtual/pkgconfig-0-r1
 	doc? ( dev-util/gtk-doc )
 	nls? ( sys-devel/gettext )
-	valgrind? ( dev-util/valgrind )
 	test-full? (
 		app-crypt/dieharder
 		>=app-misc/datefudge-1.22
@@ -101,6 +100,7 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(multilib_native_enable manpages)
 		$(multilib_native_use_enable doc gtk-doc)
 		$(multilib_native_use_enable doc)
@@ -109,7 +109,6 @@ multilib_src_configure() {
 		$(multilib_native_use_enable test tests)
 		$(multilib_native_use_enable test-full full-test-suite)
 		$(multilib_native_use_enable tools)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 		$(use_enable cxx)
 		$(use_enable dane libdane)
 		$(use_enable nls)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.9.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.9.ebuild
index 6c27a339a5..09c958dd5c 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.7.9.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )
 LICENSE="GPL-3 LGPL-2.1+"
 SLOT="0/30.30" # <libgnutls.so number>.<libgnutlsxx.so number>
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
+IUSE="brotli +cxx dane doc examples guile +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 
 REQUIRED_USE="test-full? ( cxx dane doc examples guile idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
@@ -40,7 +40,6 @@ BDEPEND="
 	>=virtual/pkgconfig-0-r1
 	doc? ( dev-util/gtk-doc )
 	nls? ( sys-devel/gettext )
-	valgrind? ( dev-util/valgrind )
 	test-full? (
 		app-crypt/dieharder
 		>=app-misc/datefudge-1.22
@@ -101,6 +100,7 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(multilib_native_enable manpages)
 		$(multilib_native_use_enable doc gtk-doc)
 		$(multilib_native_use_enable doc)
@@ -109,7 +109,6 @@ multilib_src_configure() {
 		$(multilib_native_use_enable test tests)
 		$(multilib_native_use_enable test-full full-test-suite)
 		$(multilib_native_use_enable tools)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 		$(use_enable cxx)
 		$(use_enable dane libdane)
 		$(use_enable nls)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
index 0e7c403183..d2e4444243 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.0.ebuild
@@ -18,7 +18,7 @@ LICENSE="GPL-3 LGPL-2.1+"
 # <libgnutls.so number>.<libgnutlsxx.so number>
 SLOT="0/30.30"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools valgrind zlib zstd"
+IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
 REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
 RESTRICT="!test? ( test )"
 
@@ -42,7 +42,6 @@ BDEPEND="
 	>=virtual/pkgconfig-0-r1
 	doc? ( dev-util/gtk-doc )
 	nls? ( sys-devel/gettext )
-	valgrind? ( dev-util/valgrind )
 	test-full? (
 		app-crypt/dieharder
 		>=app-misc/datefudge-1.22
@@ -99,6 +98,7 @@ multilib_src_configure() {
 	export gl_cv_warn_c__fanalyzer=no
 
 	local myeconfargs=(
+		--disable-valgrind-tests
 		$(multilib_native_enable manpages)
 		$(multilib_native_use_enable doc gtk-doc)
 		$(multilib_native_use_enable doc)
@@ -106,7 +106,6 @@ multilib_src_configure() {
 		$(multilib_native_use_enable test tests)
 		$(multilib_native_use_enable test-full full-test-suite)
 		$(multilib_native_use_enable tools)
-		$(multilib_native_use_enable valgrind valgrind-tests)
 		$(use_enable cxx)
 		$(use_enable dane libdane)
 		$(use_enable nls)
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml
index 8a72ba7694..439912b2c4 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/metadata.xml
@@ -33,9 +33,6 @@
 		<flag name="test-full">
 			Enable full test mode
 		</flag>
-		<flag name="valgrind">
-			Enable usage of <pkg>dev-util/valgrind</pkg> in debug
-		</flag>
 	</use>
 	<slots>
 		<subslots>Reflect ABI compatibility of libgnutls.so</subslots>
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libslirp/libslirp-4.7.0.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libslirp/libslirp-4.7.0.ebuild
index 7f4caff457..0810b697f5 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libslirp/libslirp-4.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libslirp/libslirp-4.7.0.ebuild
@@ -1,11 +1,11 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
 
 inherit meson
 
-KEYWORDS="~amd64 ~arm64 ~loong ~m68k ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 arm64 ~loong ~m68k ~ppc ppc64 ~riscv x86"
 MY_P="${PN}-v${PV}"
 SRC_URI="https://gitlab.freedesktop.org/slirp/libslirp/-/archive/v${PV}/${MY_P}.tar.gz -> ${P}.tar.gz"
 DESCRIPTION="A TCP-IP emulator used to provide virtual networking services"
@@ -13,11 +13,14 @@ HOMEPAGE="https://gitlab.freedesktop.org/slirp/libslirp"
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="static-libs"
+IUSE="static-libs valgrind"
 
 RDEPEND="dev-libs/glib:="
-
-DEPEND="${RDEPEND}"
+# Valgrind usage is automagic but it's not so bad given it's a header-only dep.
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-util/valgrind )
+"
 
 S=${WORKDIR}/${MY_P}
 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index 7b6217a5f3..23d9927115 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -1,6 +1,4 @@
-DIST curl-7.87.0.tar.xz 2547932 BLAKE2B b272ec928c5ef1728434630d8910f58834327a30570913df9d47921a2810d002bd88b81371005197db857d3a53386420c1e28b1e463e6241d46c1e50fbce0c13 SHA512 aa125991592667280dce3788aabe81487cf8c55b0afc59d675cc30b76055bb7114f5380b4a0e3b6461a8f81bf9812fa26d493a85f7e01d84263d484a0d699ee7
-DIST curl-7.87.0.tar.xz.asc 488 BLAKE2B 031d8236b357bd3c519548b181254dc0aea1efc1375738bce04f4f331d35bafe99d1ca394ecf5943ede7cae040854b6d2b478fd305147eb7330f8d50e5d95c96 SHA512 0bcc12bafc4ae50d80128af2cf4bf1a1ec6018ebb8d5b9c49f52b51c0c25acc77e820858965656549ef43c1f923f4e5fe75b0a3523623154b4cfb9dc8a1d76e4
-DIST curl-7.88.1.tar.xz 2581032 BLAKE2B ed7e7aa29efb02fd89a53d5c8d0ec79b4d17612ea07d2a6b5a951f0ca651b4cf7264704344b1a0c2d82196f4cb5c08525e06b4cdd432bc3278ff23c7a6580839 SHA512 b8d30c52a6d1c3e272608a7a8db78dfd79aef21330f34d6f1df43839a400e13ac6aac72a383526db0b711a70ecbec89a3b934677d7ecf5094fd64d3dbcb3492f
-DIST curl-7.88.1.tar.xz.asc 488 BLAKE2B ea90d840846fca3f0b17838a84431cb44d6e3f8d2b42c3eced1fb1c929a58e8899b303c93d27ca3cafcaa52e7269ac440e7102191d6b2c2751729a6c4116e82f SHA512 d6dc720533004c4d533cc4fb3dd33ac28d95e114f440ec011e4b58f65d1f4c40cfa10ba26d2e2f2f1f9de99511632578b4758c5e79593c7c30d29788fdf1cbb6
 DIST curl-8.0.1.tar.xz 2575544 BLAKE2B 67d82e9d71f0a351b5c2ed3ad5eab02e367ded872658a295179b935729d5105015f8c29569c396e11cd14036656af894ded85c8838cba260d9f6f1a8dcb5e22b SHA512 3bb777982659ed697ae90f113ff7b65d6ce8ba9fe6a8984cfd6769d2f051a72ba953c911abe234c204ec2cc5a35d68b4d033037fad7fba31bb92a52543f8d13d
 DIST curl-8.0.1.tar.xz.asc 488 BLAKE2B 452e1bebe1028e7621bbf8829e50cf56e254cd63a8cf2a4c0332176b9f18fb2821304ae556a203996d273c986bddbd04db2218c18fd34dee66e9155861ba50ce SHA512 92c6a0570e9a8a708fe2f717b8b37a68dcb9cd4520ca50c9baafec5891bda103bce2d2dcb67f1387bf11bd7e51e0e64ccd52d196e61d58b598ad3aa1960386cf
+DIST curl-8.1.0.tar.xz 2612568 BLAKE2B 768a824b8f5f6ddaa073599c4106f07a8134bcbe0e0d666390be1bce16ba25386d85930853bb47bc90b2c8a499a0b2abb9c685042563801e0fe58b9c315ac6cc SHA512 b99926f372ddd715cd1d2b54d8fb96b26b085e6501715e25aa57b6c6a7f8452473506ddb284e2f280f8afdb301b7f0c3bfde7ad7ed393b12c022430a9301096d
+DIST curl-8.1.0.tar.xz.asc 488 BLAKE2B c1a8e50eddc7dd140af2af29736eb486e96a6d3b67a9161244daa86558f65522527380c92597a5f10e5dad187f0bda6ac5b9cadc29386bef4492bc047c77b423 SHA512 191a74c7a6b6aa78b7f36e1535fda0701bde8b333a61c90343e1f1b2d65cc5097b5febc5fa42b2f373795ef1b34078790deaaa71c8aaa45eed1c753729a45f3d
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.87.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.87.0-r2.ebuild
deleted file mode 100644
index fcf16d41ed..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.87.0-r2.ebuild
+++ /dev/null
@@ -1,302 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-inherit autotools prefix multilib-minimal verify-sig
-
-DESCRIPTION="A Client that groks URLs"
-HOMEPAGE="https://curl.se/"
-SRC_URI="https://curl.se/download/${P}.tar.xz
-	verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )"
-
-LICENSE="curl"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap ipv6 kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
-IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
-IUSE+=" nghttp3 quiche"
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
-
-# Only one default ssl provider can be enabled
-REQUIRED_USE="
-	ssl? (
-		^^ (
-			curl_ssl_gnutls
-			curl_ssl_mbedtls
-			curl_ssl_nss
-			curl_ssl_openssl
-			curl_ssl_rustls
-		)
-	)"
-
-# lead to lots of false negatives, bug #285669
-RESTRICT="!test? ( test )"
-
-RDEPEND="ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
-	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
-	ssl? (
-		gnutls? (
-			net-libs/gnutls:=[static-libs?,${MULTILIB_USEDEP}]
-			dev-libs/nettle:=[${MULTILIB_USEDEP}]
-			app-misc/ca-certificates
-		)
-		mbedtls? (
-			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
-			app-misc/ca-certificates
-		)
-		openssl? (
-			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
-		)
-		nss? (
-			dev-libs/nss:0[${MULTILIB_USEDEP}]
-			dev-libs/nss-pem
-			app-misc/ca-certificates
-		)
-		rustls? (
-			net-libs/rustls-ffi:=[${MULTILIB_USEDEP}]
-		)
-	)
-	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
-	nghttp3? (
-		net-libs/nghttp3[${MULTILIB_USEDEP}]
-		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
-	)
-	quiche? ( >=net-libs/quiche-0.3.0[${MULTILIB_USEDEP}] )
-	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
-	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
-	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
-	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
-	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
-	sys-libs/zlib[${MULTILIB_USEDEP}]
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
-
-# Do we need to enforce the same ssl backend for curl and rtmpdump? Bug #423303
-#	rtmp? (
-#		media-video/rtmpdump
-#		curl_ssl_gnutls? ( media-video/rtmpdump[gnutls] )
-#		curl_ssl_openssl? ( media-video/rtmpdump[-gnutls,ssl] )
-#	)
-
-DEPEND="${RDEPEND}"
-BDEPEND="dev-lang/perl
-	virtual/pkgconfig
-	test? (
-		sys-apps/diffutils
-	)
-	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )"
-
-DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/curl/curlbuild.h
-)
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/curl-config
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-7.30.0-prefix.patch
-	"${FILESDIR}"/${PN}-respect-cflags-3.patch
-
-	"${FILESDIR}"/${P}-gnutls-openssl-build.patch
-	"${FILESDIR}"/${P}-typecheck-deprecated.patch
-)
-
-src_prepare() {
-	default
-
-	eprefixify curl-config.in
-	eautoreconf
-}
-
-multilib_src_configure() {
-	# We make use of the fact that later flags override earlier ones
-	# So start with all ssl providers off until proven otherwise
-	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
-	local myconf=()
-
-	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
-	#myconf+=( --without-default-ssl-backend )
-	if use ssl ; then
-		myconf+=( --without-gnutls --without-mbedtls --without-nss --without-rustls )
-
-		if use gnutls || use curl_ssl_gnutls; then
-			einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls || use curl_ssl_mbedtls; then
-			einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use nss || use curl_ssl_nss; then
-			einfo "SSL provided by nss"
-			myconf+=( --with-nss --with-nss-deprecated )
-		fi
-		if use openssl || use curl_ssl_openssl; then
-			einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls || use curl_ssl_rustls; then
-			einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-
-		if use curl_ssl_gnutls; then
-			einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_nss; then
-			einfo "Default SSL provided by nss"
-			myconf+=( --with-default-ssl-backend=nss )
-		elif use curl_ssl_openssl; then
-			einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-		fi
-
-	else
-		myconf+=( --without-ssl )
-		einfo "SSL disabled"
-	fi
-
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
-
-	myconf+=(
-		$(use_enable alt-svc)
-		--enable-crypto-auth
-		--enable-dict
-		--disable-ech
-		--enable-file
-		$(use_enable ftp)
-		$(use_enable gopher)
-		$(use_enable hsts)
-		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
-		$(use_enable ldap ldaps)
-		--enable-ntlm
-		--disable-ntlm-wb
-		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
-		$(use_enable samba smb)
-		$(use_with ssh libssh2)
-		$(use_enable smtp)
-		$(use_enable telnet)
-		$(use_enable tftp)
-		--enable-tls-srp
-		$(use_enable adns ares)
-		--enable-cookies
-		--enable-dateparse
-		--enable-dnsshuffle
-		--enable-doh
-		--enable-symbol-hiding
-		--enable-http-auth
-		$(use_enable ipv6)
-		--enable-largefile
-		--enable-manual
-		--enable-mime
-		--enable-netrc
-		$(use_enable progress-meter)
-		--enable-proxy
-		--disable-sspi
-		$(use_enable static-libs static)
-		--enable-pthreads
-		--enable-threaded-resolver
-		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
-		$(use_with brotli)
-		--without-fish-functions-dir
-		$(use_with http2 nghttp2)
-		--without-hyper
-		$(use_with idn libidn2)
-		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
-		--without-libpsl
-		--without-msh3
-		$(use_with nghttp3)
-		$(use_with nghttp3 ngtcp2)
-		$(use_with quiche)
-		$(use_with rtmp librtmp)
-		--without-schannel
-		--without-secure-transport
-		$(use_enable websockets)
-		--without-winidn
-		--without-wolfssl
-		--with-zlib
-		$(use_with zstd)
-	)
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	if ! multilib_is_native_abi; then
-		# avoid building the client
-		sed -i -e '/SUBDIRS/s:src::' Makefile || die
-		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
-	fi
-
-	# Fix up the pkg-config file to be more robust.
-	# https://github.com/curl/curl/issues/864
-	local priv=() libs=()
-	# We always enable zlib.
-	libs+=( "-lz" )
-	priv+=( "zlib" )
-	if use http2; then
-		libs+=( "-lnghttp2" )
-		priv+=( "libnghttp2" )
-	fi
-	if use quiche; then
-		libs+=( "-lquiche" )
-		priv+=( "quiche" )
-	fi
-	if use nghttp3; then
-		libs+=( "-lnghttp3" "-lngtcp2" )
-		priv+=( "libnghttp3" "libngtcp2" )
-	fi
-	if use ssl && use curl_ssl_openssl; then
-		libs+=( "-lssl" "-lcrypto" )
-		priv+=( "openssl" )
-	fi
-	grep -q Requires.private libcurl.pc && die "need to update ebuild"
-	libs=$(printf '|%s' "${libs[@]}")
-	sed -i -r \
-		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
-		libcurl.pc || die
-	echo "Requires.private: ${priv[*]}" >> libcurl.pc || die
-}
-
-multilib_src_test() {
-	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
-	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
-	# -v: verbose
-	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
-	# -k: keep test files after completion
-	# -am: automake style TAP output
-	# -p: print logs if test fails
-	# Note: if needed, we can disable tests. See e.g. Fedora's packaging
-	# or just read https://github.com/curl/curl/tree/master/tests#run.
-	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p"
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-	rm -rf "${ED}"/etc/ || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r2.ebuild
deleted file mode 100644
index 98f09d3e9b..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r2.ebuild
+++ /dev/null
@@ -1,307 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="8"
-
-inherit autotools multilib-minimal prefix verify-sig
-
-DESCRIPTION="A Client that groks URLs"
-HOMEPAGE="https://curl.se/"
-SRC_URI="https://curl.se/download/${P}.tar.xz
-	verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )"
-
-LICENSE="curl"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
-IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
-IUSE+=" nghttp3"
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
-
-#Only one default ssl provider can be enabled
-REQUIRED_USE="
-	ssl? (
-		^^ (
-			curl_ssl_gnutls
-			curl_ssl_mbedtls
-			curl_ssl_nss
-			curl_ssl_openssl
-			curl_ssl_rustls
-		)
-	)"
-
-# lead to lots of false negatives, bug #285669
-RESTRICT="!test? ( test )"
-
-RDEPEND="ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
-	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
-	ssl? (
-		gnutls? (
-			net-libs/gnutls:=[static-libs?,${MULTILIB_USEDEP}]
-			dev-libs/nettle:=[${MULTILIB_USEDEP}]
-			app-misc/ca-certificates
-		)
-		mbedtls? (
-			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
-			app-misc/ca-certificates
-		)
-		openssl? (
-			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
-		)
-		nss? (
-			dev-libs/nss:0[${MULTILIB_USEDEP}]
-			dev-libs/nss-pem
-			app-misc/ca-certificates
-		)
-		rustls? (
-			net-libs/rustls-ffi:=[${MULTILIB_USEDEP}]
-		)
-	)
-	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
-	nghttp3? (
-		net-libs/nghttp3[${MULTILIB_USEDEP}]
-		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
-	)
-	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
-	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
-	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
-	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
-	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
-	sys-libs/zlib[${MULTILIB_USEDEP}]
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
-
-DEPEND="${RDEPEND}"
-BDEPEND="dev-lang/perl
-	virtual/pkgconfig
-	test? (
-		sys-apps/diffutils
-		http2? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
-		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
-	)
-	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )"
-
-DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/curl/curlbuild.h
-)
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/curl-config
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-7.30.0-prefix.patch
-	"${FILESDIR}"/${PN}-respect-cflags-3.patch
-
-	"${FILESDIR}"/${P}-header-dump-segfault.patch
-	"${FILESDIR}"/${P}-onion-resolution.patch
-	"${FILESDIR}"/${P}-pipewait.patch
-	"${FILESDIR}"/${P}-silent-parallel.patch
-)
-
-src_prepare() {
-	default
-
-	# Some tests (HTTP/#) rely on ssl certificates that are stored VCS which breaks
-	# with out-of-tree builds.
-	sed -i "s:my \$path   = getcwd():my \$path   = \"${S}/tests\":" tests/http*-server.pl \
-		|| die "Unable to update test locations"
-	eprefixify curl-config.in
-	eautoreconf
-}
-
-multilib_src_configure() {
-	# We make use of the fact that later flags override earlier ones
-	# So start with all ssl providers off until proven otherwise
-	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
-	local myconf=()
-
-	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
-	#myconf+=( --without-default-ssl-backend )
-	if use ssl ; then
-		myconf+=( --without-gnutls --without-mbedtls --without-nss --without-rustls )
-
-		if use gnutls || use curl_ssl_gnutls; then
-			einfo "SSL provided by gnutls"
-			myconf+=( --with-gnutls )
-		fi
-		if use mbedtls || use curl_ssl_mbedtls; then
-			einfo "SSL provided by mbedtls"
-			myconf+=( --with-mbedtls )
-		fi
-		if use nss || use curl_ssl_nss; then
-			einfo "SSL provided by nss"
-			myconf+=( --with-nss --with-nss-deprecated )
-		fi
-		if use openssl || use curl_ssl_openssl; then
-			einfo "SSL provided by openssl"
-			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
-		fi
-		if use rustls || use curl_ssl_rustls; then
-			einfo "SSL provided by rustls"
-			myconf+=( --with-rustls )
-		fi
-		if use curl_ssl_gnutls; then
-			einfo "Default SSL provided by gnutls"
-			myconf+=( --with-default-ssl-backend=gnutls )
-		elif use curl_ssl_mbedtls; then
-			einfo "Default SSL provided by mbedtls"
-			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_nss; then
-			einfo "Default SSL provided by nss"
-			myconf+=( --with-default-ssl-backend=nss )
-		elif use curl_ssl_openssl; then
-			einfo "Default SSL provided by openssl"
-			myconf+=( --with-default-ssl-backend=openssl )
-		elif use curl_ssl_rustls; then
-			einfo "Default SSL provided by rustls"
-			myconf+=( --with-default-ssl-backend=rustls )
-		else
-			eerror "We can't be here because of REQUIRED_USE."
-		fi
-
-	else
-		myconf+=( --without-ssl )
-		einfo "SSL disabled"
-	fi
-
-	# These configuration options are organized alphabetically
-	# within each category.  This should make it easier if we
-	# ever decide to make any of them contingent on USE flags:
-	# 1) protocols first.  To see them all do
-	# 'grep SUPPORT_PROTOCOLS configure.ac'
-	# 2) --enable/disable options second.
-	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
-	# 3) --with/without options third.
-	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
-
-	myconf+=(
-		$(use_enable alt-svc)
-		--enable-crypto-auth
-		--enable-dict
-		--disable-ech
-		--enable-file
-		$(use_enable ftp)
-		$(use_enable gopher)
-		$(use_enable hsts)
-		--enable-http
-		$(use_enable imap)
-		$(use_enable ldap)
-		$(use_enable ldap ldaps)
-		--enable-ntlm
-		--disable-ntlm-wb
-		$(use_enable pop3)
-		--enable-rt
-		--enable-rtsp
-		$(use_enable samba smb)
-		$(use_with ssh libssh2)
-		$(use_enable smtp)
-		$(use_enable telnet)
-		$(use_enable tftp)
-		--enable-tls-srp
-		$(use_enable adns ares)
-		--enable-cookies
-		--enable-dateparse
-		--enable-dnsshuffle
-		--enable-doh
-		--enable-symbol-hiding
-		--enable-http-auth
-		--enable-ipv6
-		--enable-largefile
-		--enable-manual
-		--enable-mime
-		--enable-netrc
-		$(use_enable progress-meter)
-		--enable-proxy
-		--enable-socketpair
-		--disable-sspi
-		$(use_enable static-libs static)
-		--enable-pthreads
-		--enable-threaded-resolver
-		--disable-versioned-symbols
-		--without-amissl
-		--without-bearssl
-		$(use_with brotli)
-		--without-fish-functions-dir
-		$(use_with http2 nghttp2)
-		--without-hyper
-		$(use_with idn libidn2)
-		$(use_with kerberos gssapi "${EPREFIX}"/usr)
-		--without-libgsasl
-		--without-libpsl
-		--without-msh3
-		$(use_with nghttp3)
-		$(use_with nghttp3 ngtcp2)
-		--without-quiche
-		$(use_with rtmp librtmp)
-		--without-schannel
-		--without-secure-transport
-		--without-test-caddy
-		--without-test-httpd
-		--without-test-nghttpx
-		$(use_enable websockets)
-		--without-winidn
-		--without-wolfssl
-		--with-zlib
-		$(use_with zstd)
-	)
-
-	if use test && multilib_is_native_abi && ( use http2 || use nghttp3 ); then
-		myconf+=(
-			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
-		)
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	if ! multilib_is_native_abi; then
-		# avoid building the client
-		sed -i -e '/SUBDIRS/s:src::' Makefile || die
-		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
-	fi
-
-	# Fix up the pkg-config file to be more robust.
-	# https://github.com/curl/curl/issues/864
-	local priv=() libs=()
-	# We always enable zlib.
-	libs+=( "-lz" )
-	priv+=( "zlib" )
-	if use http2; then
-		libs+=( "-lnghttp2" )
-		priv+=( "libnghttp2" )
-	fi
-	if use nghttp3; then
-		libs+=( "-lnghttp3" "-lngtcp2" )
-		priv+=( "libnghttp3" "libngtcp2" )
-	fi
-	if use ssl && use curl_ssl_openssl; then
-		libs+=( "-lssl" "-lcrypto" )
-		priv+=( "openssl" )
-	fi
-	grep -q Requires.private libcurl.pc && die "need to update ebuild"
-	libs=$(printf '|%s' "${libs[@]}")
-	sed -i -r \
-		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
-		libcurl.pc || die
-	echo "Requires.private: ${priv[*]}" >> libcurl.pc || die
-}
-
-multilib_src_test() {
-	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
-	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
-	# -v: verbose
-	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
-	# -k: keep test files after completion
-	# -am: automake style TAP output
-	# -p: print logs if test fails
-	# Note: if needed, we can disable tests. See e.g. Fedora's packaging
-	# or just read https://github.com/curl/curl/tree/master/tests#run.
-	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p"
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-	rm -rf "${ED}"/etc/ || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
index 098b942395..9158a1ed7a 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
@@ -15,7 +15,7 @@ SRC_URI="
 
 LICENSE="curl"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
 IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
 IUSE+=" nghttp3"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.0.ebuild
similarity index 88%
rename from sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.0.ebuild
index aea51451b8..12be62edfe 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-7.88.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.0.ebuild
@@ -1,14 +1,17 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="8"
+EAPI=8
 
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
 inherit autotools multilib-minimal prefix verify-sig
 
 DESCRIPTION="A Client that groks URLs"
 HOMEPAGE="https://curl.se/"
-SRC_URI="https://curl.se/download/${P}.tar.xz
-	verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )"
+SRC_URI="
+	https://curl.se/download/${P}.tar.xz
+	verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
+"
 
 LICENSE="curl"
 SLOT="0"
@@ -16,9 +19,9 @@ KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~
 IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
 IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
 IUSE+=" nghttp3"
-VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
+RESTRICT="!test? ( test )"
 
-#Only one default ssl provider can be enabled
+# Only one default ssl provider can be enabled
 REQUIRED_USE="
 	ssl? (
 		^^ (
@@ -28,57 +31,58 @@ REQUIRED_USE="
 			curl_ssl_openssl
 			curl_ssl_rustls
 		)
-	)"
+	)
+"
 
-# lead to lots of false negatives, bug #285669
-RESTRICT="!test? ( test )"
-
-RDEPEND="ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
 	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	ldap? ( net-nds/openldap:=[${MULTILIB_USEDEP}] )
+	nghttp3? (
+		net-libs/nghttp3[${MULTILIB_USEDEP}]
+		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
+	)
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
 	ssl? (
 		gnutls? (
+			app-misc/ca-certificates
 			net-libs/gnutls:=[static-libs?,${MULTILIB_USEDEP}]
 			dev-libs/nettle:=[${MULTILIB_USEDEP}]
-			app-misc/ca-certificates
 		)
 		mbedtls? (
-			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
 			app-misc/ca-certificates
+			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
+		)
+		nss? (
+			app-misc/ca-certificates
+			dev-libs/nss[${MULTILIB_USEDEP}]
+			dev-libs/nss-pem
 		)
 		openssl? (
 			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
 		)
-		nss? (
-			dev-libs/nss:0[${MULTILIB_USEDEP}]
-			dev-libs/nss-pem
-			app-misc/ca-certificates
-		)
 		rustls? (
 			net-libs/rustls-ffi:=[${MULTILIB_USEDEP}]
 		)
 	)
-	http2? ( net-libs/nghttp2:=[${MULTILIB_USEDEP}] )
-	nghttp3? (
-		net-libs/nghttp3[${MULTILIB_USEDEP}]
-		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
-	)
-	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
-	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
-	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
-	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
-	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
-	sys-libs/zlib[${MULTILIB_USEDEP}]
-	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
-
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
 DEPEND="${RDEPEND}"
-BDEPEND="dev-lang/perl
+BDEPEND="
+	dev-lang/perl
 	virtual/pkgconfig
 	test? (
 		sys-apps/diffutils
 		http2? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
 		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
 	)
-	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )"
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
 
 DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
 
@@ -90,22 +94,25 @@ MULTILIB_CHOST_TOOLS=(
 	/usr/bin/curl-config
 )
 
+QA_CONFIG_IMPL_DECL_SKIP=(
+	__builtin_available
+	closesocket
+	CloseSocket
+	getpass_r
+	ioctlsocket
+	IoctlSocket
+	mach_absolute_time
+	setmode
+)
+
 PATCHES=(
 	"${FILESDIR}"/${PN}-7.30.0-prefix.patch
 	"${FILESDIR}"/${PN}-respect-cflags-3.patch
-
-	"${FILESDIR}"/${P}-header-dump-segfault.patch
-	"${FILESDIR}"/${P}-pipewait.patch
-	"${FILESDIR}"/${P}-silent-parallel.patch
 )
 
 src_prepare() {
 	default
 
-	# Some tests (HTTP/#) rely on ssl certificates that are stored VCS which breaks
-	# with out-of-tree builds.
-	sed -i "s:my \$path   = getcwd():my \$path   = \"${S}/tests\":" tests/http*-server.pl \
-		|| die "Unable to update test locations"
 	eprefixify curl-config.in
 	eautoreconf
 }
@@ -255,7 +262,7 @@ multilib_src_configure() {
 	ECONF_SOURCE="${S}" econf "${myconf[@]}"
 
 	if ! multilib_is_native_abi; then
-		# avoid building the client
+		# Avoid building the client (we just want libcurl for multilib)
 		sed -i -e '/SUBDIRS/s:src::' Makefile || die
 		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
 	fi
@@ -294,9 +301,12 @@ multilib_src_test() {
 	# -k: keep test files after completion
 	# -am: automake style TAP output
 	# -p: print logs if test fails
-	# Note: if needed, we can disable tests. See e.g. Fedora's packaging
-	# or just read https://github.com/curl/curl/tree/master/tests#run.
-	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p"
+	# Note: if needed, we can skip specific tests. Prefix the test number in TFLAGS
+	# with a '!'. For example, to skip test 241 and 1083, use '!241 !1083'.
+	# See https://github.com/curl/curl/tree/master/tests#run for advanced test selection.
+	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
+	# as most gentoo users don't have an 'ip6-localhost'
+	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p !241 !1083"
 }
 
 multilib_src_install_all() {
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-gnutls-openssl-build.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-gnutls-openssl-build.patch
deleted file mode 100644
index 88463dc003..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-gnutls-openssl-build.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-https://bugs.gentoo.org/887833
-https://github.com/curl/curl/issues/10110
-https://github.com/curl/curl/commit/aef4dc892d012d990c85c7bad0d9d06c2ebfa775
-
-From aef4dc892d012d990c85c7bad0d9d06c2ebfa775 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Thu, 22 Dec 2022 17:40:26 +0100
-Subject: [PATCH] md4: fix build with GnuTLS + OpenSSL v1
-
-Reported-by: Esdras de Morais da Silva
-
-Fixes #10110
-Closes #10142
---- a/lib/md4.c
-+++ b/lib/md4.c
-@@ -86,11 +86,7 @@
- #include "memdebug.h"
- 
- 
--#if defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
--
--#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
--
--#elif defined(USE_GNUTLS)
-+#if defined(USE_GNUTLS)
- 
- typedef struct md4_ctx MD4_CTX;
- 
-@@ -109,6 +105,10 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
-   md4_digest(ctx, MD4_DIGEST_SIZE, result);
- }
- 
-+#elif defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
-+
-+#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
-+
- #elif defined(AN_APPLE_OS)
- typedef CC_MD4_CTX MD4_CTX;
- 
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-typecheck-deprecated.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-typecheck-deprecated.patch
deleted file mode 100644
index dec6d117ef..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.87.0-typecheck-deprecated.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-https://bugs.gentoo.org/890587
-https://github.com/curl/curl/issues/10148
-https://github.com/curl/curl/commit/e2aed004302e51cfa5b6ce8c8ab65ef92aa83196
-
-From e2aed004302e51cfa5b6ce8c8ab65ef92aa83196 Mon Sep 17 00:00:00 2001
-From: Patrick Monnerat <patrick@monnerat.net>
-Date: Fri, 23 Dec 2022 15:35:27 +0100
-Subject: [PATCH] typecheck: accept expressions for option/info parameters
-
-As expressions can have side effects, evaluate only once.
-
-To enable deprecation reporting only once, get rid of the __typeof__
-use to define the local temporary variable and use the target type
-(CURLoption/CURLINFO). This also avoids multiple reports on type
-conflicts (if some) by the curlcheck_* macros.
-
-Note that CURLOPT_* and CURLINFO_* symbols may be deprecated, but not
-their values: a curl_easy_setopt call with an integer constant as option
-will never report a deprecation.
-
-Reported-by: Thomas Klausner
-Fixes #10148
-Closes #10149
---- a/include/curl/typecheck-gcc.h
-+++ b/include/curl/typecheck-gcc.h
-@@ -42,9 +42,8 @@
-  */
- #define curl_easy_setopt(handle, option, value)                         \
-   __extension__({                                                       \
--      CURL_IGNORE_DEPRECATION(__typeof__(option) _curl_opt = option;)   \
-+      CURLoption _curl_opt = (option);                                  \
-       if(__builtin_constant_p(_curl_opt)) {                             \
--        (void) option;                                                  \
-         CURL_IGNORE_DEPRECATION(                                        \
-           if(curlcheck_long_option(_curl_opt))                          \
-             if(!curlcheck_long(value))                                  \
-@@ -120,9 +119,8 @@
- /* wraps curl_easy_getinfo() with typechecking */
- #define curl_easy_getinfo(handle, info, arg)                            \
-   __extension__({                                                       \
--      CURL_IGNORE_DEPRECATION(__typeof__(info) _curl_info = info;)      \
-+      CURLINFO _curl_info = (info);                                     \
-       if(__builtin_constant_p(_curl_info)) {                            \
--        (void) info;                                                    \
-         CURL_IGNORE_DEPRECATION(                                        \
-           if(curlcheck_string_info(_curl_info))                         \
-             if(!curlcheck_arr((arg), char *))                           \
-
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-header-dump-segfault.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-header-dump-segfault.patch
deleted file mode 100644
index 48ebb7a5e4..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-header-dump-segfault.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-https://github.com/curl/curl/commit/1c9cfb7af368feefb522caf81b052ee742a76da8
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Mon, 20 Feb 2023 18:35:13 +0100
-Subject: [PATCH] tool_operate: avoid fclose(NULL) on bad header dump file
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fixes #10570
-Reported-by: Jérémy Rabasco
-Closes #10571
---- a/src/tool_operate.c
-+++ b/src/tool_operate.c
-@@ -984,12 +984,13 @@ static CURLcode single_transfer(struct GlobalConfig *global,
-              */
-             if(!per->prev || per->prev->config != config) {
-               newfile = fopen(config->headerfile, "wb+");
--              fclose(newfile);
-+              if(newfile)
-+                fclose(newfile);
-             }
-             newfile = fopen(config->headerfile, "ab+");
- 
-             if(!newfile) {
--              warnf(global, "Failed to open %s\n", config->headerfile);
-+              errorf(global, "Failed to open %s\n", config->headerfile);
-               result = CURLE_WRITE_ERROR;
-               break;
-             }
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-onion-resolution.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-onion-resolution.patch
deleted file mode 100644
index d3385623da..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-onion-resolution.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-https://bugs.gentoo.org/887287
-https://github.com/curl/curl/pull/10705
-
-From: Matt Jolly <Matt.Jolly@footclan.ninja>
-Date: Wed, 8 Mar 2023 02:16:45 +1100
-Subject: [PATCH] Refuse to resolve the .onion TLD.
-
-RFC 7686 states that:
-
-> Applications that do not implement the Tor
-> protocol SHOULD generate an error upon the use of .onion and
-> SHOULD NOT perform a DNS lookup.
-
-Let's do that.
-
-See curl/curl#543
-https://www.rfc-editor.org/rfc/rfc7686#section-2
---- a/lib/hostip.c
-+++ b/lib/hostip.c
-@@ -652,6 +652,14 @@ enum resolve_t Curl_resolv(struct Curl_easy *data,
-   CURLcode result;
-   enum resolve_t rc = CURLRESOLV_ERROR; /* default to failure */
-   struct connectdata *conn = data->conn;
-+  /* We should intentionally error and not resolve .onion TLDs */
-+  size_t hostname_len = strlen(hostname);
-+  if(hostname_len >= 7 &&
-+  (curl_strequal(&hostname[hostname_len-6], ".onion") ||
-+  curl_strequal(&hostname[hostname_len-7], ".onion."))) {
-+    failf(data, "Not resolving .onion address (RFC 7686)");
-+    return CURLRESOLV_ERROR;
-+  }
-   *entry = NULL;
- #ifndef CURL_DISABLE_DOH
-   conn->bits.doh = FALSE; /* default is not */
---- a/tests/data/Makefile.inc
-+++ b/tests/data/Makefile.inc
-@@ -186,8 +186,8 @@ test1432 test1433 test1434 test1435 test1436 test1437 test1438 test1439 \
- test1440 test1441 test1442 test1443 test1444 test1445 test1446 test1447 \
- test1448 test1449 test1450 test1451 test1452 test1453 test1454 test1455 \
- test1456 test1457 test1458 test1459 test1460 test1461 test1462 test1463 \
--test1464 test1465 test1466 test1467 test1468 test1469 \
--\
-+test1464 test1465 test1466 test1467 test1468 test1469 test1471 \
-+test1472 \
- test1500 test1501 test1502 test1503 test1504 test1505 test1506 test1507 \
- test1508 test1509 test1510 test1511 test1512 test1513 test1514 test1515 \
- test1516 test1517 test1518 test1519 test1520 test1521 test1522 test1523 \
---- /dev/null
-+++ b/tests/data/test1471
-@@ -0,0 +1,39 @@
-+<testcase>
-+<info>
-+<keywords>
-+Onion
-+Tor
-+FAILURE
-+</keywords>
-+</info>
-+#
-+# Server-side
-+<reply>
-+</reply>
-+
-+#
-+# Client-side
-+<client>
-+<server>
-+none
-+</server>
-+<name>
-+Fail to resolve .onion TLD
-+</name>
-+<command>
-+red.onion
-+</command>
-+</client>
-+
-+#
-+# Verify data after the test has been "shot"
-+<verify>
-+# Couldn't resolve host name
-+<errorcode>
-+6
-+</errorcode>
-+<stderr mode="text">
-+curl: (6) Not resolving .onion address (RFC 7686)
-+</stderr>
-+</verify>
-+</testcase>
---- /dev/null
-+++ b/tests/data/test1472
-@@ -0,0 +1,39 @@
-+<testcase>
-+<info>
-+<keywords>
-+Onion
-+Tor
-+FAILURE
-+</keywords>
-+</info>
-+#
-+# Server-side
-+<reply>
-+</reply>
-+
-+#
-+# Client-side
-+<client>
-+<server>
-+none
-+</server>
-+<name>
-+Fail to resolve .onion. TLD
-+</name>
-+<command>
-+tasty.onion.
-+</command>
-+</client>
-+
-+#
-+# Verify data after the test has been "shot"
-+<verify>
-+# Couldn't resolve host name
-+<errorcode>
-+6
-+</errorcode>
-+<stderr mode="text">
-+curl: (6) Not resolving .onion address (RFC 7686)
-+</stderr>
-+</verify>
-+</testcase>
--- 
-2.39.2
-
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-pipewait.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-pipewait.patch
deleted file mode 100644
index 6c626a86c8..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-pipewait.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-https://github.com/curl/curl/commit/821f6e2a89de8aec1c7da3c0f381b92b2b801efc
-From: Stefan Eissing <stefan@eissing.org>
-Date: Thu, 9 Feb 2023 16:07:34 +0100
-Subject: [PATCH] CURLOPT_PIPEWAIT: allow waited reuse also for subsequent
- connections
-
-note: Dropped test portion of patch; not shipped in source tarball!
-
-As tested in test_02_07, when firing off 200 urls with --parallel, 199
-wait for the first connection to be established. if that is multiuse,
-urls are added up to its capacity.
-
-The first url over capacity opens another connection. But subsequent
-urls found the same situation and open a connection too. They should
-have waited for the second connection to actually connect and make its
-capacity known.
-
-This change fixes that by
-
-- setting `connkeep()` early in the HTTP setup handler. as otherwise
-  a new connection is marked as closeit by default and not considered
-  for multiuse at all
-- checking the "connected" status for a candidate always and continuing
-  to PIPEWAIT if no alternative is found.
-
-pytest:
-- removed "skip" from test_02_07
-- added test_02_07b to check that http/1.1 continues to work as before
-
-Closes #10456
---- a/lib/http.c
-+++ b/lib/http.c
-@@ -233,6 +233,7 @@ static CURLcode http_setup_conn(struct Curl_easy *data,
- 
-   Curl_mime_initpart(&http->form);
-   data->req.p.http = http;
-+  connkeep(conn, "HTTP default");
- 
-   if((data->state.httpwant == CURL_HTTP_VERSION_3)
-      || (data->state.httpwant == CURL_HTTP_VERSION_3ONLY)) {
---- a/lib/url.c
-+++ b/lib/url.c
-@@ -1170,14 +1170,14 @@ ConnectionExists(struct Curl_easy *data,
-             continue;
-           }
-         }
-+      }
- 
--        if(!Curl_conn_is_connected(check, FIRSTSOCKET)) {
--          foundPendingCandidate = TRUE;
--          /* Don't pick a connection that hasn't connected yet */
--          infof(data, "Connection #%ld isn't open enough, can't reuse",
--                check->connection_id);
--          continue;
--        }
-+      if(!Curl_conn_is_connected(check, FIRSTSOCKET)) {
-+        foundPendingCandidate = TRUE;
-+        /* Don't pick a connection that hasn't connected yet */
-+        infof(data, "Connection #%ld isn't open enough, can't reuse",
-+              check->connection_id);
-+        continue;
-       }
- 
- #ifdef USE_UNIX_SOCKETS
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-silent-parallel.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-silent-parallel.patch
deleted file mode 100644
index 1162067f73..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-7.88.1-silent-parallel.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-https://github.com/curl/curl/commit/475207c1c834ecf203dc4f3bc1917ae87628b6d0
-From: Daniel Stenberg <daniel@haxx.se>
-Date: Tue, 21 Feb 2023 11:38:03 +0100
-Subject: [PATCH] tool_progress: shut off progress meter for --silent in
- parallel
-
-Reported-by: finkjsc on github
-Fixes #10573
-Closes #10579
---- a/src/tool_progress.c
-+++ b/src/tool_progress.c
-@@ -173,7 +173,7 @@ bool progress_meter(struct GlobalConfig *global,
-   struct timeval now;
-   long diff;
- 
--  if(global->noprogress)
-+  if(global->noprogress || global->silent)
-     return FALSE;
- 
-   now = tvnow();
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
index cdd47f1033..10ae7d7198 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/metadata.xml
@@ -20,7 +20,6 @@
 		<flag name="imap">Enable Internet Message Access Protocol support</flag>
 		<flag name="mbedtls">Enable mbedtls ssl backend</flag>
 		<flag name="nghttp3">Enable HTTP/3.0 support using <pkg>net-libs/nghttp3</pkg> and <pkg>net-libs/ngtcp2</pkg></flag>
-		<flag name="quiche">Enable HTTP/3.0 support using <pkg>net-libs/quiche</pkg></flag>
 		<flag name="nss">Enable nss ssl backend</flag>
 		<flag name="openssl">Enable openssl ssl backend</flag>
 		<flag name="pop3">Enable Post Office Protocol 3 support</flag>
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.2.7-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.2.7-r2.ebuild
index 2696011e9b..9b4a39a988 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.2.7-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/rsync/rsync-3.2.7-r2.ebuild
@@ -27,7 +27,7 @@ else
 		SRC_DIR="src-previews"
 	else
 		SRC_DIR="src"
-		KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 	fi
 
 	SRC_URI="https://rsync.samba.org/ftp/rsync/${SRC_DIR}/${P/_/}.tar.gz
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
index 7053a35222..f74c516e7c 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
@@ -1,2 +1,4 @@
 DIST wget-1.21.3.tar.gz 5079864 BLAKE2B 4ff40a30cb3be82ea492d0eae324a9d43de30a0169d3b219ce25f3d667915f90c7eb1559760d1605340f112e96e028613265e0be73aaba7935c69cc06a4ae4f6 SHA512 29889ecbf590dff0f39183d9e0621741d731a554d990e5c995a4644725dca62e8e19601d40db0ef7d62ebf54e5457c7409965e4832b6e60e4ccbc9c8caa30718
 DIST wget-1.21.3.tar.gz.sig 854 BLAKE2B 71f69492397ae9e36284be9acdd1c94da34a7397c14a6de1a867c0d1e807bf961f8a2e098ab5629425691ce595227fb08f046416245fda2a6025929079f2d7c2 SHA512 b9f41496e0083545bc703c97b0758500f337527647cdc422152d7855d05351e3a62685269238c78300eafdbfaed8afecaeb988901a3d8a6b002e9fb3d70efe4f
+DIST wget-1.21.4.tar.gz 5059591 BLAKE2B ced6fb9a20343d41e4d8e0c8f171c60535847504fa4c32abc81d104a1594dc7b7c97b5b301836e31dacc7a0f2155c0a2e70e42ff60dc3fa471deb1dad33ba736 SHA512 7a1539045174f6b97ab6980811c2ac1799edc20db72987b5ba9b1710cffb19669a7736813d15c8da3aa2d4a384246ff946b77ecb0baeb6fd3e12ae591f1bf6a3
+DIST wget-1.21.4.tar.gz.sig 854 BLAKE2B 162c4f358e781bbfb0fa73910191c29dd411f48c9b2c8e8fe00a12741153e624955393d769aa7311b03115d04b6b946a84b636f643d7cdc8c8cd81387b9cf143 SHA512 72603493c2d799dca08700175a2010d8736fd6d3cb9bea3987db8814e9f133ab0fbd1477892115f7fbbd1a7d4d416ec370bdbff6dbe8f00d1eea84f0c4f8d84b
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.21.4.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.21.4.ebuild
new file mode 100644
index 0000000000..c0a4ad8cf6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.21.4.ebuild
@@ -0,0 +1,110 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/wget.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+DESCRIPTION="Network utility to retrieve files from the WWW"
+HOMEPAGE="https://www.gnu.org/software/wget/"
+SRC_URI="mirror://gnu/wget/${P}.tar.gz"
+SRC_URI+=" verify-sig? ( mirror://gnu/wget/${P}.tar.gz.sig )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="cookie-check debug gnutls idn ipv6 metalink nls ntlm pcre +ssl static test uuid zlib"
+REQUIRED_USE="ntlm? ( !gnutls ssl ) gnutls? ( ssl )"
+RESTRICT="!test? ( test )"
+
+# * Force a newer libidn2 to avoid libunistring deps. #bug #612498
+# * Metalink can use gpgme automagically (so let's always depend on it)
+# for signed metalink resources.
+LIB_DEPEND="
+	cookie-check? ( net-libs/libpsl )
+	idn? ( >=net-dns/libidn2-0.14:=[static-libs(+)] )
+	metalink? (
+		app-crypt/gpgme
+		media-libs/libmetalink
+	)
+	pcre? ( dev-libs/libpcre2[static-libs(+)] )
+	ssl? (
+		gnutls? ( net-libs/gnutls:=[static-libs(+)] )
+		!gnutls? ( dev-libs/openssl:=[static-libs(+)] )
+	)
+	uuid? ( sys-apps/util-linux[static-libs(+)] )
+	zlib? ( sys-libs/zlib[static-libs(+)] )
+"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	sys-apps/texinfo
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+	test? (
+		${PYTHON_DEPS}
+		>=dev-perl/HTTP-Daemon-6.60.0
+		dev-perl/HTTP-Message
+		dev-perl/IO-Socket-SSL
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-wget-20230511 )
+"
+
+DOCS=( AUTHORS MAILING-LIST NEWS README )
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+	sed -i -e "s:/usr/local/etc:${EPREFIX}/etc:g" doc/{sample.wgetrc,wget.texi} || die
+}
+
+src_configure() {
+	# fix compilation on Solaris, we need filio.h for FIONBIO as used in
+	# the included gnutls -- force ioctl.h to include this header
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -DBSD_COMP=1
+
+	if use static ; then
+		append-ldflags -static
+		tc-export PKG_CONFIG
+		PKG_CONFIG+=" --static"
+	fi
+
+	# There is no flag that controls this.  libunistring-prefix only
+	# controls the search path (which is why we turn it off below).
+	# Further, libunistring is only needed w/older libidn2 installs,
+	# and since we force the latest, we can force off libunistring. # bug #612498
+	local myeconfargs=(
+		ac_cv_libunistring=no
+		--disable-assert
+		--disable-pcre
+		--disable-rpath
+		--without-included-libunistring
+		--without-libunistring-prefix
+		$(use_enable debug)
+		$(use_enable idn iri)
+		$(use_enable ipv6)
+		$(use_enable nls)
+		$(use_enable ntlm)
+		$(use_enable pcre pcre2)
+		$(use_enable ssl digest)
+		$(use_enable ssl opie)
+		$(use_with cookie-check libpsl)
+		$(use_enable idn iri)
+		$(use_with metalink)
+		$(use_with ssl ssl $(usex gnutls gnutls openssl))
+		$(use_with uuid libuuid)
+		$(use_with zlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
index 659286d351..600538e71f 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/whois/Manifest
@@ -1,3 +1,3 @@
 DIST whois_5.5.14.tar.xz 87480 BLAKE2B 868c9dc968581535ee2b56a6293f634e2c8dc6c00703a45d4ca4f0ce6769786ee4921bd66f3a470b2a7f31808db2971b284c23b76b608bff1edbb7bbe37f892a SHA512 f190d488d7bd68717c0a83ca85709fad09c33b619c46d7e0dd12e79621fdba56b9d43480c25ef3c9df2f6ade0ee72d692bfc5d0bd96839ef92194004313d1cc6
-DIST whois_5.5.15.tar.xz 89960 BLAKE2B 50e0114b3b6c3ad143e7a1aed62e492e780a061d7151de2b0d48cc4b55b889958abaa5fc069c8c36075936fb4bf4ad3d9e15ff799c2c0e2e33a1aa31c4136272 SHA512 e173927fd3428d27bc8ab34b1a66b82d6a2cfc107245755868bdd33cb7eb1b8159e87774c3a751d9694e65b3d870b9904dc9a3c657dca385950c8a19be1fa61c
 DIST whois_5.5.16.tar.xz 90516 BLAKE2B c3d34dd392c2d7968c5c9b7bcce07d144dc3d7dcea15f1578de2114dc34325a9d01754d922b7a83edd799101c816c254b7a79e78feeb8a115c40f41ac1e01f4c SHA512 302a88edad11fee38b4d16b78af38701938d8d875e5ef22b9f40147717f9edda5abc5b791638bb2a3534214938a598faeeae5001275e751d480f95761b6bff14
+DIST whois_5.5.17.tar.xz 90608 BLAKE2B 82793097e421d88130d089fc64bb0bceac0c9170b39388262b45d2bf62fc2f8b7c4e393fc5351bba6be303ced00a00af1972bf73c1c8c7c86c812b19a0a6fb5a SHA512 0ed33edc2005eb51a88bda505cc3f6ebe3966095d6f12c03cfe62c12e7e575e1d008632d12de6f27b4c09b91ce5a45705d57acce88409e573bbd7b5132df7fc6
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.15.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.17.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.15.ebuild
rename to sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.17.ebuild
index cd95191e70..7d0d51aff2 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.15.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/whois/whois-5.5.17.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -15,7 +15,7 @@ if [[ ${PV} == *9999 ]] ; then
 else
 	SRC_URI="mirror://debian/pool/main/w/whois/${MY_P}.tar.xz"
 	#SRC_URI="https://github.com/rfc1036/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	S="${WORKDIR}"/${PN}
+	#S="${WORKDIR}"/${PN}
 
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index f69ce2e172..3432f1a512 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,11 +1,19 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Matt Turner <tetromino@gentoo.org> (2023-02-15)
+# Sam James <sam@gentoo.org> (2023-05-01)
+# media-libs/libjxl is not keyworded
+# bug https://bugs.gentoo.org/853628
+media-gfx/gimp jpegxl
+media-gfx/graphicsmagick jpegxl
+media-gfx/imagemagick jpegxl
+media-libs/imlib2 jpegxl
+
+# Matt Turner <mattst88@gentoo.org> (2023-02-15)
 # pandoc not keyworded here, bug #878355
 app-admin/conky doc
 
-# Matt Turner <tetromino@gentoo.org> (2023-02-15)
+# Matt Turner <mattst88@gentoo.org> (2023-02-15)
 # net-libs/libqmi and net-libs/libqrtr-glib are not keyworded here
 net-misc/modemmanager qmi qrtr
 
@@ -29,11 +37,6 @@ net-misc/openntpd constraints
 # Needs unkeyworded app-doc/halibut
 >=net-misc/putty-0.77 doc
 
-# Sergey Torokhov <torokhov-s-a@yandex.ru> (2022-06-22)
-# media-libs/libjxl is not keyworded
-# bug https://bugs.gentoo.org/853628
-media-gfx/gimp jpegxl
-
 # Sam James <sam@gentoo.org> (2022-04-29)
 # Needs unkeyworded dev-util/umockdev
 sys-power/upower test
@@ -44,7 +47,7 @@ dev-python/click doc
 
 # Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
 # Dependencies are missing keywords
-media-libs/imlib2 svg heif jpegxl
+media-libs/imlib2 svg heif
 
 # Matt Turner <mattst88@gentoo.org> (2022-04-18)
 # app-text/nuspell is not keyworded
@@ -54,10 +57,6 @@ app-text/enchant nuspell
 # gnome-base/librsvg missing keywords
 media-libs/freetype svg
 
-# Sam James <sam@gentoo.org> (2022-03-26)
-# media-libs/libjxl not keyworded here
-media-gfx/graphicsmagick jpegxl
-
 # Adel Kara Slimane <adel.ks@zegrapher.com> (2022-03-14)
 # Untested useflag on other arches, needs keywording
 media-video/ffmpeg vmaf
@@ -72,7 +71,7 @@ media-video/ffmpeg svt-av1
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Avoid keywording unnecessary depenencies for now, bug #804115
-dev-python/scipy pythran
+dev-python/scipy fortran
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Test suite is very fragile and doesn't even run on amd64.
@@ -121,6 +120,7 @@ media-libs/rubberband jni
 media-libs/gd avif heif
 media-gfx/graphicsmagick heif
 www-client/links avif
+dev-lang/php avif
 
 # Sam James <sam@gentoo.org> (2021-02-26)
 # dev-libs/efl not keyworded here
@@ -185,8 +185,6 @@ media-libs/mesa vulkan vulkan-overlay zink
 # net-libs/webkit-gtk has no alpha keywords
 app-editors/emacs xwidgets
 gnome-extra/evolution-data-server oauth
-# needs mail-client/evolution, depends on net-libs/webkit-gtk
-app-office/planner eds
 # needs gnome-extra/sushi, depends on net-libs/webkit-gtk
 gnome-base/nautilus previewer
 # needs libgdata[gnome-online-accounts], depends on net-libs/webkit-gtk
@@ -470,11 +468,6 @@ media-libs/gst-plugins-base ivorbis
 # remove mask if/when media-gfx/argyllcms is keywored here.
 x11-misc/colord argyllcms extra-print-profiles
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
-# requires app-office/unoconv, which requires virtual/ooo, which is not
-# keyworded here. Remove mask if this situation changes.
-gnome-extra/sushi office
-
 # Raúl Porcel <armin76@gentoo.org> (2012-12-30)
 # Needs testing
 media-libs/phonon gstreamer vlc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/use.mask
index d264e4d4e9..46424728f2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -193,10 +193,6 @@ opencl
 # Unmask once sys-libs/libunwind gets ported & keyworded.
 unwind
 
-# Pacho Ramos <pacho@gentoo.org> (2014-01-08)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Tobias Klausmann <klausman@gentoo.org> (2014-07-20)
 # Mask redis USE flag everywhere since redis depends on google-perftools,
 # which are not supported on Alpha at all (assembly).
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.force
index 9c619d92ff..da0808237a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.force
@@ -1,10 +1,6 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2020-06-18)
-# Force host target
-dev-libs/keystone llvm_targets_X86
-
 # Michał Górny <mgorny@gentoo.org> (2017-12-30)
 # We have ready-to-use configs here.
 sys-kernel/gentoo-kernel -savedconfig
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index 69516b4928..9a0ced87db 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-05-15)
+# net-libs/rustls-ffi is keyworded here
+www-servers/apache -apache2_modules_tls
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-04-22)
 # snap only works on amd64
 kde-plasma/discover -snap
@@ -353,7 +357,7 @@ media-libs/libmikmod cpu_flags_x86_sse2
 
 # Andreas K. Huettel <dilfridge@gentoo.org> (2014-01-04)
 # While globally masked, the needed amd64 keywords are already present
-dev-vcs/git -mediawiki -mediawiki-experimental
+dev-vcs/git -mediawiki
 
 # Sergey Popov <pinkbyte@gentoo.org> (2013-12-27)
 # Boost.Context can be built on amd64
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index 5bb8f28a05..133b37c5b5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-05-15)
+# net-libs/rustls-ffi is not marked stable
+www-servers/apache apache2_modules_tls
+
 # Michał Górny <mgorny@gentoo.org> (2023-04-22)
 # pandoc is stable here.
 dev-python/nbclassic -doc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index 959adab62d..a7962c924f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -55,10 +55,6 @@
 -python_targets_pypy3
 -python_single_target_pypy3
 
-# Michał Górny <mgorny@gentoo.org> (2013-05-04)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # keyworded on amd64
 -clisp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index d47933dac3..56fec00dc6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -42,7 +42,6 @@ dev-python/PyQtWebEngine
 app-admin/calamares
 app-doc/zeal
 app-editors/ghostwriter
-app-editors/notepadqq
 app-editors/retext
 app-misc/anki
 app-office/kalendar:5
@@ -172,7 +171,6 @@ dev-ruby/coffee-rails
 dev-ruby/coffee-script
 dev-ruby/deckar01-task_list
 dev-ruby/execjs
-dev-ruby/turbolinks
 dev-ruby/uglifier
 dev-util/uglifyjs
 net-libs/nodejs
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
index 4439dbfa50..a08ded6acd 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
@@ -46,10 +46,8 @@ www-servers/uwsgi uwsgi_plugins_rados
 # Michał Górny <mgorny@gentoo.org> (2018-01-12)
 # Those packages require net-libs/nodejs.
 dev-lang/nim test-js
-dev-python/nbdime webtools
 dev-ruby/ammeter test
 dev-ruby/jsobfu test
-dev-ruby/rails asset-pipeline
 dev-ruby/sprockets test
 dev-ruby/tilt test
 net-analyzer/netdata nodejs
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
index 36ce30e861..5bcf186478 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.mask
@@ -11,7 +11,6 @@ dev-python/PyQtWebEngine
 app-admin/calamares
 app-doc/zeal
 app-editors/ghostwriter
-app-editors/notepadqq
 app-editors/retext
 app-misc/anki
 app-office/kalendar:5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.force
index 12be1ef6ae..9fe795360f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.force
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # matoro <matoro_gentoo@matoro.tk> (2022-08-31)
@@ -10,10 +10,6 @@ dev-lang/ghc:0/9.0.2 llvm
 # Satisfy REQUIRED_USE on arm
 app-emulation/xen debug
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2020-06-18)
-# Force host target
-dev-libs/keystone llvm_targets_ARM
-
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2019-02-16)
 # Force the host target
 dev-lang/rust llvm_targets_ARM
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index a0c7d38b98..3781ce232d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-10)
+# sys-cluster/ceph not keyworded here
+sys-block/tgt rbd
+
+# Sebastian Parborg <darkdefende@gmail.com> (2023-05-08)
+# media-libs/openpgl and media-libs/embree only supports amd64 and arm64
+media-gfx/blender embree openpgl
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-03-07)
 # nbval/nbclassic docs require pandoc which is not keyworded here yet
 dev-python/nbval doc
@@ -75,10 +83,6 @@ app-emulation/qemu rbd slirp spice virgl vde
 app-emulation/qemu qemu_softmmu_targets_i386 qemu_softmmu_targets_x86_64
 app-emulation/qemu qemu_softmmu_targets_ppc qemu_softmmu_targets_ppc64
 
-# Sam James <sam@gentoo.org> (2021-10-31)
-# dev-python/pyilmbase isn't keyworded on arm
-media-gfx/alembic python
-
 # Tomáš Mózes <hydrapolic@gmail.com> (2021-09-25)
 # Unkeyworded dependencies.
 app-admin/syslog-ng mongodb
@@ -235,10 +239,6 @@ media-video/mpv -raspberry-pi
 # smallest wav files.
 media-sound/xmms2 mac
 
-# Ian Whyman <thev00d00@gentoo.org> (2017-09-05)
-# missing keywords media-libs/lastfmlib
-net-misc/gerbera lastfm
-
 # Michał Górny <mgorny@gentoo.org> (2017-08-10)
 # Requires USE=ipmi which is masked in this profile.
 sys-power/nut ups_drivers_nut-ipmipsu
@@ -434,17 +434,11 @@ dev-tex/tex4ht java
 dev-vcs/subversion java
 media-libs/libjpeg-turbo java
 net-misc/tigervnc java
-sys-devel/gettext java
 
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2013-01-22)
 # remove mask if/when media-gfx/argyllcms is keywored here.
 x11-misc/colord argyllcms extra-print-profiles
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
-# requires app-office/unoconv, which requires virtual/ooo, which is not
-# keyworded here. Remove mask if this situation changes.
-gnome-extra/sushi office
-
 # Markus Meier <maekke@gentoo.org> (2012-12-08)
 # mask app-office/libreoffice java extensions
 app-office/libreoffice libreoffice_extensions_scripting-beanshell libreoffice_extensions_scripting-javascript libreoffice_extensions_wiki-publisher coinmp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
index 1c6ed0e821..a1e0711b3b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.stable.mask
@@ -66,8 +66,6 @@ media-libs/phonon vlc
 net-misc/openssh security-key
 dev-util/geany-plugins markdown
 app-arch/rpm test
-net-misc/openssh security-key
-dev-util/geany-plugins markdown
 net-misc/unison gtk
 
 # Michał Górny <mgorny@gentoo.org> (2019-09-08)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
index 989f3507b1..0227ba0da3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/use.mask
@@ -121,10 +121,6 @@ video_cards_radeonsi
 # media-libs/xine-lib is not keyworded
 xine
 
-# Michał Górny <mgorny@gentoo.org> (2013-05-04)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org> (2013-08-22)
 # virtual/opencl is not keyworded
 opencl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
index 4392200bf9..83a38f1693 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # matoro <matoro_gentoo@matoro.tk> (2022-08-31)
@@ -11,10 +11,6 @@ dev-lang/ghc:0/9.0.2 llvm
 sys-kernel/gentoo-kernel -savedconfig
 sys-kernel/vanilla-kernel -savedconfig
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2020-06-18)
-# Force host target
-dev-libs/keystone llvm_targets_AArch64
-
 # Aaron Bauman <bman@gentoo.org> (2019-12-27)
 # ffmpeg does support 64 bit neon
 media-video/ffmpeg cpu_flags_arm_neon
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index 9fb567a447..dcbd55a09e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -67,10 +67,6 @@ sys-cluster/slurm ucx
 # Supports 64-bit NEON
 dev-libs/libgcrypt -cpu_flags_arm_neon
 
-# Sam James <sam@gentoo.org> (2021-10-31)
-# dev-python/pyilmbase isn't keyworded on arm64
-media-gfx/alembic python
-
 # Jakov Smolić <jsmolic@gentoo.org> (2021-10-07)
 # dev-libs/mongo-c-driver is not keyworded here
 net-analyzer/zmap mongo
@@ -374,10 +370,6 @@ app-emulation/libvirt xen
 # Requires USE=sdl that is masked in this profile.
 media-video/mjpegtools sdlgfx
 
-# Ian Whyman <thev00d00@gentoo.org> (2017-09-05)
-# missing keywords media-libs/lastfmlib
-net-misc/gerbera lastfm
-
 # Roy Bamford <neddysegoon@gentoo.org> (2017-08-24)
 # Support for g15daemon still needs -9999 packages on all arches
 net-voip/mumble g15
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
index 8e48c570e5..d491354344 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/use.mask
@@ -73,10 +73,6 @@ opencl
 # net-libs/libsmi not tested on arm64 yet
 smi
 
-# Mart Raudsepp <leio@gentoo.org> (2017-02-01)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Markus Meier <maekke@gentoo.org> (2010-08-22)
 # net-wireless/wimax not tested
 wimax
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 9bc2a11136..28b10b38c5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-15)
+# Unkeyworded dependencies
+www-servers/apache apache2_modules_tls
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-04-22)
 # snap only works on amd64
 kde-plasma/discover snap
@@ -118,13 +122,6 @@ x11-wm/mutter video_cards_nvidia
 # We don't list "clozurecl" here since it's already in use.mask.
 >=sci-mathematics/maxima-5.44.0-r5 clozurecl64
 
-# Sam James <sam@gentoo.org> (2021-03-02)
-# Java build is extremely sensitive to environment
-# Previously stable-masked but moved here
-# Then: bug #483372, bug #508564
-# Now: bug #773913 (exposed by having a new ~arch ebuild)
-media-libs/libcaca java mono
-
 # Jaco Kroon <jaco@uls.co.za> (2021-01-08)
 # blocksruntime (clang -fblocks) isn't available on all arches.
 net-misc/asterisk blocks
@@ -347,7 +344,7 @@ media-sound/lmms vst
 
 # Andreas K. Huettel <dilfridge@gentoo.org> (2014-01-04)
 # Mask until dependencies are keyworded (bug 497068)
-dev-vcs/git mediawiki mediawiki-experimental
+dev-vcs/git mediawiki
 
 # Sergey Popov <pinkbyte@gentoo.org> (2013-12-27)
 # Mask because Boost.Context library does not work on most of arches
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 1d46d81afb..9131415958 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # matoro <matoro_gentoo@matoro.tk> (2022-09-29)
@@ -207,11 +207,6 @@ ecls
 gcl
 sbcl
 
-# Michał Górny <mgorny@gentoo.org> (2013-05-04)
-# Mask systemd flag globally, unmasked on arches on which systemd
-# is keyworded.
-systemd
-
 # Mike Gilbert <floppym@gentoo.org> (2014-10-19)
 # Requires the following packages to be keyworded/stable:
 # sys-libs/libapparmor
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
index 23d2f5f96e..b0be4f5987 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.force
@@ -1,6 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-04-30)
+# Stacks on HPPA grow upwards and GCC doesn't support SSP or SCP there.
+sys-devel/gcc -default-stack-clash-protection
+
 # Sam James <sam@gentoo.org> (2022-02-19)
 # New enough SpiderMonkey not keyworded here, bug #753221
 sys-auth/polkit duktape
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index 9977cd44be..80a121bcef 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -4,6 +4,30 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Michał Górny <mgorny@gentoo.org> (2023-05-20)
+# Requires dev-python/sphinx-autodoc-types that has unkeyworded depgraph.
+dev-python/jupyter-core doc
+
+# Sam James <sam@gentoo.org> (2023-05-19)
+# kde-frameworks/kwayland:5 is not keyworded here.
+app-crypt/pinentry wayland
+
+# Sam James <sam@gentoo.org> (2023-05-10)
+# sys-cluster/ceph not keyworded here
+sys-block/tgt rbd
+
+# Sam James <sam@gentoo.org> (2023-05-01)
+# media-libs/libjxl is not keyworded
+# bug https://bugs.gentoo.org/853628
+media-gfx/gimp jpegxl
+media-gfx/graphicsmagick jpegxl
+media-gfx/imagemagick jpegxl
+media-libs/imlib2 jpegxl
+
+# Sam James <sam@gentoo.org> (2023-04-30)
+# Stacks on HPPA grow upwards and GCC doesn't support SSP or SCP there.
+sys-devel/gcc default-stack-clash-protection
+
 # Sam James <sam@gentoo.org> (2023-04-16)
 # net-libs/libcloudproviders not keyworded here
 x11-libs/gtk+ cloudproviders
@@ -34,11 +58,6 @@ net-dns/ddclient test
 # deps not keyworded
 dev-util/pkgcheck emacs
 
-# Sergey Torokhov <torokhov-s-a@yandex.ru> (2022-06-22)
-# media-libs/libjxl is not keyworded
-# bug https://bugs.gentoo.org/853628
-media-gfx/gimp jpegxl
-
 # Sam James <sam@gentoo.org> (2022-05-17)
 # sci-libs/sundials fails to build tests on HPPA
 # bug #845222
@@ -51,7 +70,7 @@ dev-libs/libgdata crypt
 
 # Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
 # Dependencies are missing keywords
-media-libs/imlib2 svg heif jpegxl
+media-libs/imlib2 svg heif
 
 # Sam James <sam@gentoo.org> (2022-04-24)
 # Requires dev-util/pahole.
@@ -66,10 +85,6 @@ app-text/enchant nuspell
 # gnome-base/librsvg missing keywords
 media-libs/freetype svg
 
-# Sam James <sam@gentoo.org> (2022-03-26)
-# media-libs/libjxl not keyworded here
-media-gfx/graphicsmagick jpegxl
-
 # Sam James <sam@gentoo.org> (2022-03-22)
 # media-libs/dav1d not keyworded here
 media-libs/xine-lib dav1d
@@ -98,10 +113,6 @@ dev-python/anyio doc
 # Avoid unnecessary dependencies
 dev-python/matplotlib gtk3
 
-# Sam James <sam@gentoo.org> (2021-11-05)
-# Avoid keywording unnecessary depenencies for now, bug #804115
-dev-python/scipy pythran
-
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Test suite is very fragile and doesn't even run on amd64.
 # No real point in running it here right now, bug #804115.
@@ -158,6 +169,7 @@ media-libs/rubberband jni
 media-libs/gd avif heif
 media-gfx/graphicsmagick heif
 www-client/links avif
+dev-lang/php avif
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-01-19)
 # uchardet not stable/keyworded yet on this arch
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
index 17397f9389..6a5a44bf9a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.stable.mask
@@ -43,10 +43,8 @@ net-misc/chrony pps
 net-libs/libpcap netlink rdma
 
 # Sam James <sam@gentoo.org> (2021-11-17)
-# x11-libs/libXvMC is not marked stable on HPPA
 # media-libs/mesa is not marked stable on HPPA
 media-libs/libepoxy egl
-media-libs/mesa xvmc
 
 # Rolf Eike Beer <eike@sf-mail.de> (2021-11-10)
 # The following packages have no stable keywords on hppa:
@@ -170,10 +168,6 @@ sys-apps/dbus test
 # noone actually tests it on real hardware anymore
 x11-base/xorg-server xorg
 
-# Rolf Eike Beer <eike@sf-mail.de> (2020-12-11)
-# not all needed sphinx modules are stable on hppa.
-dev-python/aiohttp doc
-
 # Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> (2020-10-14)
 # app-i18n/fcitx:4 not stable.
 media-libs/libsdl2 fcitx4
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
index 5337dd2771..9542a2f792 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -41,10 +41,6 @@ vulkan
 system-libvpx
 vpx
 
-# Matt Turner <mattst88@gentoo.org> (2018-05-26)
-# Unmask systemd since it is keyworded here.
--systemd
-
 #
 # Jeroen Roovers <jer@gentoo.org> (2018-03-22)
 # sys-cluster/ceph is not supported
@@ -154,6 +150,7 @@ gconf
 gnome
 gnome-keyring
 gnome-online-accounts
+keyring
 
 # Jeroen Roovers <jer@gentoo.org> (2010-07-19)
 # Masked because of missing gnome-base/gnome-panel
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
index 7e7c58c430..1f1e961e60 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-04-17)
+# net-misc/pps-tools is not keyworded here
+net-misc/chrony pps
+
+# Sam James <sam@gentoo.org> (2023-05-01)
+# media-libs/libjxl is not keyworded
+# bug https://bugs.gentoo.org/853628
+media-gfx/gimp jpegxl
+media-gfx/graphicsmagick jpegxl
+media-gfx/imagemagick jpegxl
+media-libs/imlib2 jpegxl
+
 # Sam James <sam@gentoo.org> (2023-04-14)
 # dev-python/sympy not keyworded here yet
 dev-python/nbval test
@@ -30,15 +42,9 @@ dev-util/pkgcheck emacs
 # net-libs/libqrtr-glib not keyworded
 net-misc/modemmanager qrtr
 
-# Sergey Torokhov <torokhov-s-a@yandex.ru> (2022-06-22)
-# media-libs/libjxl is not keyworded
-# bug https://bugs.gentoo.org/853628
-media-gfx/gimp jpegxl
-
 # Nickolas Raymond Kaczynski <nrk@disroot.org> (2022-04-24)
 # Dependencies are missing keywords
-media-libs/imlib2 svg heif jpegxl
-media-gfx/graphicsmagick jpegxl
+media-libs/imlib2 svg heif
 
 # Matt Turner <mattst88@gentoo.org> (2022-04-18)
 # app-text/nuspell is not keyworded
@@ -66,7 +72,7 @@ app-accessibility/espeak-ng man
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Avoid keywording unnecessary depenencies for now, bug #804115
-dev-python/scipy pythran
+dev-python/scipy fortran
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Test suite is very fragile and doesn't even run on amd64.
@@ -127,6 +133,7 @@ media-libs/rubberband jni
 media-libs/gd avif heif
 media-gfx/graphicsmagick heif
 www-client/links avif
+dev-lang/php avif
 
 # Akinori Hattori <hattya@gentoo.org> (2021-03-03)
 # dev-lang/ruby is not keyworded
@@ -347,7 +354,6 @@ media-sound/rhythmbox upnp-av
 
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2016-06-28)
 # Missing keywords on app-text/gspell - bug #587368
->=app-editors/gedit-3.20 spell
 >=app-text/evince-3.30 spell
 
 # Pacho Ramos <pacho@gentoo.org> (2016-01-31)
@@ -451,11 +457,6 @@ net-misc/modemmanager qmi
 # remove mask if/when media-gfx/argyllcms is keywored here.
 x11-misc/colord argyllcms extra-print-profiles
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
-# requires app-office/unoconv, which requires virtual/ooo, which is not
-# keyworded here. Remove mask if this situation changes.
-gnome-extra/sushi office
-
 # Agostino Sarubbo <ago@gentoo.org> (2012-12-18)
 # kde is not stable, then no needs phonon backends
 media-libs/phonon gstreamer vlc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/use.mask
index 187c06dae9..8cf4b1f138 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -198,10 +198,6 @@ opencl
 # sys-devel/llvm s not keyworded, bug #320221
 llvm
 
-# Pacho Ramos <pacho@gentoo.org> (2014-01-08)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # sys-libs/libseccomp has not been ported to this arch yet #524148
 seccomp
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
index 12507b441c..20547d7e15 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.force
@@ -7,7 +7,6 @@
 # Some packages are not fully ported yet, but preemptively added so we won't
 # have to revisit later.
 dev-lang/rust llvm_targets_LoongArch
-dev-libs/keystone llvm_targets_LoongArch
 dev-ml/llvm-ocaml llvm_targets_LoongArch
 sys-devel/clang llvm_targets_LoongArch
 sys-devel/llvm llvm_targets_LoongArch
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index f84e98af64..a7996f8baf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -136,7 +136,6 @@ media-plugins/gst-plugins-meta libvisual
 # in particular need downstream changes).
 app-office/libreoffice clang
 <dev-db/postgresql-16 llvm
-<media-libs/mesa-22.3.0 llvm
 
 # WANG Xuerui <xen0n@gentoo.org> (2022-11-27)
 # LLVM toolchain now partially usable on loong, mask the remaining pieces
@@ -168,7 +167,6 @@ mate-base/mate help
 # virtual/{jdk,jre} is not available on loong yet.
 app-office/libreoffice libreoffice_extensions_scripting-beanshell libreoffice_extensions_scripting-javascript
 media-libs/rubberband jni
-www-client/chromium js-type-check
 
 # WANG Xuerui <xen0n@gentoo.org> (2022-05-13)
 # Fails testing at least with libssh-0.9.6 and mbedtls-2.28.0-r1, needs
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
index 589be7f7ad..398d7e3a4c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/use.mask
@@ -1,4 +1,4 @@
-# Copyright 2022 Gentoo Authors
+# Copyright 2022-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # WANG Xuerui <xen0n@gentoo.org> (2022-12-05)
@@ -41,9 +41,6 @@ webengine
 # Unmask the flag which corresponds to ARCH.
 -loong
 
-# Unmask systemd
--systemd
-
 # Things we actually can support
 -input_devices_synaptics
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.use.mask
index 0fac36b10e..45c9b819a1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/package.use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Stijn Tintel <stijn@linux-ipv6.be> (2023-02-02)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
index 1bbcb68e53..205311408f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/m68k/use.mask
@@ -1,13 +1,9 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -m68k
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2022-05-31)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # James Le Cuirot <chewi@gentoo.org> (2021-01-30)
 # GTK is not keyworded or tested.
 gtk
@@ -105,6 +101,7 @@ audit
 # Masking these globally, since we don't have X
 gnome
 gnome-keyring
+keyring
 nas
 
 # Masking since net-dns/avahi and net-misc/mDNSResponder are masked
@@ -132,7 +129,6 @@ djbfft
 djvu
 emacs
 emf
-gnome-keyring
 graphite
 guile
 hardened
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index 334b1af2af..dfaf83be4c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -154,7 +154,7 @@ dev-python/wxpython webkit
 
 # Markos Chandras <hwoarang@gentoo.org> (2014-01-05)
 # Perl is heavily unkeyworded on MIPS. See 497068
-dev-vcs/git mediawiki mediawiki-experimental
+dev-vcs/git mediawiki
 
 # Sergey Popov <pinkbyte@gentoo.org> (2013-09-02)
 # Not tested
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
index 409c8ea6b8..618df7c4de 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
@@ -21,10 +21,6 @@ tpm
 # rdma-core is not keyworded mips...
 rdma
 
-# Matt Turner <mattst88@gentoo.org> (2018-03-25)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Mart Raudsepp <leio@gentoo.org> (2018-02-11)
 # dev-util/valgrind is not keyworded here yet,
 # though the MIPS platform is supported upstream
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.force
index 2f00ba841d..58c2037315 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.force
@@ -1,10 +1,6 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2020-06-18)
-# Force host target
-dev-libs/keystone llvm_targets_PowerPC
-
 # Luke Dashjr <luke-jr+gentoobugs@utopios.org> (2019-09-21)
 # iasl is stable on ppc
 sys-firmware/seabios -binary
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index ebc5b4e0f9..48cb9bc991 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -258,10 +258,6 @@ x11-base/xorg-drivers video_cards_amdgpu
 # Missing keywords
 net-dns/unbound dnstap
 
-# Andreas K. Huettel <dilfridge@gentoo.org> (2015-02-15)
-# There's no keyworded office implementation anymore.
-gnome-extra/sushi office
-
 # Mark Wright <gienah@gentoo.org> (2014-12-14/2014-12-24, 2015-04-01)
 # test dependencies need keywording
 dev-haskell/dlist test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.mask
index ba036c8865..3b04d2d58c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-06)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-libs/pdal
+
 # Sergei Trofimovich <slyfox@gentoo.org> (2021-02-17)
 # Not ported to ppc32. See ALL_.*_SUPPORTED_ARCH
 # in compiler-rt/cmake/. Bug #708344
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 6a499ea8be..74d7992856 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,6 +1,19 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-19)
+# kde-frameworks/kwayland:5 is not keyworded here.
+app-crypt/pinentry wayland
+
+# Sam James <sam@gentoo.org> (2023-05-06)
+# sci-libs/vtk not keyworded here (+ lots of unkw'd deps), bug #778293
+sci-mathematics/maxima vtk
+
+# Sam James <sam@gentoo.org> (2023-05-06)
+# Broken bundled Eigen, fails to compile. See bug #865191.
+sci-geosciences/grass pdal
+sci-libs/vtk pdal
+
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not keyworded
 dev-python/nbval test
@@ -11,7 +24,7 @@ dev-ruby/mysql2 mysql
 
 # Sam James <sam@gentoo.org> (2023-01-05)
 # dev-python/pythran fails tests on ppc32 right now, bug #880263
-dev-python/scipy fortran pythran
+dev-python/scipy fortran
 
 # Sam James <sam@gentoo.org> (2022-12-26)
 # Unkeyworded dependencies
@@ -83,8 +96,6 @@ sci-mathematics/singular polymake
 # keep masks here (for now?).
 # Needs unkeyworded gnome-extra/sushi
 gnome-base/nautilus previewer
-# needs mail-client/evolution, depends on net-libs/webkit-gtk
-app-office/planner eds
 # needs gnome-extra/sushi, depends on net-libs/webkit-gtk
 gnome-base/nautilus previewer
 # needs libgdata[gnome-online-accounts], depends on net-libs/webkit-gtk
@@ -126,6 +137,7 @@ dev-python/diskcache test
 # media-libs/libavif isn't keyworded here
 media-libs/gd avif heif
 www-client/links avif
+dev-lang/php avif
 
 # Sam James <sam@gentoo.org> (2021-02-28)
 # compiler-rt* has no support for ppc32 (yet?)
@@ -212,10 +224,6 @@ sci-libs/gdal armadillo
 # kde-frameworks/*:5 not keyworded.
 net-irc/kvirc kde
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2016-06-28)
-# Missing keywords on app-text/gspell - bug #587368
->=app-editors/gedit-3.20 spell
-
 # James Le Cuirot <chewi@gentoo.org> (2015-01-12)
 # Java is no longer supported on ppc.
 app-text/texlive pdfannotextractor
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
index 8b56e5ee72..dfc84d5e81 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
@@ -1,4 +1,4 @@
-# Copyright 2008-2022 Gentoo Authors
+# Copyright 2008-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
@@ -35,7 +35,3 @@ java
 -clisp
 -ecls
 -sbcl
-
-# Pacho Ramos <pacho@gentoo.org> (2013-09-11)
-# Unmask systemd since it is keyworded here.
--systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.mask
index 101c6d9c58..dd7108999f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2019-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Craig Andrews <candrews@gentoo.org> (2023-03-09)
+# media-libs/libplacebo is keyworded here
+media-video/ffmpeg -libplacebo
+
 # Joonas Niilola <juippis@gentoo.org> (2022-11-10)
 # Doesn't work on ppc64, #871921
 sci-mathematics/gmp-ecm custom-tune
@@ -65,7 +69,3 @@ media-video/vlc -libplacebo
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2019-08-14)
 # works on ppc64le
 media-libs/mesa -llvm -video_cards_radeonsi
-
-# Craig Andrews <candrews@gentoo.org> (2023-03-09)
-# media-libs/libplacebo is keyworded here
-media-video/ffmepg -libplacebo
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.mask
index c4a6c015a8..707fc0aa40 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Georgy Yakovlev (2022-02-16)
@@ -12,7 +12,7 @@ dev-lang/python-exec -python_targets_pypy3
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-07-27)
 # deps not keyworded
-media-gfx/gnome-photos flickr upnp-av
+media-gfx/gnome-photos upnp-av
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2021-07-27)
 # deps not keyworded
@@ -40,7 +40,6 @@ dev-lang/spidermonkey clang
 mail-client/thunderbird clang
 <www-client/firefox-104 clang
 
-
 # James Le Cuirot <chewi@gentoo.org> (2020-04-23)
 # Requires media-libs/mesa[llvm], which is masked.
 dev-python/pyopengl test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index 45cbf8086e..d21d9c6938 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -165,10 +165,6 @@ net-irc/kvirc kde
 app-arch/p7zip kde
 dev-vcs/subversion kwallet
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2016-06-28)
-# Missing keywords on app-text/gspell - bug #587368
->=app-editors/gedit-3.20 spell
-
 # Patrice Clement <monsieurp@gentoo.org> (2016-02-08)
 # I would need to keyword an awful lot of packages on ppc64
 # that would need Java 7 otherwise.
@@ -189,11 +185,6 @@ games-simulation/openttd openmedia
 # Masking USE-dep on it
 sys-cluster/vzctl ploop
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
-# requires app-office/unoconv, which requires virtual/ooo, which is not
-# keyworded here. Remove mask if this situation changes.
-gnome-extra/sushi office
-
 # Kacper Kowalik <xarthisius@gentoo.org> (2011-09-02)
 # Mask www-client/seamonkey[ipc] on ppc64 wrt #381191
 www-client/seamonkey ipc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/use.mask
index ef203e88e2..e4ee2f94b6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/use.mask
@@ -32,7 +32,3 @@ battery
 
 # Unmask the flag for Playstation 3
 -ps3
-
-# Michał Górny <mgorny@gentoo.org> (2013-05-04)
-# Unmask systemd since it is keyworded here.
--systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
index cfff2f28c2..ac70255b3d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # PPC Specific use flags
@@ -127,7 +127,3 @@ nvtt
 
 # fdk-aac is already keyworded here
 -fdk
-
-# Pacho Ramos <pacho@gentoo.org> (2014-01-08)
-# Unmask systemd since it is keyworded here.
--systemd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index 0891cb8df2..e8befb84ff 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 2019-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-10)
+# sys-cluster/ceph not keyworded here
+sys-block/tgt rbd
+
 # jinqiang zhang <peeweep@0x0.ee> (2023-03-27)
 # Sanitizers supported on this architecture.
 sys-libs/compiler-rt-sanitizers -asan -lsan
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
index d9d54fb8a7..1c381636e5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/use.mask
@@ -1,12 +1,9 @@
-# Copyright 2019-2022 Gentoo Authors
+# Copyright 2019-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -riscv
 
-# Unmask systemd
--systemd
-
 # matoro <matoro_gentoo@matoro.tk> (2022-09-29)
 # dev-util/google-perftools is supported here
 -tcmalloc
@@ -41,9 +38,6 @@ mono
 # No proper support for this arch yet
 java
 
-# Neither the virtual nor any of the runtimes (except mesa) keyworded here yet
-opencl
-
 # not supported / tested cards
 
 video_cards_ast
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index b4a4aa7316..41ac083218 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-01)
+# media-libs/libjxl is not keyworded
+# bug https://bugs.gentoo.org/853628
+media-gfx/gimp jpegxl
+media-gfx/graphicsmagick jpegxl
+media-gfx/imagemagick jpegxl
+media-libs/imlib2 jpegxl
+
 # Conrad Kostecki <conikost@gentoo.org> (2023-04-23)
 # Needs dev-perl/Math-Int64 which is not keyworded
 dev-perl/IP-Country-DB_File test
@@ -27,9 +35,7 @@ dev-ruby/stringex test
 # Sam James <sam@gentoo.org> (2022-04-26)
 # eps: app-text/libspectre not keyworded here
 # heif: media-libs/libheif not keyworded here
-# jpegxl: libjxl not keyworded here
-media-libs/imlib2 eps heif jpegxl
-media-gfx/imagemagick jpegxl
+media-libs/imlib2 eps heif
 
 # Sam James <sam@gentoo.org> (2022-04-26)
 # Avoid unkeyworded dependencies
@@ -90,6 +96,7 @@ media-libs/libcanberra sound
 media-libs/gd avif heif
 media-gfx/graphicsmagick heif
 www-client/links avif
+dev-lang/php avif
 
 # Sam James <sam@gentoo.org> (2022-04-24)
 # Unkeyworded dev-tcltk/* dependencies
@@ -118,7 +125,7 @@ media-video/ffmpeg vmaf
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Avoid keywording unnecessary depenencies for now, bug #804115
-dev-python/scipy pythran
+dev-python/scipy fortran
 
 # Matt Turner <mattst88@gentoo.org> (2021-06-10)
 # dev-python/django is not keyworded here
@@ -145,7 +152,6 @@ app-editors/vim lua
 media-gfx/imagemagick raw
 dev-db/mariadb numa
 # not tested yet
-app-misc/mc samba
 app-arch/rpm test
 # no ceph keyworded
 net-analyzer/rrdtool rados
@@ -164,7 +170,7 @@ app-portage/layman g-sorcery
 
 # Mikle Kolyada <zlogene@gentoo.org> (2014-01-11)
 # too much unkeyworded dependencies (bug #497068)
-dev-vcs/git mediawiki mediawiki-experimental
+dev-vcs/git mediawiki
 
 # Agostino Sarubbo <ago@gentoo.org< (2013-04-10)
 # It requires too much unstable dep.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
index c327a57d7c..aefa28077c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/use.mask
@@ -1,13 +1,9 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Unmask the flag which corresponds to ARCH.
 -s390
 
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2022-05-20)
-# Keyworded here
--systemd
-
 # Sam James <sam@gentoo.org> (2022-04-26)
 # dev-libs/mongo-c-driver not keyworded here
 mongodb
@@ -47,10 +43,6 @@ lua_targets_luajit
 luajit
 luajittex
 
-# Matt Turner <mattst88@gentoo.org> (2019-12-05)
-# media-libs/libglvnd is not keyworded
-libglvnd
-
 # Stuff we don't want/not tested
 R
 octave
@@ -103,6 +95,7 @@ gtk2
 gtk3
 gnome
 gnome-keyring
+keyring
 
 diet
 m17n-lib
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 612843e5b5..82891f1896 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,19 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Arsen Arsenović <arsen@gentoo.org> (2023-05-17)
+# app-emulation/libguestfs pulls in a large amount of dependencies, most
+# of which aren't or can't be kw'd on SPARC.
+sys-block/nbdkit libguestfs
+
+# Arsen Arsenović <arsen@gentoo.org> (2023-05-14)
+# dev-lang/go doesn't work on SPARC.
+sys-libs/libnbd go
+
+# Sam James <sam@gentoo.org> (2023-05-10)
+# sys-cluster/ceph not keyworded here
+sys-block/tgt rbd
+
 # Sam James <sam@gentoo.org> (2023-04-14)
 # Needs dev-python/sympy which is not keyworded
 dev-python/nbval test
@@ -14,10 +27,6 @@ dev-python/pymysql test
 dev-python/nbval doc
 dev-python/nbclassic doc
 
-# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-03-07)
-# nbdime webtools require nodejs which is not keyworded here yet
-dev-python/nbdime webtools
-
 # Stijn Tintel <stijn@linux-ipv6.be> (2023-02-02)
 # Dependency not keyworded
 # https://bugs.gentoo.org/show_bug.cgi?id=892389
@@ -105,7 +114,7 @@ app-admin/conky lua-rsvg
 
 # Sam James <sam@gentoo.org> (2021-11-05)
 # Avoid keywording unnecessary depenencies for now, bug #804115
-dev-python/scipy pythran
+dev-python/scipy fortran
 
 # Sam James <sam@gentoo.org> (2021-10-16)
 # Requires dev-db/mariadb which, at last check, was broken on sparc.
@@ -167,6 +176,7 @@ media-libs/gd avif heif
 net-libs/webkit-gtk avif
 media-gfx/graphicsmagick heif
 www-client/links avif
+dev-lang/php avif
 
 # Sam James <sam@gentoo.org> (2021-02-26)
 # dev-libs/efl not keyworded here
@@ -431,14 +441,6 @@ net-dns/bind dnstap
 # networkmanager USE masked due to missing keywords
 gnome-extra/nm-applet teamd
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2016-06-28)
-# Missing keywords on app-text/gspell - bug #587368
->=app-editors/gedit-3.20 spell
-
-# Pacho Ramos <pacho@gentoo.org> (2016-02-20)
-# Missing keywords, bug #551580
-app-office/planner eds
-
 # Pacho Ramos <pacho@gentoo.org> (2016-01-31)
 # Missing keywords, bug #560382
 media-video/ffmpeg snappy
@@ -470,6 +472,10 @@ net-mail/dovecot lz4
 # Requires wifi USE flag, which is masked for this arch
 net-misc/networkmanager wext
 
+# Marius Brehler <marfbre@linux.sungazer.de> (2015-08-13)
+# missing keyword
+>=sci-misc/boinc-7.4.42-r1 X
+
 # Pacho Ramos <pacho@gentoo.org> (2015-06-13)
 # Missing keywords, bug #513108
 net-misc/spice-gtk smartcard webdav
@@ -517,10 +523,6 @@ net-misc/modemmanager mbim
 # Missing keywords, bug #495250
 >=gnome-base/gnome-extra-apps-3.10 tracker
 
-# Raúl Porcel <armin76@gentoo.org> (2014-02-01)
-# Sigbuses
-net-misc/openssh hpn
-
 # Pacho Ramos <pacho@gentoo.org> (2014-01-19)
 # Missing keywords, bug #478254
 gnome-base/gnome classic extras
@@ -553,11 +555,6 @@ net-misc/modemmanager qmi
 # remove mask if/when media-gfx/argyllcms is keywored here.
 x11-misc/colord argyllcms extra-print-profiles
 
-# Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
-# requires app-office/unoconv, which requires virtual/ooo, which is not
-# keyworded here. Remove mask if this situation changes.
-gnome-extra/sushi office
-
 # Raúl Porcel <armin76@gentoo.org> (2012-12-30)
 # Needs testing
 media-libs/phonon gstreamer vlc
@@ -622,13 +619,6 @@ media-libs/sdl-sound mikmod
 # Needs krb4 USE flag for mit-krb5 (Bug #255579), and we believe it to be unstable.
 net-im/pidgin zephyr
 
-# Mask srtp for ortp because libsrtp is marked -sparc
-net-libs/ortp srtp
-
 # Ultrabug <ultrabug@gentoo.org> (2011-09-05)
 # missing keyword for net-libs/zeromq
 app-admin/rsyslog zeromq
-
-# Marius Brehler <marfbre@linux.sungazer.de> (2015-08-13)
-# missing keyword
->=sci-misc/boinc-7.4.42-r1 X
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
index db24b722f9..321ddb3a64 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
@@ -242,10 +242,6 @@ unwind
 # sys-devel/llvm is not keyworded, bug #320221
 llvm
 
-# Pacho Ramos <pacho@gentoo.org> (2014-01-19)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # sys-libs/libseccomp has not been ported to this arch yet #524148
 seccomp
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
index 90f7069f2f..868e5ba455 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
@@ -4,10 +4,6 @@
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in use.mask
 
-# Matt Turner <mattst88@gentoo.org> (2022-09-16)
-# gui-libs/gtk is not stable here
-gtk4
-
 # Sam James <sam@gentoo.org> (2021-04-27)
 # Clang and friends aren't (yet?) stable on sparc
 clang
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
index dc1d37b816..e15ff225dc 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
@@ -11,7 +11,6 @@ dev-python/PyQtWebEngine
 app-admin/calamares
 app-doc/zeal
 app-editors/ghostwriter
-app-editors/notepadqq
 app-editors/retext
 app-misc/anki
 app-office/kalendar:5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.force
index 25906d7385..6cca49d603 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.force
@@ -18,10 +18,6 @@ www-client/firefox system-libvpx
 dev-java/openjdk:11 -system-bootstrap
 dev-java/openjdk:17 -system-bootstrap
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2020-06-18)
-# Force host target
-dev-libs/keystone llvm_targets_X86
-
 # Michał Górny <mgorny@gentoo.org> (2017-12-30)
 # We have ready-to-use configs here.
 sys-kernel/gentoo-kernel -savedconfig
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index dbb783f113..47e4da6674 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,10 +1,26 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Anna Vyalkova <cyber+gentoo@sysrq.in> (2023-05-20)
+# net-libs/libomemo-c is not keyworded for ~x86.
+net-libs/qxmpp omemo
+
+# Joonas Niilola <juippis@gentoo.org> (2023-05-16)
+# Doesn't work on x86. #878445
+net-libs/pjproject webrtc
+
+# Matt Turner <mattst88@gentoo.org> (2023-05-12)
+# Likely untested upstream. Not worth the hassle.
+>=media-libs/mesa-23.1 opencl
+
 # Ionen Wolkens <ionen@gentoo.org> (2023-03-30)
 # Needs x11-drivers/nvidia-drivers which is no longer available here.
 media-tv/mythtv nvdec
 
+# Craig Andrews <candrews@gentoo.org> (2023-03-09)
+# media-libs/libplacebo is keyworded here
+media-video/ffmpeg -libplacebo
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2023-02-06)
 # Successful build of dev-qt/qtwebengine depends on 64-bit host
 # Bug #893234
@@ -185,10 +201,6 @@ sys-block/fio -io-uring -zbc
 # Unmask globally-masked flashrom drivers and tools which do work on x86
 sys-apps/flashrom -atahpt -atapromise -atavia -drkaiser -gfxnvidia -internal -it8212 -nic3com -nicintel -nicintel-eeprom -nicintel-spi -nicnatsemi -nicrealtek -ogp-spi -rayer-spi -satamv -satasii -tools
 
-# Christopher Head <chead@chead.ca> (2020-06-10)
-# Requires dev-db/influxdb which is amd64-only
-dev-python/influxdb test
-
 # Mikle Kolyada <zlogene@gentoo.org> (2020-06-08)
 # clisp is keyworded on x86
 app-text/texlive-core -xindy
@@ -456,7 +468,3 @@ media-gfx/iscan -X
 
 # Steve Dibb <beandog@gentoo.org> (2008-09-29)
 media-video/mplayer -cpudetection
-
-# Craig Andrews <candrews@gentoo.org> (2023-03-09)
-# media-libs/libplacebo is keyworded here
-media-video/ffmepg -libplacebo
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
index c3f90515ea..80bda00184 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
@@ -48,10 +48,6 @@ webengine
 -python_targets_pypy3
 -python_single_target_pypy3
 
-# Michał Górny <mgorny@gentoo.org> (2013-05-04)
-# Unmask systemd since it is keyworded here.
--systemd
-
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # keyworded on x86
 -clisp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
index d7ebad36ea..f227acf07c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/make.defaults
@@ -6,18 +6,17 @@
 
 # Profile IUSE injection (applies only to ebuilds which use EAPI 5 or later)
 IUSE_IMPLICIT="prefix prefix-guest prefix-stack"
-USE_EXPAND_IMPLICIT="ELIBC KERNEL USERLAND"
+USE_EXPAND_IMPLICIT="ELIBC KERNEL"
 USE_EXPAND_VALUES_ELIBC="bionic Cygwin Darwin glibc mingw musl SunOS Winnt"
 USE_EXPAND_VALUES_KERNEL="Darwin linux SunOS Winnt"
-USE_EXPAND_VALUES_USERLAND="BSD GNU"
 
 # Env vars to expand into USE vars.  Modifying this requires prior
 # discussion on gentoo-dev@lists.gentoo.org.
-USE_EXPAND="ABI_MIPS ABI_S390 ABI_X86 ADA_TARGET ALSA_CARDS AMDGPU_TARGETS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86 CURL_SSL ELIBC FFTOOLS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL L10N LCD_DEVICES LIBREOFFICE_EXTENSIONS LLVM_TARGETS LUA_SINGLE_TARGET LUA_TARGETS MONKEYD_PLUGINS NGINX_MODULES_HTTP NGINX_MODULES_MAIL NGINX_MODULES_STREAM OFFICE_IMPLEMENTATION OPENMPI_FABRICS OPENMPI_OFED_FEATURES OPENMPI_RM PHP_TARGETS POSTGRES_TARGETS PYTHON_SINGLE_TARGET PYTHON_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS ROS_MESSAGES RUBY_TARGETS SANE_BACKENDS USERLAND UWSGI_PLUGINS VIDEO_CARDS VOICEMAIL_STORAGE XTABLES_ADDONS"
+USE_EXPAND="ABI_MIPS ABI_S390 ABI_X86 ADA_TARGET ALSA_CARDS AMDGPU_TARGETS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86 CURL_SSL ELIBC FFTOOLS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL L10N LCD_DEVICES LIBREOFFICE_EXTENSIONS LLVM_TARGETS LUA_SINGLE_TARGET LUA_TARGETS MONKEYD_PLUGINS NGINX_MODULES_HTTP NGINX_MODULES_MAIL NGINX_MODULES_STREAM OFFICE_IMPLEMENTATION OPENMPI_FABRICS OPENMPI_OFED_FEATURES OPENMPI_RM PHP_TARGETS POSTGRES_TARGETS PYTHON_SINGLE_TARGET PYTHON_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS ROS_MESSAGES RUBY_TARGETS SANE_BACKENDS UWSGI_PLUGINS VIDEO_CARDS VOICEMAIL_STORAGE XTABLES_ADDONS"
 
 # USE_EXPAND variables whose contents are not shown in package manager
 # output. Changes need discussion on gentoo-dev.
-USE_EXPAND_HIDDEN="USERLAND KERNEL ELIBC ABI_MIPS ABI_S390 ABI_X86 CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86"
+USE_EXPAND_HIDDEN="KERNEL ELIBC ABI_MIPS ABI_S390 ABI_X86 CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86"
 
 CONFIG_PROTECT="/etc"
 CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf"
@@ -47,12 +46,11 @@ ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY CARGO_HOME GDK_PIXBUF_MODULE_FILE XA
 
 # Variables that are set exclusively by the profile
 # and not by user configuration files.
-PROFILE_ONLY_VARIABLES="${PROFILE_ONLY_VARIABLES} ELIBC IUSE_IMPLICIT KERNEL USERLAND USE_EXPAND_IMPLICIT USE_EXPAND_UNPREFIXED USE_EXPAND_VALUES_ELIBC USE_EXPAND_VALUES_KERNEL USE_EXPAND_VALUES_USERLAND"
+PROFILE_ONLY_VARIABLES="${PROFILE_ONLY_VARIABLES} ELIBC IUSE_IMPLICIT KERNEL USE_EXPAND_IMPLICIT USE_EXPAND_UNPREFIXED USE_EXPAND_VALUES_ELIBC USE_EXPAND_VALUES_KERNEL"
 
 # 'Sane' defaults
 ELIBC="glibc"
 KERNEL="linux"
-USERLAND="GNU"
 INPUT_DEVICES="libinput"
 
 # Accept only licenses in the FREE license group, i.e., with
@@ -129,12 +127,12 @@ PYTHONDONTWRITEBYTECODE="1"
 # This MUST be kept in sync with the PYTHON_TARGETS below
 # Mike Gilbert <floppym@gentoo.org> (2018-05-23)
 # sys-apps/baselayout-2.5 needs split-usr enabled.
-BOOTSTRAP_USE="unicode internal-glib pkg-config split-usr xml python_targets_python3_10"
+BOOTSTRAP_USE="unicode internal-glib pkg-config split-usr xml python_targets_python3_11"
 
 # Mike Gilbert <floppym@gentoo.org> (2012-05-15)
 # Default target(s) for python-r1.eclass
-PYTHON_TARGETS="python3_10"
-PYTHON_SINGLE_TARGET="python3_10"
+PYTHON_TARGETS="python3_11"
+PYTHON_SINGLE_TARGET="python3_11"
 
 # Michał Górny <mgorny@gentoo.org> (2013-08-10)
 # Moved from portage's make.globals.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 943f70b314..d02c5ebecc 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -84,7 +84,6 @@ app-arch/unzip unicode
 app-arch/zip unicode
 sys-apps/util-linux unicode
 sys-process/procps unicode
-www-client/lynx unicode
 #
 # b) using libidn
 app-text/ghostscript-gpl unicode
@@ -176,7 +175,6 @@ sys-firmware/seabios binary
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2018-09-11)
 # All glibc versions that include RPC code are masked now.
 net-analyzer/snort libtirpc
-net-firewall/conntrack-tools libtirpc
 net-fs/autofs libtirpc
 net-misc/netkit-bootparamd libtirpc
 sci-astronomy/esomidas libtirpc
@@ -209,7 +207,6 @@ app-shells/bash:0 readline
 # Michał Górny <mgorny@gentoo.org> (2012-10-14)
 # Force-enable all PYTHON_TARGETS for python-exec to avoid using private
 # API. Please remember to keep it in sync with python_targets.desc.
-dev-lang/python-exec python_targets_python3_9
 dev-lang/python-exec python_targets_python3_10
 dev-lang/python-exec python_targets_python3_11
 dev-lang/python-exec python_targets_pypy3
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 3b6308459f..2625b69bfa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,18 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Joonas Niilola <juippis@gentoo.org> (2023-05-07)
+# Doesn't compile, see #894210.
+dev-libs/log4cxx smtp
+
+# Mike Gilbert <floppym@gentoo.org> (2023-05-04)
+# Requires unreleased >media-libs/libaom-3.6.0.
+>=www-client/chromium-113 system-av1
+
+# Sam James <sam@gentoo.org> (2023-05-01)
+# Doc building is broken with Python 3.11. See https://github.com/ukoethe/vigra/issues/529.
+media-libs/vigra doc
+
 # Sam James <sam@gentoo.org> (2023-04-17)
 # Ruby has several JITs available but they need porting to individual arches.
 # Unmask on specific arches where it's available.
@@ -74,10 +86,6 @@ media-gfx/kphotoalbum qtav
 # Fails to compile: https://github.com/libffi/libffi/issues/760
 dev-libs/libffi exec-static-trampoline
 
-# Sam James <sam@gentoo.org> (2023-01-10)
-# Needs last-rited www-client/dillo, bug #890244
-mail-client/claws-mail dillo
-
 # Joonas Niilola <juippis@gentoo.org> (2023-01-08)
 # Doesn't compile currently, bug #853094.
 >=net-dialup/freeradius-3.2.0 oracle
@@ -125,10 +133,6 @@ x11-wm/stumpwm doc
 # Particularly unwise given it parses data from network.
 net-libs/libproxy spidermonkey
 
-# Pascal Jäger <pascal.jaeger@leimstift.de> (2022-11-24)
-# Metamail last rited
-app-text/crm114 mimencode
-
 # Guillermo Joandet <gjoandet@gmail.com> (2022-11-22)
 # app-text/pandoc is not keyworded on most architectures
 net-libs/gssdp man
@@ -161,7 +165,6 @@ dev-python/pyotherside qt6
 # Mask the flag for now
 # Bugs: #643466, #674872, #832161, #855722
 app-emulation/virtualbox pax-kernel
-app-emulation/virtualbox-modules pax-kernel
 
 # Sam James <sam@gentoo.org> (2022-10-02)
 # USE=compat / possibly allowing sys-libs/zlib needs to be figured out,
@@ -243,10 +246,6 @@ sys-libs/ncurses stack-realign
 # Not ready for general use.
 >=www-client/chromium-104 pgo
 
-# Michał Górny <mgorny@gentoo.org> (2022-05-25)
-# dev-python/sphinxcontrib-openapi is masked for removal.
-dev-python/jupyter-server doc
-
 # Joonas Niilola <juippis@gentoo.org> (2022-05-03)
 # system-python-libs is HIGHLY EXPERIMENTAL according to upstream, and
 # still being worked on in Gentoo.
@@ -373,10 +372,6 @@ dev-lang/gnat-gpl:10 lto
 # Avoid running failing tests by default.
 sys-kernel/dracut test
 
-# Michał Górny <mgorny@gentoo.org> (2021-05-31)
-# Requires Python 3.7 and old SciPy.
-<sys-cluster/ceph-16 diskprediction
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2021-05-09)
 # Dependency requires sys-apps/systemd. Will only be unmasked in systemd target.
 kde-plasma/plasma-meta firewall
@@ -452,11 +447,6 @@ net-wireless/gr-osmosdr xtrx
 # app-text/ots is masked for removal.  Bug #648964.
 app-office/abiword ots
 
-# Matt Turner <mattst88@gentoo.org> (2020-12-05)
-# Relies on gtkdoc-mktmpl which was removed from gtk-doc-1.26
-# Bug #740690
-x11-libs/colord-gtk doc
-
 # Michał Górny <mgorny@gentoo.org> (2020-12-04)
 # Mask the experimental targets in release ebuilds.
 # Note to self: remember to move still-applicable masks to the newer
@@ -546,10 +536,6 @@ sci-physics/root cudnn
 mail-client/thunderbird eme-free
 www-client/firefox eme-free
 
-# Rick Farina <zerochaos@gentoo.org> (2020-02-26)
-# dev-python/pyzmq USE=doc deps are not met with python2_7
-dev-python/pyzmq doc
-
 # Alexey Shvetsov <alexxy@gentoo.org> (2019-12-24)
 # Gromacs python module install br0ken
 sci-chemistry/gromacs python
@@ -566,7 +552,6 @@ sci-mathematics/gsl-shell fox
 # using any-r1 API to build docs or cond-deps.
 dev-python/matplotlib doc
 dev-python/pandas doc
-dev-python/pandas-datareader doc
 dev-python/statsmodels doc
 
 # Haelwenn (lanodan) Monnier <contact@hacktivis.me> (2019-12-01)
@@ -585,7 +570,7 @@ dev-python/statsmodels doc
 net-libs/ngtcp2 ssl
 net-misc/curl nghttp3
 
-# Thomas Deutschmann <whissi88@gentoo.org> (2019-09-02)
+# Thomas Deutschmann <whissi@gentoo.org> (2019-09-02)
 # PGO not yet supported for comm-central, bug #693160
 >=mail-client/thunderbird-68 pgo
 
@@ -684,7 +669,6 @@ virtual/mysql embedded
 
 # Brian Evans <grknight@gentoo.org> (2018-02-28)
 # Mask client-libs USE to force users to install alternative standard pacakges
-dev-db/mariadb client-libs
 dev-db/mysql client-libs
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2018-02-02)
@@ -807,10 +791,6 @@ media-libs/cogl gstreamer
 # gentoo bugs.
 media-libs/libsdl2 custom-cflags
 
-# Chí-Thanh Christopher Nguyễn <chithanh@gentoo.org> (2013-07-13)
-# GL/GLES support in cairo is mutually exclusive, bug #428770.
-x11-libs/cairo gles2-only
-
 # Kacper Kowalik <xarthisius@gentoo.org> (2013-05-19)
 # Fails to build, haven't had time to debug
 app-doc/doxygen sqlite
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index 1ff56a55ee..1e9ae51033 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -4,6 +4,10 @@
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in package.use.mask
 
+# Mike Gilbert <floppym@gentoo.org> (2023-04-30)
+# Requires llvm-16.
+www-client/chromium libcxx lto pgo
+
 # Alfredo Tupone <tupone@gentoo.org> (2023-04-02)
 # For doc, dev-python/sphinxcontrib-bibtex is required
 sci-mathematics/why3-for-spark doc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.force b/sdk_container/src/third_party/portage-stable/profiles/base/use.force
index d51d6c2ea5..fa5f73a673 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.force
@@ -1,17 +1,11 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Matt Turner <mattst88@gentoo.org> (2020-08-11)
-# Force USE=libglvnd in order to mask app-eselect/eselect-opengl for removal.
-# This USE flag will be removed completely in the near future. Bug #728286
-libglvnd
-
 # Mike Gilbert <floppym@gentoo.org> (2019-07-20)
 # Disabling this requires a migration to be performed.
 split-usr
 
-# Force the GNU/Linux ELIBC, KERNEL, and USERLAND
+# Force the GNU/Linux ELIBC and KERNEL
 # flags that apply to the majority of profiles.
 elibc_glibc
 kernel_linux
-userland_GNU
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
index 07ade179a4..f6587acbec 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
@@ -61,9 +61,6 @@ packagekit
 selinux
 multilib
 
-# Mask ELIBC, KERNEL, and USERLAND flags that apply to specific profiles.
-userland_BSD
-
 elibc_bionic
 elibc_Cygwin
 elibc_Darwin
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv6j/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv6j/parent
index f3229c5b98..7648ec7e7c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv6j/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv6j/parent
@@ -1 +1,2 @@
 ..
+../../../../../../arch/arm/armv6j
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv7a/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv7a/parent
index f3229c5b98..b70a1c7bef 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv7a/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/17.0/musl/armv7a/parent
@@ -1 +1,2 @@
 ..
+../../../../../../arch/arm/armv7a
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv6j/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv6j/parent
index f3229c5b98..7648ec7e7c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv6j/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv6j/parent
@@ -1 +1,2 @@
 ..
+../../../../../../arch/arm/armv6j
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv7a/parent b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv7a/parent
index f3229c5b98..b70a1c7bef 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv7a/parent
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/arm/23.0/musl/armv7a/parent
@@ -1 +1,2 @@
 ..
+../../../../../../arch/arm/armv7a
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
index f9eab8d33a..e47f6172b1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/apache2_modules.desc
@@ -92,6 +92,7 @@ socache_shmcb - A shared object cache provider using a high-performance cyclic b
 speling - Attempts to correct mistaken URLs that users might have entered by ignoring capitalization and by allowing up to one misspelling
 status - Provides information on server activity and performance
 substitute - Perform search and replace operations on response bodies
+tls - mod_tls TLS module for Apache, intended to replace mod_ssl
 unique_id - Provides an environment variable with a unique identifier for each request
 unixd - Basic (required) security for Unix-family platforms
 userdir - User-specific directories
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
index e0f1bed263..d931638828 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_single_target.desc
@@ -3,7 +3,6 @@
 
 # This file contains descriptions of PYTHON_SINGLE_TARGET USE_EXPAND flags.
 
-python3_9 - Build for Python 3.9 only
 python3_10 - Build for Python 3.10 only
 python3_11 - Build for Python 3.11 only
 pypy3 - Build for PyPy3 only
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
index 7b5841ecd4..bb38d02367 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/desc/python_targets.desc
@@ -3,7 +3,6 @@
 
 # This file contains descriptions of PYTHON_TARGETS USE_EXPAND flags.
 
-python3_9 - Build with Python 3.9
 python3_10 - Build with Python 3.10
 python3_11 - Build with Python 3.11
 pypy3 - Build with PyPy3
diff --git a/sdk_container/src/third_party/portage-stable/profiles/desc/userland.desc b/sdk_container/src/third_party/portage-stable/profiles/desc/userland.desc
deleted file mode 100644
index 3b3ed55d46..0000000000
--- a/sdk_container/src/third_party/portage-stable/profiles/desc/userland.desc
+++ /dev/null
@@ -1,9 +0,0 @@
-# Copyright 1999-2006 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-# This file contains descriptions of USERLAND USE_EXPAND flags.
-
-# Keep it sorted.
-
-GNU - USERLAND setting for systems that use the GNU userland tools
-BSD - USERLAND setting for systems using BSDish userland (FreeBSD OpenBSD NetBSD DragonFly)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/embedded/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/embedded/make.defaults
index 5b6dc2b406..fd59da1054 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/embedded/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/embedded/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 2008-2022 Gentoo Authors
+# Copyright 2008-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 USE="kdrive minimal multicall zlib"
@@ -16,29 +16,27 @@ PORTAGE_ECLASS_WARNING_ENABLE="0"
 INPUT_DEVICES="evdev"
 VIDEO_CARDS="fbdev"
 KERNEL="linux"
-USERLAND="GNU"
 LINGUAS="en"
 
 # Profile IUSE injection (applies only to ebuilds which use EAPI 5 or later)
 IUSE_IMPLICIT="prefix prefix-guest prefix-stack"
 USE_EXPAND_UNPREFIXED="ARCH"
-USE_EXPAND_IMPLICIT="ARCH ELIBC KERNEL USERLAND"
+USE_EXPAND_IMPLICIT="ARCH ELIBC KERNEL"
 USE_EXPAND_VALUES_ARCH="alpha amd64 amd64-linux arm arm64 hppa ia64 loong m68k mips ppc ppc64 ppc64-linux ppc-macos riscv s390 sparc sparc64-solaris sparc-solaris x64-cygwin x64-macos x64-solaris x64-winnt x86 x86-linux x86-solaris x86-winnt"
 USE_EXPAND_VALUES_ELIBC="bionic Cygwin Darwin glibc mingw musl SunOS Winnt"
 USE_EXPAND_VALUES_KERNEL="Darwin linux SunOS Winnt"
-USE_EXPAND_VALUES_USERLAND="BSD GNU"
 
 # Env vars to expand into USE vars.  Modifying this requires prior
 # discussion on gentoo-dev@lists.gentoo.org.
-USE_EXPAND="ABI_MIPS ABI_S390 ABI_X86 ADA_TARGET ALSA_CARDS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86 CURL_SSL ELIBC FFTOOLS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL L10N LCD_DEVICES LIBREOFFICE_EXTENSIONS LLVM_TARGETS LUA_SINGLE_TARGET LUA_TARGETS MONKEYD_PLUGINS NGINX_MODULES_HTTP NGINX_MODULES_MAIL NGINX_MODULES_STREAM OFFICE_IMPLEMENTATION OPENMPI_FABRICS OPENMPI_OFED_FEATURES OPENMPI_RM PHP_TARGETS POSTGRES_TARGETS PYTHON_SINGLE_TARGET PYTHON_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS ROS_MESSAGES RUBY_TARGETS SANE_BACKENDS USERLAND UWSGI_PLUGINS VIDEO_CARDS VOICEMAIL_STORAGE XTABLES_ADDONS"
+USE_EXPAND="ABI_MIPS ABI_S390 ABI_X86 ADA_TARGET ALSA_CARDS APACHE2_MODULES APACHE2_MPMS CALLIGRA_FEATURES CAMERAS COLLECTD_PLUGINS CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86 CURL_SSL ELIBC FFTOOLS GPSD_PROTOCOLS GRUB_PLATFORMS INPUT_DEVICES KERNEL L10N LCD_DEVICES LIBREOFFICE_EXTENSIONS LLVM_TARGETS LUA_SINGLE_TARGET LUA_TARGETS MONKEYD_PLUGINS NGINX_MODULES_HTTP NGINX_MODULES_MAIL NGINX_MODULES_STREAM OFFICE_IMPLEMENTATION OPENMPI_FABRICS OPENMPI_OFED_FEATURES OPENMPI_RM PHP_TARGETS POSTGRES_TARGETS PYTHON_SINGLE_TARGET PYTHON_TARGETS QEMU_SOFTMMU_TARGETS QEMU_USER_TARGETS ROS_MESSAGES RUBY_TARGETS SANE_BACKENDS UWSGI_PLUGINS VIDEO_CARDS VOICEMAIL_STORAGE XTABLES_ADDONS"
 
 # USE_EXPAND variables whose contents are not shown in package manager
 # output. Changes need discussion on gentoo-dev.
-USE_EXPAND_HIDDEN="USERLAND KERNEL ELIBC ABI_MIPS ABI_S390 ABI_X86 CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86"
+USE_EXPAND_HIDDEN="KERNEL ELIBC ABI_MIPS ABI_S390 ABI_X86 CPU_FLAGS_ARM CPU_FLAGS_PPC CPU_FLAGS_X86"
 
 # Variables that are set exclusively by the profile
 # and not by user configuration files.
-PROFILE_ONLY_VARIABLES="IUSE_IMPLICIT USERLAND USE_EXPAND_IMPLICIT USE_EXPAND_UNPREFIXED USE_EXPAND_VALUES_ARCH USE_EXPAND_VALUES_ELIBC USE_EXPAND_VALUES_KERNEL USE_EXPAND_VALUES_USERLAND"
+PROFILE_ONLY_VARIABLES="IUSE_IMPLICIT USE_EXPAND_IMPLICIT USE_EXPAND_UNPREFIXED USE_EXPAND_VALUES_ARCH USE_EXPAND_VALUES_ELIBC USE_EXPAND_VALUES_KERNEL"
 
 # Accept only licenses in the FREE license group, i.e., with
 # the freedom to use, share, modify and share modifications
diff --git a/sdk_container/src/third_party/portage-stable/profiles/embedded/use.force b/sdk_container/src/third_party/portage-stable/profiles/embedded/use.force
index 5885fddb45..c03a3a61ad 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/embedded/use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/embedded/use.force
@@ -1,2 +1 @@
 kernel_linux
-userland_GNU
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
index 22dd9672ac..ec3d7e42cd 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.mask
@@ -1,6 +1,10 @@
 # Copyright 2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# matoro <matoro_gentoo@matoro.tk> (2023-05-05)
+# Test failures on BE (https://github.com/sekrit-twc/zimg/pull/156)
+media-libs/zimg
+
 # matoro <matoro_gentoo@matoro.tk> (2023-04-11)
 # Test failures on BE (#833010).  Supported by Debian CI.
 # https://gitlab.freedesktop.org/wayland/weston/-/issues/739
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
index e79bcdf235..146182d4c1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/use.mask
@@ -1,6 +1,10 @@
 # Copyright 2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# matoro <matoro_gentoo@matoro.tk> (2023-05-05)
+# media-libs/zimg casualties (https://github.com/sekrit-twc/zimg/pull/156)
+zimg
+
 # matoro <matoro_gentoo@matoro.tk> (2023-04-07)
 # media-libs/openh264 casualties (#896138)
 # https://github.com/cisco/openh264/issues/3634
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/llvm/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/features/llvm/make.defaults
index 77b32d47a3..54254b71b5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/llvm/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/llvm/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 2021-2022 Gentoo Authors
+# Copyright 2021-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # this is for now highly experimental -dilfridge
@@ -53,7 +53,7 @@ CXXSTDLIB="c++"
 BOOTSTRAP_USE="${BOOTSTRAP_USE} ssl curl_ssl_openssl"
 
 # Clang needs this
-BOOTSTRAP_USE="${BOOTSTRAP_USE} python_single_target_python3_10"
+BOOTSTRAP_USE="${BOOTSTRAP_USE} python_single_target_python3_11"
 
 # sys-devel/llvm
 BOOTSTRAP_USE="${BOOTSTRAP_USE} -binutils-plugin"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 3a906adb89..94bf8b9e00 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -14,7 +14,7 @@ sys-block/arcconf
 sys-apps/smcipmitool
 
 # Alfredo Tupone <tupone@gentoo.org> (2023-02-27)
-# Uses dev-util/nvidia-cuda-toolkit
+# Uses dev-util/nvidia-cuda-sdk
 dev-libs/cutlass
 
 # Sam James <sam@gentoo.org> (2023-01-02)
@@ -35,16 +35,6 @@ dev-libs/intel-compute-runtime
 =sys-devel/gcc-12.2.1_p20221231:12
 =sys-devel/gcc-12.2.1_p20230121:12
 
-# Andrey Grozin <grozin@gentoo.org> (2022-12-01)
-# sbcl upstream supports only glibc Linux systems, bug #712626
-# and these packages depend on dev-lisp/sbcl unconditionally
-dev-lisp/sbcl
-app-emacs/sly
-dev-lisp/alexandria
-sci-mathematics/acl2
-x11-wm/stumpwm
-x11-wm/stumpwm-contrib
-
 # Sam James <sam@gentoo.org> (2022-10-17)
 # Needs porting to musl
 # https://github.com/rr-debugger/rr/issues/2236
@@ -109,7 +99,6 @@ net-misc/casync
 
 # Bernd Waibel <waebbl-gentoo@posteo.net> (2022-03-14)
 # Doesn't build with musl, bug #832742
-app-eselect/eselect-opencascade
 app-doc/kicad-doc
 media-gfx/freecad
 media-gfx/prusaslicer
@@ -233,7 +222,6 @@ net-im/mattermost-desktop-bin
 net-im/rocketchat-desktop-bin
 net-im/skypeforlinux
 net-im/slack
-net-im/teams
 net-im/telegram-desktop-bin
 net-im/wazzapp-bin
 net-im/whatsapp-desktop-bin
@@ -259,7 +247,6 @@ sys-apps/ipmicfg
 sys-apps/tas
 sys-block/hpssacli
 sys-block/megacli
-sys-power/dptfxtract
 www-apps/chromedriver-bin
 www-apps/grafana-bin
 www-apps/jellyfin
@@ -323,7 +310,6 @@ net-misc/netkit-rsh
 dev-libs/cudnn
 dev-libs/cudnn-frontend
 dev-python/pycuda
-dev-util/nvidia-cuda-sdk
 dev-util/nvidia-cuda-toolkit
 dev-libs/optix
 x11-drivers/nvidia-drivers
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.force
index 369d1774b6..52cf9aedc6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.force
@@ -1,6 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors.
+# Copyright 1999-2023 Gentoo Authors.
 # Distributed under the terms of the GNU General Public License v2
 
+# Violet Purcell <vimproved@inventati.org> (2023-04-25)
+# SBCL Upstream does not provide musl binaries for bootstrap, use CLisp.
+dev-lisp/sbcl system-bootstrap
+
 # Sam James <sam@gentoo.org> (2022-11-02)
 # The libxcrypt migration is optional for musl.
 sys-libs/libxcrypt -system -compat
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index f47dd6dadc..269ec23079 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -1,14 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-05-08)
+# Needs fpu_control.h, bug #891063
+media-sound/lame debug
+
 # Conrad Kostecki <conikost@gentoo.org> (2023-03-01)
 # sys-block/arcconf is masked on musl
 net-analyzer/nagios-plugin-check_raid aacraid
 
-# Sam James <sam@gentoo.org> (2023-02-17)
-# dev-lisp/sbcl is masked on musl
-sci-mathematics/fricas sbcl
-
 # Bernd Waibel <waebbl-gentoo@posteo.net> (2022-10-04)
 # Mask loguru until fixed upstream #873601
 sci-libs/vtk logging
@@ -91,6 +91,7 @@ sys-apps/man-pages l10n_sr l10n_sv l10n_uk l10n_vi
 sys-apps/man-pages l10n_ja l10n_ru l10n_zh-CN
 sys-apps/sysvinit nls
 sys-auth/sssd man
+sys-apps/util-linux nls
 
 # Sam James <sam@gentoo.org> (2021-11-07)
 # Disable some sanitizers for LLVM, see bug #753935
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/make.defaults
index 3dbb25ed7d..5357594cb9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Michael Haubenwallner <haubi@gentoo.org> (2016-04-19)
@@ -21,7 +21,3 @@ FEATURES="${FEATURES} -sandbox -usersandbox"
 # Prefix does not have user management and the security model does not apply.
 # Disable user* features by default.
 FEATURES="${FEATURES} -userpriv -userfetch -usersync"
-
-# this probably already is like this, but we assure that in prefix we
-# have a GNU userland
-USERLAND="GNU"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.force b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.force
index 843b1c7ed8..53de2c1a67 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.force
@@ -1,8 +1,5 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # force prefix flag to be set
 prefix
-
-# force GNU userland (even though base profile sets this too)
-userland_GNU
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.mask
index a273fbe66e..482ce57f04 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/use.mask
@@ -1,12 +1,9 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # prefix USE flag should always be unmasked in prefix profiles
 -prefix
 
-# re-add userland GNU
--userland_GNU
-
 # USE flags inherited by the base/use.defaults file that shouldn't be in Prefix
 gpm
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/selinux/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/selinux/package.mask
index aa5f3c6bc8..352a6c3ad5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/selinux/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/selinux/package.mask
@@ -1,261 +1,2 @@
-# Copyright 2011-2022 Gentoo Authors
+# Copyright 2011-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
-
-# Kenton Groombridge <concord@gentoo.org> (2022-11-02)
-# SELinux policies 2.20221101-r1 were published in error
-# as they do not include any policy changes since the
-# previous release. Please upgrade to 2.20221101-r2.
-=sec-policy/selinux-abrt-2.20221101-r1
-=sec-policy/selinux-accountsd-2.20221101-r1
-=sec-policy/selinux-acct-2.20221101-r1
-=sec-policy/selinux-afs-2.20221101-r1
-=sec-policy/selinux-aide-2.20221101-r1
-=sec-policy/selinux-alsa-2.20221101-r1
-=sec-policy/selinux-amanda-2.20221101-r1
-=sec-policy/selinux-amavis-2.20221101-r1
-=sec-policy/selinux-android-2.20221101-r1
-=sec-policy/selinux-apache-2.20221101-r1
-=sec-policy/selinux-apcupsd-2.20221101-r1
-=sec-policy/selinux-apm-2.20221101-r1
-=sec-policy/selinux-arpwatch-2.20221101-r1
-=sec-policy/selinux-asterisk-2.20221101-r1
-=sec-policy/selinux-at-2.20221101-r1
-=sec-policy/selinux-automount-2.20221101-r1
-=sec-policy/selinux-avahi-2.20221101-r1
-=sec-policy/selinux-awstats-2.20221101-r1
-=sec-policy/selinux-backup-2.20221101-r1
-=sec-policy/selinux-bacula-2.20221101-r1
-=sec-policy/selinux-base-2.20221101-r1
-=sec-policy/selinux-base-policy-2.20221101-r1
-=sec-policy/selinux-bind-2.20221101-r1
-=sec-policy/selinux-bitcoin-2.20221101-r1
-=sec-policy/selinux-bitlbee-2.20221101-r1
-=sec-policy/selinux-bluetooth-2.20221101-r1
-=sec-policy/selinux-brctl-2.20221101-r1
-=sec-policy/selinux-cachefilesd-2.20221101-r1
-=sec-policy/selinux-calamaris-2.20221101-r1
-=sec-policy/selinux-canna-2.20221101-r1
-=sec-policy/selinux-cdrecord-2.20221101-r1
-=sec-policy/selinux-ceph-2.20221101-r1
-=sec-policy/selinux-certbot-2.20221101-r1
-=sec-policy/selinux-cgmanager-2.20221101-r1
-=sec-policy/selinux-cgroup-2.20221101-r1
-=sec-policy/selinux-chromium-2.20221101-r1
-=sec-policy/selinux-chronyd-2.20221101-r1
-=sec-policy/selinux-clamav-2.20221101-r1
-=sec-policy/selinux-cloudinit-2.20221101-r1
-=sec-policy/selinux-collectd-2.20221101-r1
-=sec-policy/selinux-colord-2.20221101-r1
-=sec-policy/selinux-container-2.20221101-r1
-=sec-policy/selinux-corosync-2.20221101-r1
-=sec-policy/selinux-couchdb-2.20221101-r1
-=sec-policy/selinux-courier-2.20221101-r1
-=sec-policy/selinux-cpucontrol-2.20221101-r1
-=sec-policy/selinux-cpufreqselector-2.20221101-r1
-=sec-policy/selinux-cups-2.20221101-r1
-=sec-policy/selinux-cvs-2.20221101-r1
-=sec-policy/selinux-cyphesis-2.20221101-r1
-=sec-policy/selinux-daemontools-2.20221101-r1
-=sec-policy/selinux-dante-2.20221101-r1
-=sec-policy/selinux-dbadm-2.20221101-r1
-=sec-policy/selinux-dbskk-2.20221101-r1
-=sec-policy/selinux-dbus-2.20221101-r1
-=sec-policy/selinux-ddclient-2.20221101-r1
-=sec-policy/selinux-devicekit-2.20221101-r1
-=sec-policy/selinux-dhcp-2.20221101-r1
-=sec-policy/selinux-dictd-2.20221101-r1
-=sec-policy/selinux-dirmngr-2.20221101-r1
-=sec-policy/selinux-dirsrv-2.20221101-r1
-=sec-policy/selinux-distcc-2.20221101-r1
-=sec-policy/selinux-djbdns-2.20221101-r1
-=sec-policy/selinux-dkim-2.20221101-r1
-=sec-policy/selinux-dmidecode-2.20221101-r1
-=sec-policy/selinux-dnsmasq-2.20221101-r1
-=sec-policy/selinux-docker-2.20221101-r1
-=sec-policy/selinux-dovecot-2.20221101-r1
-=sec-policy/selinux-dpkg-2.20221101-r1
-=sec-policy/selinux-dracut-2.20221101-r1
-=sec-policy/selinux-dropbox-2.20221101-r1
-=sec-policy/selinux-entropyd-2.20221101-r1
-=sec-policy/selinux-evolution-2.20221101-r1
-=sec-policy/selinux-exim-2.20221101-r1
-=sec-policy/selinux-fail2ban-2.20221101-r1
-=sec-policy/selinux-fetchmail-2.20221101-r1
-=sec-policy/selinux-finger-2.20221101-r1
-=sec-policy/selinux-flash-2.20221101-r1
-=sec-policy/selinux-fprintd-2.20221101-r1
-=sec-policy/selinux-ftp-2.20221101-r1
-=sec-policy/selinux-games-2.20221101-r1
-=sec-policy/selinux-gatekeeper-2.20221101-r1
-=sec-policy/selinux-git-2.20221101-r1
-=sec-policy/selinux-gitosis-2.20221101-r1
-=sec-policy/selinux-glusterfs-2.20221101-r1
-=sec-policy/selinux-gnome-2.20221101-r1
-=sec-policy/selinux-googletalk-2.20221101-r1
-=sec-policy/selinux-gorg-2.20221101-r1
-=sec-policy/selinux-gpg-2.20221101-r1
-=sec-policy/selinux-gpm-2.20221101-r1
-=sec-policy/selinux-gpsd-2.20221101-r1
-=sec-policy/selinux-gssproxy-2.20221101-r1
-=sec-policy/selinux-hddtemp-2.20221101-r1
-=sec-policy/selinux-hostapd-2.20221101-r1
-=sec-policy/selinux-icecast-2.20221101-r1
-=sec-policy/selinux-ifplugd-2.20221101-r1
-=sec-policy/selinux-inetd-2.20221101-r1
-=sec-policy/selinux-inn-2.20221101-r1
-=sec-policy/selinux-ipsec-2.20221101-r1
-=sec-policy/selinux-irc-2.20221101-r1
-=sec-policy/selinux-ircd-2.20221101-r1
-=sec-policy/selinux-irqbalance-2.20221101-r1
-=sec-policy/selinux-jabber-2.20221101-r1
-=sec-policy/selinux-java-2.20221101-r1
-=sec-policy/selinux-kdeconnect-2.20221101-r1
-=sec-policy/selinux-kdump-2.20221101-r1
-=sec-policy/selinux-kerberos-2.20221101-r1
-=sec-policy/selinux-kerneloops-2.20221101-r1
-=sec-policy/selinux-kismet-2.20221101-r1
-=sec-policy/selinux-ksmtuned-2.20221101-r1
-=sec-policy/selinux-ldap-2.20221101-r1
-=sec-policy/selinux-links-2.20221101-r1
-=sec-policy/selinux-lircd-2.20221101-r1
-=sec-policy/selinux-loadkeys-2.20221101-r1
-=sec-policy/selinux-logrotate-2.20221101-r1
-=sec-policy/selinux-logsentry-2.20221101-r1
-=sec-policy/selinux-logwatch-2.20221101-r1
-=sec-policy/selinux-lpd-2.20221101-r1
-=sec-policy/selinux-makewhatis-2.20221101-r1
-=sec-policy/selinux-mandb-2.20221101-r1
-=sec-policy/selinux-matrixd-2.20221101-r1
-=sec-policy/selinux-mcelog-2.20221101-r1
-=sec-policy/selinux-memcached-2.20221101-r1
-=sec-policy/selinux-milter-2.20221101-r1
-=sec-policy/selinux-modemmanager-2.20221101-r1
-=sec-policy/selinux-mono-2.20221101-r1
-=sec-policy/selinux-mozilla-2.20221101-r1
-=sec-policy/selinux-mpd-2.20221101-r1
-=sec-policy/selinux-mplayer-2.20221101-r1
-=sec-policy/selinux-mrtg-2.20221101-r1
-=sec-policy/selinux-munin-2.20221101-r1
-=sec-policy/selinux-mutt-2.20221101-r1
-=sec-policy/selinux-mysql-2.20221101-r1
-=sec-policy/selinux-nagios-2.20221101-r1
-=sec-policy/selinux-ncftool-2.20221101-r1
-=sec-policy/selinux-networkmanager-2.20221101-r1
-=sec-policy/selinux-nginx-2.20221101-r1
-=sec-policy/selinux-node_exporter-2.20221101-r1
-=sec-policy/selinux-nslcd-2.20221101-r1
-=sec-policy/selinux-ntop-2.20221101-r1
-=sec-policy/selinux-ntp-2.20221101-r1
-=sec-policy/selinux-nut-2.20221101-r1
-=sec-policy/selinux-nx-2.20221101-r1
-=sec-policy/selinux-obfs4proxy-2.20221101-r1
-=sec-policy/selinux-oddjob-2.20221101-r1
-=sec-policy/selinux-oident-2.20221101-r1
-=sec-policy/selinux-openct-2.20221101-r1
-=sec-policy/selinux-openrc-2.20221101-r1
-=sec-policy/selinux-opensm-2.20221101-r1
-=sec-policy/selinux-openvpn-2.20221101-r1
-=sec-policy/selinux-pan-2.20221101-r1
-=sec-policy/selinux-pcscd-2.20221101-r1
-=sec-policy/selinux-phpfpm-2.20221101-r1
-=sec-policy/selinux-plymouthd-2.20221101-r1
-=sec-policy/selinux-podman-2.20221101-r1
-=sec-policy/selinux-policykit-2.20221101-r1
-=sec-policy/selinux-portmap-2.20221101-r1
-=sec-policy/selinux-postfix-2.20221101-r1
-=sec-policy/selinux-postgresql-2.20221101-r1
-=sec-policy/selinux-postgrey-2.20221101-r1
-=sec-policy/selinux-ppp-2.20221101-r1
-=sec-policy/selinux-prelude-2.20221101-r1
-=sec-policy/selinux-privoxy-2.20221101-r1
-=sec-policy/selinux-procmail-2.20221101-r1
-=sec-policy/selinux-psad-2.20221101-r1
-=sec-policy/selinux-publicfile-2.20221101-r1
-=sec-policy/selinux-pulseaudio-2.20221101-r1
-=sec-policy/selinux-puppet-2.20221101-r1
-=sec-policy/selinux-pyzor-2.20221101-r1
-=sec-policy/selinux-qemu-2.20221101-r1
-=sec-policy/selinux-qmail-2.20221101-r1
-=sec-policy/selinux-quota-2.20221101-r1
-=sec-policy/selinux-radius-2.20221101-r1
-=sec-policy/selinux-radvd-2.20221101-r1
-=sec-policy/selinux-razor-2.20221101-r1
-=sec-policy/selinux-redis-2.20221101-r1
-=sec-policy/selinux-remotelogin-2.20221101-r1
-=sec-policy/selinux-resolvconf-2.20221101-r1
-=sec-policy/selinux-rngd-2.20221101-r1
-=sec-policy/selinux-rootlesskit-2.20221101-r1
-=sec-policy/selinux-rpc-2.20221101-r1
-=sec-policy/selinux-rpcbind-2.20221101-r1
-=sec-policy/selinux-rpm-2.20221101-r1
-=sec-policy/selinux-rssh-2.20221101-r1
-=sec-policy/selinux-rtkit-2.20221101-r1
-=sec-policy/selinux-rtorrent-2.20221101-r1
-=sec-policy/selinux-salt-2.20221101-r1
-=sec-policy/selinux-samba-2.20221101-r1
-=sec-policy/selinux-sasl-2.20221101-r1
-=sec-policy/selinux-screen-2.20221101-r1
-=sec-policy/selinux-secadm-2.20221101-r1
-=sec-policy/selinux-sendmail-2.20221101-r1
-=sec-policy/selinux-sensord-2.20221101-r1
-=sec-policy/selinux-shorewall-2.20221101-r1
-=sec-policy/selinux-shutdown-2.20221101-r1
-=sec-policy/selinux-skype-2.20221101-r1
-=sec-policy/selinux-slocate-2.20221101-r1
-=sec-policy/selinux-slrnpull-2.20221101-r1
-=sec-policy/selinux-smartmon-2.20221101-r1
-=sec-policy/selinux-smokeping-2.20221101-r1
-=sec-policy/selinux-snmp-2.20221101-r1
-=sec-policy/selinux-snort-2.20221101-r1
-=sec-policy/selinux-soundserver-2.20221101-r1
-=sec-policy/selinux-spamassassin-2.20221101-r1
-=sec-policy/selinux-squid-2.20221101-r1
-=sec-policy/selinux-sssd-2.20221101-r1
-=sec-policy/selinux-stunnel-2.20221101-r1
-=sec-policy/selinux-subsonic-2.20221101-r1
-=sec-policy/selinux-sudo-2.20221101-r1
-=sec-policy/selinux-sxid-2.20221101-r1
-=sec-policy/selinux-syncthing-2.20221101-r1
-=sec-policy/selinux-sysstat-2.20221101-r1
-=sec-policy/selinux-tboot-2.20221101-r1
-=sec-policy/selinux-tcpd-2.20221101-r1
-=sec-policy/selinux-tcsd-2.20221101-r1
-=sec-policy/selinux-telnet-2.20221101-r1
-=sec-policy/selinux-tftp-2.20221101-r1
-=sec-policy/selinux-tgtd-2.20221101-r1
-=sec-policy/selinux-thunderbird-2.20221101-r1
-=sec-policy/selinux-timidity-2.20221101-r1
-=sec-policy/selinux-tmpreaper-2.20221101-r1
-=sec-policy/selinux-tor-2.20221101-r1
-=sec-policy/selinux-tripwire-2.20221101-r1
-=sec-policy/selinux-ucspitcp-2.20221101-r1
-=sec-policy/selinux-ulogd-2.20221101-r1
-=sec-policy/selinux-uml-2.20221101-r1
-=sec-policy/selinux-unconfined-2.20221101-r1
-=sec-policy/selinux-uptime-2.20221101-r1
-=sec-policy/selinux-usbguard-2.20221101-r1
-=sec-policy/selinux-usbmuxd-2.20221101-r1
-=sec-policy/selinux-uucp-2.20221101-r1
-=sec-policy/selinux-uwimap-2.20221101-r1
-=sec-policy/selinux-uwsgi-2.20221101-r1
-=sec-policy/selinux-varnishd-2.20221101-r1
-=sec-policy/selinux-vbetool-2.20221101-r1
-=sec-policy/selinux-vdagent-2.20221101-r1
-=sec-policy/selinux-vde-2.20221101-r1
-=sec-policy/selinux-virt-2.20221101-r1
-=sec-policy/selinux-vlock-2.20221101-r1
-=sec-policy/selinux-vmware-2.20221101-r1
-=sec-policy/selinux-vnstatd-2.20221101-r1
-=sec-policy/selinux-vpn-2.20221101-r1
-=sec-policy/selinux-watchdog-2.20221101-r1
-=sec-policy/selinux-webalizer-2.20221101-r1
-=sec-policy/selinux-wine-2.20221101-r1
-=sec-policy/selinux-wireguard-2.20221101-r1
-=sec-policy/selinux-wireshark-2.20221101-r1
-=sec-policy/selinux-wm-2.20221101-r1
-=sec-policy/selinux-xen-2.20221101-r1
-=sec-policy/selinux-xfs-2.20221101-r1
-=sec-policy/selinux-xscreensaver-2.20221101-r1
-=sec-policy/selinux-xserver-2.20221101-r1
-=sec-policy/selinux-zabbix-2.20221101-r1
-=sec-policy/selinux-zfs-2.20221101-r1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index 1038c6db36..99e254326a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -20,9 +20,6 @@ dev-lang/rust-bin
 dev-python/autobahn
 >=dev-python/bcrypt-4
 >=dev-python/cryptography-36
-dev-python/gcs-oauth2-boto-plugin
-dev-python/google-apitools
-dev-python/google-reauth-python
 dev-python/josepy
 dev-python/keyring
 dev-python/libcloud
@@ -34,8 +31,6 @@ dev-python/mkdocs-git-authors-plugin
 dev-python/mkdocs-i18n
 dev-python/mkdocs-material-extensions
 dev-python/mkdocs-git-revision-date-localized-plugin
-dev-python/ndg-httpsclient
-dev-python/oauth2client
 dev-python/oauthlib
 dev-python/openstacksdk
 dev-python/os-client-config
@@ -92,7 +87,6 @@ net-im/gajim
 >=net-irc/polari-3.37
 net-libs/quiche
 net-misc/electrum-ltc
-net-misc/gsutil
 net-news/newsboat
 net-p2p/deluge
 sci-geosciences/gnome-maps
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
index 9b572fad64..59fffef973 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Matt Turner <mattst88@gentoo.org> (2023-05-12)
+# The Rusticl OpenCL state tracker requires rust
+>=media-libs/mesa-23.1 opencl
+
 # Michał Górny <mgorny@gentoo.org> (2023-03-09)
 # Packages needing dev-python/selenium.
 dev-python/aiohttp-cors test
@@ -17,6 +21,7 @@ dev-util/gef doc
 # Sam James <sam@gentoo.org> (2022-12-11)
 # net-libs/rustls-ffi needs Rust.
 net-misc/curl rustls curl_ssl_rustls
+www-servers/apache apache2_modules_tls
 
 # matoro <matoro_gentoo@matoro.tk> (2022-12-01)
 # tree-sitter-grammar.eclass adds dev-util/tree-sitter-cli as test dep
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 745815cc10..1693f7af31 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -15,7 +15,7 @@
 # https://www.gnu.org/licenses/license-list.html
 # GPL or LGPL with various exceptions are also included here, because
 # they are more permissive than the licenses they are based on.
-GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2-with-classpath-exception GPL-2-with-exceptions GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception unicode Unlicense UoI-NCSA UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
+GPL-COMPATIBLE AGPL-3 AGPL-3+ Apache-2.0 Apache-2.0-with-LLVM-exceptions Artistic-2 Boost-1.0 BSD BSD-2 CC0-1.0 CeCILL-2 Clarified-Artistic Clear-BSD ECL-2.0 FSFAP FTL gcc-runtime-library-exception-3.1 GPL-1 GPL-1+ GPL-2 GPL-2+ GPL-2+-with-openssl-exception GPL-2+-with-eCos-exception-2 GPL-2-with-classpath-exception GPL-2-with-exceptions GPL-2-with-font-exception GPL-2-with-linking-exception GPL-2-with-MySQL-FLOSS-exception GPL-2+-with-Pyinstaller-Bootloader-exception GPL-3 GPL-3+ GPL-3+-with-autoconf-exception GPL-3+-with-font-exception GPL-3-with-font-exception GPL-3-with-openssl-exception HPND IJG ISC LGPL-2 LGPL-2+ LGPL-2-with-linking-exception LGPL-2.1 LGPL-2.1+ LGPL-2.1-with-linking-exception LGPL-3 LGPL-3+ LGPL-3-with-linking-exception libgcc libstdc++ metapackage MIT MPL-2.0 Nokia-Qt-LGPL-Exception-1.1 OPENLDAP PSF-2 PSF-2.4 public-domain PYTHON qwt Ruby Ruby-BSD SGI-B-2.0 Sleepycat tanuki-community Transmission-OpenSSL-exception unicode Unlicense UoI-NCSA UPX-exception vim W3C WTFPL-2 wxWinLL-3.1 ZLIB ZPL
 
 # Free software licenses approved by the FSF
 FSF-APPROVED @GPL-COMPATIBLE AFL-2.1 AFL-3.0 Apache-1.0 Apache-1.1 APSL-2 BSD-4 CDDL CeCILL-B CeCILL-C CNRI CPAL-1.0 CPL-1.0 EPL-1.0 EPL-2.0 EUPL-1.1 EUPL-1.2 FraunhoferFDK gnuplot IBM LPPL-1.2 MPL-1.0 MPL-1.1 Ms-PL Ms-RL NPL-1.1 openssl OSL-1.1 OSL-2.0 OSL-2.1 PHP-3.01 QPL-1.0 Zend-2.0
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index 10bf245f78..abf9de72a1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -17,6 +17,11 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2023-04-26)
+# Renamed upstream to dev-python/pypdf.  Since Python modules were
+# renamed as well, projects need to update their imports.
+dev-python/PyPDF2
+
 # Sam James <sam@gentoo.org> (2023-04-07)
 # Inactive upstream, doesn't support newer Rubies.
 # Please port your package to use dev-ruby/erubis instead.
@@ -62,11 +67,6 @@ sys-apps/edac-utils
 # Last-rites pending and waiting for revdeps, bug 877311
 x11-libs/snorenotify
 
-# Michał Górny <mgorny@gentoo.org> (2022-12-25)
-# Archived upstream.  Last activity in 2018.  Broken with Python 3.8.
-# Broken with Django 2.
-dev-python/oauth2client
-
 # Michał Górny <mgorny@gentoo.org> (2022-12-24)
 # Unmaintained with last release in 2019.  We already patched it to work
 # with Python 3.9+.  The upstream code is also vulnerable
@@ -80,11 +80,7 @@ dev-python/future
 # work with prior Python versions.  If your package still needs it
 # (sic!), then either port it to use a maintained test framework (pytest
 # preferably) or last rite it.
-#
-# Case is also unmaintained (since 2018).  Nose-random has had last
-# commit in 2016 and was not even released to pypi!
 dev-python/nose
-dev-python/nose-random
 
 # Michał Górny <mgorny@gentoo.org> (2022-10-14)
 # The toml package is unmaintained (last release in 2020) and does not
@@ -128,7 +124,6 @@ virtual/jpeg
 app-text/enchant:0
 app-text/gnome-doc-utils
 app-text/gtkspell:2
-app-text/rarian
 app-text/scrollkeeper-dtd
 dev-cpp/gtkmm:2.4
 dev-libs/libcroco
@@ -139,7 +134,6 @@ gnome-base/libgnomecanvas
 media-libs/libart_lgpl
 x11-libs/gtksourceview:2.0
 x11-libs/libwnck:1
-x11-libs/vte:0
 x11-themes/gnome-icon-theme-extras
 x11-themes/gnome-icon-theme-symbolic
 x11-themes/gtk-chtheme
@@ -148,7 +142,6 @@ x11-themes/gtk-engines-adwaita
 x11-themes/gtk-engines-candido
 x11-themes/gtk-engines-experience
 x11-themes/gtk-engines-murrine
-x11-themes/gtk-engines-nodoka
 x11-themes/gtk-engines-qtpixmap
 x11-themes/gtk-engines-quartz
 x11-themes/gtk-engines-rezlooks
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index b83fac8113..c02dfaf7d8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,17 +33,185 @@
 
 #--- END OF EXAMPLES ---
 
+# Sam James <sam@gentoo.org> (2023-05-20)
+# Various regressions, please upgrade to the latest libxml2 (>=2.11.4).
+=dev-libs/libxml2-2.11.1
+=dev-libs/libxml2-2.11.2
+=dev-libs/libxml2-2.11.2-r1
+=dev-libs/libxml2-2.11.3
+
+# Sam James <sam@gentoo.org> (2023-05-19)
+# Breaks Portage's pid-sandbox at least with 5.10 kernels. Pending investigation.
+# If you're hitting this, try: FEATURES="-pid-sandbox" emerge -v1 sys-apps/util-linux
+# as a workaround. bug #906797.
+~sys-apps/util-linux-2.39
+
+# Michał Górny <mgorny@gentoo.org> (2023-05-19)
+# Replaced by dev-python/pyproject-hooks.  No revdeps left.
+# Removal on 2023-06-18.  Bug #906789.
+dev-python/pep517
+
+# David Seifert <soap@gentoo.org> (2023-05-19)
+# Abandoned, NIH library only used by other obsolete packages like gkeys
+# and layman, use app-crypt/gpgme[python] as a proper upstream
+# supported gpg library. Removal on 2023-08-17.
+dev-python/pyGPG
+
+# David Seifert <soap@gentoo.org> (2023-05-19)
+# Abandoned, replaced by 'eselect repository', tons of open bugs.
+# Removal on 2023-08-17. Bug #761199.
+app-portage/layman
+
+# David Seifert <soap@gentoo.org> (2023-05-19)
+# EAPI 6, abandoned, never went anywhere, long obsolete with
+# app-crypt/gkeys removal.
+# Use these instead:
+# sec-keys/openpgp-keys-gentoo-auth
+# sec-keys/openpgp-keys-gentoo-developers
+# sec-keys/openpgp-keys-gentoo-release
+# Removal on 2023-06-18. Bug #566782, #659822
+app-crypt/gentoo-keys
+
+# Thomas Beierlein <tomjbe@gentoo.org> (2023-05-17)
+# Functionality got integrated into >=net-wireless/gnuradio-3.10
+# itself. See
+# https://wiki.analog.com/resources/tools-software/linux-software/gnuradio
+# Removal on 2023-06-17. Bug #897168.
+net-wireless/gr-iio
+
+# Michał Górny <mgorny@gentoo.org> (2023-05-16)
+# Unmaintained since 2020.  Does not implement TOML 1.0, buggy.
+# Alternatives include built-in tomllib module (Python 3.11+),
+# dev-python/tomli along with dev-python/tomli-w, dev-python/tomlkit.
+# Removal on 2023-06-15.  Bug #878651.
+dev-python/toml
+
+# David Seifert <soap@gentoo.org> (2023-05-14)
+# QA and build issues, EAPI 6, no proper releases, no other
+# distro packages this. Removal on 2023-06-13. Bug #713794, #872539.
+dev-vcs/cvsync
+
+# David Seifert <soap@gentoo.org> (2023-05-14)
+# EAPI 6, last release over 20 years ago, no other distro packages this
+# anymore. Removal on 2023-06-13.
+dev-tex/cpp2latex
+
+# Michał Górny <mgorny@gentoo.org> (2023-05-13)
+# Unmaintained.  Does not build anymore.  No activity upstream
+# since 2019, the build system is messy and fixing the issues would take
+# a lot of effort.
+# Removal on 2023-06-12.  Bug #791034.
+games-emulation/pcsxr
+
+# Matt Turner <mattst88@gentoo.org> (2023-05-12)
+# Dead slot. Only reverse dependency is stardict which is masked for removal
+# Removal on 2023-06-12
+gnome-extra/gucharmap:0
+
+# Matt Turner <mattst88@gentoo.org> (2023-05-11)
+# Depends on many deprecated packages, such as
+# 	- app-text/enchant:0
+# 	- app-text/gnome-doc-utils
+# 	- gnome-extra/gucharmap:0
+# 	- x11-libs/gtk+:2
+# No reverse dependencies.
+# Bug #905901. Removal on 2023-06-11
+app-text/stardict
+
+# Sam James <sam@gentoo.org> (2023-05-10)
+# A major reverse depndency (kde-apps/libkexiv2) does not yet build against this
+# so mask for now, see bug #906087 and bug #906090.
+=media-gfx/exiv2-0.28.0
+
+# Sam James <sam@gentoo.org> (2023-05-10)
+# Lots of package breakage as usual for new versions. Masked until most/all
+# reverse dependencies are fixed. Tracker bug is bug #906077.
+=dev-libs/libfmt-10*
+
+# Matt Turner <mattst88@gentoo.org> (2023-05-08)
+# Package is unmaintained and appears quite dead. Last release in 2020. Broken
+# with stable glib-2.76. Depends on app-text/enchant:0.
+# Bug #905954. Removal on 2023-06-08
+net-im/mcabber
+
+# Michał Górny <mgorny@gentoo.org> (2023-05-05)
+# The Gentoo packages are severely out of date, and they haven't been
+# ported to Python 3.11.  They are hard to keep working, and there
+# are better alternatives available.  The suggested replacements are:
+# media-gfx/prusaslicer, media-gfx/superslicer and orcaslicer
+# (not packaged).
+# Removal on 2023-08-04.  Bug #905769.
+media-gfx/cura
+acct-group/ultimaker
+acct-user/ultimaker
+dev-libs/libarcus
+dev-libs/clipper
+dev-libs/libcharon
+dev-libs/libnest2d
+dev-libs/libsavitar
+dev-python/pynest2d
+dev-python/uranium
+media-gfx/fdm-materials
+media-gfx/curaengine
+
+# Mike Gilbert <floppym@gentoo.org> (2023-05-04)
+# Out of date by several versions. Many unresolved security
+# vulnerabilities. Lack of manpower/interest in keeping it up to date.
+# Removal on 2023-06-03.
+# Chromium-based bin alternatives: google-chrome, microsoft-edge & vivaldi.
+www-client/chromium-bin
+
+# Sam James <sam@gentoo.org> (2023-05-03)
+# Broken pkgconfig file, please upgrade to -r1.
+# bug #704348, bug #905632, bug #905822
+=sci-libs/metis-5.2.1
+=sci-libs/metis-5.2.1-r1
+=sci-libs/parmetis-4.0.3_p20230326
+
+# Michał Górny <mgorny@gentoo.org> (2023-05-03)
+# Unmaintained upstream.  Fails to build without sys-apps/which, fails
+# with modern autoconf.
+# Removal on 2023-06-02.  Bug #896896.
+dev-python/thunarx-python
+
+# Sam James <sam@gentoo.org> (2023-05-01)
+# Breaks dev-python/scipy build. See bug #905396 and https://github.com/serge-sans-paille/gast/issues/74.
+=dev-python/pythran-0.13.0
+=dev-python/gast-0.5.4
+
+# John Helmert III <ajak@gentoo.org> (2023-04-30)
+# STARTTLS vulnerability, depends on gtk+:2, practically unmainatined
+# upstream. Use mail-client/claws instead. Removal in 30 days, bugs
+# #769293, #807358
+mail-client/sylpheed
+
+# Sam James <sam@gentoo.org> (2023-05-01)
+# Quite broken, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109672.
+=sys-devel/gcc-14.0.0_pre20230430
+
+# Andreas Sturmlechner <asturm@gentoo.org> 2023-04-30
+# Breaking even latest ~arch version of KDE PIM, bug #905352.
+=dev-libs/ktextaddons-1.3*
+
+# Matt Turner <mattst88@gentoo.org> (2023-04-26)
+# Package contains only a script that runs an X application on a remote system
+# with rsh (use ssh -Y instead), and two scripts that were probably used for
+# converting the old BDF fonts to XLFD names back in the early 90's. None of
+# these are useful today.
+# Removal on 2023-05-26
+x11-apps/scripts
+
+# Mike Gilbert <floppym@gentoo.org> (2023-04-26)
+# Merged into net-libs/ldns.  Bug 828109.
+# Removal on 2023-05-26.
+net-dns/ldns-utils
+
 # Volkmar W. Pogatzki <gentoo@pogatzki.net> (2023-04-22)
 # Unused acct-group. Removal on 2023-05-22
 # The server was removed on 2021-08-24 with commit
 # 7a1e8a90fa8a09a84741dc8ef5f774d92ae8433c
 acct-group/resin
 
-# Michał Górny <mgorny@gentoo.org> (2023-04-23)
-# Upstream changed config_settings interface breaking compatibility
-# with our invocations.  Bug #904677.
-=dev-python/meson-python-0.13.0
-
 # Conrad Kostecki <conikost@gentoo.org> (2023-04-23)
 # Very old package, does not build with modern compilers.
 # It provides BOOTP support, predecessor of DHCP.
@@ -63,12 +231,6 @@ dev-java/avalon-logkit
 java-virtuals/servlet-api
 dev-java/resin-servlet-api
 
-# Ionen Wolkens <ionen@gentoo.org> (2023-04-19)
-# Snapshot matching Proton-8.0-1's vkd3d-proton commit, but reported
-# to be semi-broken. Keeping around anyway but leaving masked until
-# a proper release. Bug #904660.
-=app-emulation/vkd3d-proton-2.8_p20230207
-
 # Sam James <sam@gentoo.org> (2023-04-19)
 # Last-minute libstdc++ symbol versioning magic causes e.g. mold, cmake
 # to segfault:
@@ -83,181 +245,29 @@ dev-java/resin-servlet-api
 # https://bugs.gentoo.org/904500
 =xfce-base/libxfce4ui-4.19.0
 
-# Sam James <sam@gentoo.org> (2023-04-18)
-# Fails to compile with GCC 13, out of date, QA issues, and various open bugs.
-# Removal on 2023-05-18.
-# Bug #899218, bug #899218, bug #796599, bug #672326, bug #788844.
-net-p2p/litecoind
-
-# Sam James <sam@gentoo.org> (2023-04-18)
-# Fails to compile with GCC 13, no upstream activity.
-# Removal on 2023-05-18.  Bug #895206.
-sci-geosciences/congen
-
-# David Seifert <soap@gentoo.org> (2023-04-17)
-# Unmaintained, no release in over 10 years, EAPI 6, no other distro
-# carries this, usual suckless.org assortment of build system
-# patching required. Removal on 2023-05-17. Bug #732424.
-x11-misc/sprop
-
 # Sam James <sam@gentoo.org> (2023-04-16)
 # SEEK_HOLE issues causing corruption with (sparse?) copies again.
 # See https://github.com/openzfs/zfs/issues/14753.
 =sys-fs/zfs-kmod-2.1.10
 
-# Sam James <sam@gentoo.org> (2023-04-14)
-# Fails with modern C, no upstream activity since 2005.
-# Removal on 2023-05-14.  Bug #778506, bug #881205.
-www-apache/mod_log_sql
-
-# Sam James <sam@gentoo.org> (2023-04-14)
-# Obsolete because of Twitter API changes. Archived upstream.
-# Removal on 2023-05-14.  Bug #904296.
-net-im/cawbird
-
 # Sam James <sam@gentoo.org> (2023-04-13)
 # Leads to broken terminal output in e.g. vim and openrc and other applications
 # like joe crashing.
-# See issues reported at bottom of bug #904247 and bug #904263.
-=sys-libs/ncurses-6.4_p20230408
-=sys-libs/ncurses-6.4_p20230415
-=sys-libs/ncurses-6.4_p20230418
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-13)
-# Lack of support for Python 3.11.  The current version is from 2016.
-# No revdeps.  Removal on 2023-05-13.
-dev-python/picklemagic
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-13)
-# django-tagging is broken on Python 3.11 and unmaintained upstream
-# (last commit in 2020).  Graphite-web is its only revdep and it is
-# replaced by app-metrics/carbonapi-web.
-# Removal on 2023-05-13.  Bug #897056.
-dev-python/django-tagging
-net-analyzer/graphite-web
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-13)
-# No Python 3.11 support.  The package has been discontinued upstream
-# (in favor of pyro5 that we do not package at the moment).  It was only
-# used as an optional dependency of dev-python/kombu, and it has
-# no revdeps anymore.
-# Removal on 2023-05-13.  Bug #896744.
-dev-python/Pyro4
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-13)
-# Broken tests and no Python 3.11 support.  Upstream has discontinued
-# the package, dev-python/mistune is suggested as a replacement.
-# No reverse dependencies.
-# Removal on 2023-05-13.  Bug #798066.
-dev-python/misaka
-
-# David Seifert <soap@gentoo.org> (2023-04-13)
-# Unmaintained, implicit declarations, last release over 17 years ago,
-# no other distro still packages this.
-# Removal on 2023-05-13. Bug #874522, #898456.
-x11-plugins/ascpu
+# Bugs:
+# - reported at bottom of bug #904247 and bug #904263
+# - app-misc/tmux: https://github.com/tmux/tmux/issues/3531
+# - sys-apps/openrc: https://github.com/OpenRC/openrc/issues/619
+=sys-libs/ncurses-6.4_p20230424
+=sys-libs/ncurses-6.4_p20230506
 
 # Eray Aslan <eras@gentoo.org> (2023-04-12)
 # Mask experimental software
 =mail-mta/postfix-3.9*
 
-# Matt Turner <mattst88@gentoo.org> (2023-04-10)
-# DMX support was dropped from the Xserver in v21.1.0 and had been broken for
-# 14 years previous to its removal. See
-# https://cgit.freedesktop.org/xorg/xserver/commit/?id=b3b81c8c2090cd49410960a021baf0d27fdd2ab3
-# Removal on 2023-05-10
-x11-libs/libdmx
-
-# Matt Turner <mattst88@gentoo.org> (2023-04-10)
-# speedo support was dropped from libXfont ~14 years ago. See
-# https://www.x.org/wiki/DeprecatedInX11R7/
-# https://gitlab.freedesktop.org/xorg/lib/libxfont/-/commit/85b66b8a7f3095f10437c8ecb3dcbfe68c9cfced
-# Removal on 2023-05-10
-media-fonts/font-bitstream-speedo
-
 # Ulrich Müller <ulm@gentoo.org> (2023-04-10)
 # Pretest versions, masked for testing.
 <app-editors/emacs-29.0.9999:29-vcs
 
-# Hans de Graaff <graaff@gentoo.org> (2023-04-10)
-# Ruby 2.7 reached EOL upstream on April 1st. Mask this version and any
-# remaining ruby27-only packages for removal on 2023-05-10.
-dev-lang/ruby:2.7
-=dev-ruby/bundler-2.1.4
-=dev-ruby/did_you_mean-1.4.0
-=dev-ruby/rubygems-3.1.6
-=dev-ruby/contracts-0.16.1
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-10)
-# Last release in 2016, carries a few patches already.  No revdeps.
-# dev-python/cbor2 is a more modern replacement.
-# Removal on 2023-05-10.  Bug #903261.
-dev-python/cbor
-
-# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-04-09)
-# Archived upstream, better alternatives available, try:
-# - net-im/whatsapp-desktop-bin (another electron based approach)
-# - net-im/whatsie (a simple yet configurable Qt based app)
-# - net-im/whatsapp-for-linux::guru (a simple app using webkit2gtk)
-# Removal on 2023-05-09
-net-im/wazzapp-bin
-
-# Matthew Thode <prometheanfire@gentoo.org> (2023-04-08)
-# upstream has been dead for nearly five years
-# Removal on 2023-05-07
-app-admin/mcollective
-
-# John Helmert III <ajak@gentoo.org> (2023-04-08)
-# i3-gaps has been meregd into upstream i3. Use x11-wm/i3 instead.
-# See also: https://github.com/i3/i3/issues/3724
-# Removal on 2023-05-08.
-x11-wm/i3-gaps
-
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2023-04-09)
-# Numerous vulnerabilities, bug #825486.
-# Nothing depends on it. Removal on 2023-05-09
-dev-java/jython
-
-# Hans de Graaff <graaff@gentoo.org> (2023-04-08)
-# Last release in 2008. Upstream is gone. No reverse dependencies. No tests.
-# Removal on 2023-05-08
-dev-ruby/allison
-
-# Michał Górny <mgorny@gentoo.org> (2023-04-07)
-# No Python 3.11 support and the ebuild is not running the test suite.
-# Still uses deprecated dev-python/toml (upstream).  No revdeps.
-# Removal on 2023-05-07.  Bug #878655.
-app-misc/wildq
-
-# David Seifert <soap@gentoo.org> (2023-04-06)
-# Last release over 7 years ago, abandoned upstream, still depends on
-# dead 0.1-legacy samtools slot. No revdeps in tree.
-# Removal on 2023-05-06. Bug #862288.
-dev-perl/Bio-SamTools
-sci-biology/samtools:0.1-legacy
-
-# Hans de Graaff <graaff@gentoo.org> (2023-04-02)
-# Archived upstream since two years, meant to be used with Rails
-# 5.2. Continued as Turbo as part of the hotwire project in Rails.
-# Masked for removal on 2023-05-02
-dev-ruby/turbolinks
-dev-ruby/turbolinks-source
-
-# Michał Górny <mgorny@gentoo.org> (2023-03-31)
-# Packages with non-functional tests and no py3.11 support.  They were
-# only needed for media-fonts/noto-emoji[buildfont], and that variant
-# was removed, so they have no revdeps now.
-# Removal on 2023-04-30.  Bug #719882.
-dev-python/booleanOperations
-dev-python/defcon
-dev-python/nototools
-
-# Sam James <sam@gentoo.org> (2023-03-31)
-# Has suspicious test suite warnings with >=ruby31, no activity upstream, and
-# no reverse dependencies in Gentoo.
-# Removal on 2023-04-30.
-dev-ruby/ddmemoize
-
 # Ionen Wolkens <ionen@gentoo.org> (2023-03-30)
 # NVIDIA dropped support for the 390.xx branch in December 2022[1].
 #
@@ -280,68 +290,6 @@ dev-ruby/ddmemoize
 # [2] https://wiki.gentoo.org/wiki/Nouveau
 x11-drivers/nvidia-drivers:0/390
 
-# Matt Turner <mattst88@gentoo.org> (2023-03-30)
-# gnome-online-miners and libzapojit are archived upstream. All three packages
-# are stuck on libsoup-2.4. gnome-photos is the only reverse dependency of
-# gnome-online-miners, and it works without it.
-# Removal on 2023-04-30.
-net-libs/libgfbgraph
-net-libs/libzapojit
-net-misc/gnome-online-miners
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-30)
-# Deprecated upstream and ruby27-only. Masked for removal on 2023-04-30.
-dev-ruby/elasticsearch-extensions
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-30)
-# Ships a Certificate Authority bundle from 2014. Not needed on Gentoo
-# since we use ca-certificates. Masked for removal on 2023-04-30.
-dev-ruby/certified
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-30)
-# ruby27-only package. Last release 5 years ago. Does not build with
-# modern C compilers. classifier-reborn depends on this package, and is
-# itself a dependency for the now-masked jekyll. Masked for removal on
-# 2023-04-30.
-dev-ruby/rb-gsl
-dev-ruby/classifier-reborn
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-29)
-# ruby27-only slot of rspec. Please use rspec:3 instead. Masked for
-# removal on 2023-04-28.
-dev-ruby/rspec:2
-dev-ruby/rspec-core:2
-dev-ruby/rspec-expectations:2
-dev-ruby/rspec-mocks:2
-
-# Sam James <sam@gentoo.org> (2023-03-29)
-# Stuck on ruby27, low activity upstream, needs someone who actively uses it to
-# test it properly as automated tests require an API key.
-# Removal on 2023-04-28.  Bug #903542.
-dev-ruby/flickraw
-
-# Sam James <sam@gentoo.org> (2023-03-29)
-# Only supports imminently-EOL ruby27, depends on obsolete QtScript instead
-# of QML. Support for other languages was removed long ago, e.g. python support
-# is stuck on python2-only. Kross itself is on the chopping block too:
-# bug #810493, bug #903532.
-# Removal on 2023-04-28.
-kde-apps/kross-interpreters
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-29)
-# ruby27-only package. app-text/ronn-ng is a drop-in replacement.  it is
-# also the only consumer of dev-ruby/hpricot which has a ruby30 target
-# but is not actually compatible. Masked for removal on 2023-04-29.
-app-text/ronn
-dev-ruby/hpricot
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-29)
-# ruby27-only package without tests and without maintainer. Upstream
-# releases new versions in an unversioned zip file. This needs a
-# dedicated maintainer that can test this package.
-# Masked for removal on 2023-04-29.
-app-admin/ec2-ami-tools
-
 # Sam James <sam@gentoo.org> (2023-03-29)
 # Regressions in solving ability affecting e.g. igraph:
 # https://github.com/opencollab/arpack-ng/issues/401
@@ -350,49 +298,6 @@ app-admin/ec2-ami-tools
 # https://github.com/igraph/igraph/issues/2311
 =sci-libs/arpack-3.9.0
 
-# Michał Górny <mgorny@gentoo.org> (2023-03-28)
-# Unfetchable, the homepage is gone.  Last updated in 2020.
-# Removal on 2023-04-27.  Bug #831304.
-net-analyzer/netio
-
-# Michał Górny <mgorny@gentoo.org> (2023-03-28)
-# Unfetchable due to untrusted TLS certificate.  The game doesn't seem
-# to work anyway (displays blank window).
-# Removal on 2023-04-27.  Bug #835858.
-games-rpg/coe2
-
-# Michał Górny <mgorny@gentoo.org> (2023-03-28)
-# No upstream activity since Jan 2019.  The current version fails
-# to build.  Multiple other bugs reported.
-# Removal on 2023-04-27.  Bug #902069.
-acct-group/shellinaboxd
-acct-user/shellinaboxd
-www-misc/shellinabox
-
-# Michał Górny <mgorny@gentoo.org> (2023-03-28)
-# Unmaintained.  The current Gentoo version is from 2017 and has
-# multiple build failures reported.
-# Removal on 2023-04-27.  Bug #721816.
-app-editors/le
-
-# Sam James <sam@gentoo.org> (2023-03-27)
-# The upstream tzinfo maintainers recommend using 2023a for now because of the
-# disruption regarding Lebanon's DST change. See https://lore.kernel.org/distributions/87cz4u2gmj.fsf@gentoo.org/T/#u.
-=sys-libs/timezone-data-2023b
-=dev-python/pytz-2023.2-r1
-=dev-perl/DateTime-TimeZone-2.580.0
-
-# Michał Górny <mgorny@gentoo.org> (2023-03-26)
-# No py3.11.  Last release in 2014.  No revdeps.
-# Removal on 2023-04-25.  Bug #896762.
-dev-python/collective-checkdocs
-
-# Hans de Graaff <graaff@gentoo.org> (2023-03-26)
-# Mask ruby27-only version of puppet for removal. Please upgrade to
-# puppetserver 7 and either puppet-agent 7 or puppet 7.
-# Masked for removal on 2023-04-26.
-=app-admin/puppet-5*
-
 # Sam James <sam@gentoo.org> (2023-03-24)
 # Please upgrade to make-4.4.1 as make-4.4 has a bunch of issues.
 =sys-devel/make-4.4
@@ -430,22 +335,6 @@ dev-python/collective-checkdocs
 # Breaks too many revdeps for now
 =app-text/discount-3*
 
-# David Seifert <soap@gentoo.org> (2023-01-14)
-# Py3.8 only backports
-dev-python/backports-tempfile
-dev-python/backports-weakref
-dev-python/backports-zoneinfo
-dev-python/pkgutil_resolve_name
-
-# Sam James <sam@gentoo.org> (2023-01-05)
-# Breaks reverse dependencies: bug #889694, bug #888579.
-=sys-fs/btrfs-progs-6.1.1
-
-# Sam James <sam@gentoo.org> (2022-12-27)
-# Regression in listing subvolumes (no UUIDs), bug #888549
-# https://github.com/kdave/btrfs-progs/issues/562
-=sys-fs/btrfs-progs-6.1
-
 # Ionen Wolkens <ionen@gentoo.org> (2022-12-24)
 # Upstream dropped wxGTK support in >=games-emulation/pcsx2-1.7.3773,
 # and it now always requires Qt6. Masked given Qt6 is also masked in
@@ -459,15 +348,6 @@ dev-python/pkgutil_resolve_name
 # This version currently is not compatible with kernel build (yet)
 ~dev-util/bindgen-0.63.0
 
-# Matt Turner <mattst88@gentoo.org> (2022-11-16)
-# Masked for testing and migration of consumers
-media-gfx/gnome-photos
->=media-libs/grilo-0.3.15-r1
->=media-plugins/grilo-plugins-0.3.16
-media-sound/gnome-music
->=media-sound/rhythmbox-3.4.7
-net-libs/libdmapsharing:4.0
-
 # Jaco Kroon <jaco@uls.co.za> (2022-11-05)
 # Some potentially breaking changes here, please check the UPGRADE.txt file.
 # Most important:  chan_sip no longer builds by default, if you've migrated to
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
index 65c385e7ab..f883ab31fb 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.mask
@@ -1,2 +1,2 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.force
index c1677ba925..1214720308 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/macos/package.use.force
@@ -1,11 +1,9 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# Fabian Groffen <grobian@gentoo.org> (2020-12-10)
-# Fails to compile without nls during link with undefined symbol for
-# _gl_get_setlocale_null_lock, related, but causing other issues:
-# https://gitweb.gentoo.org/repo/proj/prefix.git/commit/?id=24276d89d7c30abb460e786497fe7d50605bcdf7
-~sys-devel/gettext-0.21 nls
+# Jacob Floyd <cognifloyd@gmail.org> (2020-12-20)
+# Make sure we always use libcxxabi on macos prefix
+sys-libs/libcxx libcxxabi
 
 # Fabian Groffen <grobian@gentoo.org> (2020-06-08)
 # Do NOT enable tinfo, it breaks ANYTHING existing, and it also breaks
@@ -21,7 +19,3 @@ media-gfx/tachyon threads opengl
 # Elias Pipping <pipping@gentoo.org> (2007-11-29)
 # won't compile without
 media-libs/libsdl opengl
-
-# Jacob Floyd <cognifloyd@gmail.org> (2020-12-20)
-# Make sure we always use libcxxabi on macos prefix
-sys-libs/libcxx libcxxabi
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.use.mask
index 70aa17d0cb..40dcb8932b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/darwin/package.use.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2023-05-03)
+# Darwin is Mach-O, so ELF stuff is not useful here and missing deps
+dev-libs/glib elf
+
 # Sam James <sam@gentoo.org> (2020-12-01)
 # Needs more work to make bindings build
 dev-db/qdbm java perl ruby
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/package.use.mask
index 1c74e8a689..bcae2df087 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/linux/package.use.mask
@@ -1,6 +1,10 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Fabian Groffen <grobian@gentoo.org> (2023-05-03)
+# this pulls in glibc or musl, which requires RAP
+dev-libs/libgcrypt getentropy
+
 # Michael Haubenwallner <haubi@gentoo.org> (2019-05-02)
 # gold is linux only, and is required by cxx
 sys-devel/binutils -gold -default-gold
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
index 219a58091e..359e8435b2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Fabian Groffen <grobian@gentoo.org> (2022-02-13)
@@ -24,7 +24,7 @@ sys-apps/debianutils installkernel
 sys-devel/binutils gold default-gold
 
 # Fabian Groffen <grobian@gentoo.org> (2018-12-27)
-# USE-dep fixing, bugs #665088, #667266, #671730, 
+# USE-dep fixing, bugs #665088, #667266, #671730,
 dev-db/postgresql kerberos ldap llvm pam systemd
 net-libs/libsoup gssapi samba vala
 net-libs/glib-networking gnome libproxy
@@ -36,7 +36,7 @@ app-text/texlive-core cjk
 
 # Mikle Kolyada <zlogene@gentoo.org> (2014-11-29)
 # Masked because of lack of manpower/time (bug #497068)
-dev-vcs/git mediawiki mediawiki-experimental
+dev-vcs/git mediawiki
 
 # Fabian Groffen <grobian@gentoo.org> (2010-10-23)
 # IPC relies on pipes, selects, polls, and more stuff that Python is
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/use.force b/sdk_container/src/third_party/portage-stable/profiles/prefix/use.force
index b772df1545..c14d80f0d0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/use.force
@@ -1,7 +1,7 @@
-# Copyright 1999-2014 Gentoo Foundation
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-# unforce the GNU/Linux ELIBC, KERNEL, and USERLAND
+# unforce the GNU/Linux ELIBC and KERNEL
 # flags that come from the base profile
 -elibc_glibc
 -kernel_linux
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
index 82661cdf4d..2f7d314eb7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/gnome/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-USE="colord eds evo gnome gnome-keyring gnome-online-accounts gstreamer introspection libsecret nautilus networkmanager pulseaudio sysprof tracker wayland"
+USE="colord eds evo gnome gnome-keyring gnome-online-accounts gstreamer introspection keyring nautilus networkmanager pulseaudio sysprof tracker wayland"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
index 94f35c83e1..6aab4ee1d8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-USE="activities declarative dri kde kwallet plasma policykit qml semantic-desktop widgets"
+USE="activities declarative dri kde kwallet pipewire plasma policykit pulseaudio qml screencast semantic-desktop wayland widgets"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
index 78b21cc90a..7144cc980c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/plasma/package.use
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # NSS: Required by kde-apps/okular[pdf]
@@ -37,6 +37,9 @@ media-gfx/graphviz python
 # Required by media-gfx/graphviz which is required by kde-apps/kcachegrind
 media-libs/gd fontconfig
 
+# Needed by a global USE=wayland right now
+media-libs/libsdl2 gles2
+
 # Required by kde-plasma/kwin
 media-libs/mesa wayland
 
@@ -60,3 +63,6 @@ kde-apps/marble phonon
 
 # Required by kde-plasma/plasma-meta
 kde-plasma/kwin lock
+
+# plasma profile never enabled pulseaudio. We're skipping to pipewire.
+media-video/pipewire sound-server
diff --git a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
index 28f6d04cff..668cf3a528 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
+++ b/sdk_container/src/third_party/portage-stable/profiles/thirdpartymirrors
@@ -19,7 +19,6 @@ mplayer		https://www1.mplayerhq.hu/MPlayer http://www2.mplayerhq.hu/MPlayer http
 nongnu		https://download.savannah.nongnu.org/releases/ https://ftp.cc.uoc.gr/mirrors/nongnu.org/ http://ftp.twaren.net/Unix/NonGNU/ https://mirror.csclub.uwaterloo.ca/nongnu/ ftp://mirror.csclub.uwaterloo.ca/nongnu/ https://mirrors.fe.up.pt/pub/nongnu/ ftp://mirrors.fe.up.pt/pub/nongnu/ https://nongnu.askapache.com/ https://nongnu.uib.no/ ftp://nongnu.uib.no/pub/nongnu/ http://savannah.c3sl.ufpr.br/ ftp://ftp.twaren.net/Unix/NonGNU/
 openbsd		https://cdn.openbsd.org/pub/OpenBSD https://fastly.cdn.openbsd.org/pub/OpenBSD
 openssl		https://www.openssl.org/ https://artfiles.org/openssl.org/ https://www.mirrorservice.org/sites/ftp.openssl.org/ ftp://ftp.openssl.org
-pypi		https://files.pythonhosted.org/packages/source
 qmail		https://qmail-mirror.jms1.net/ http://qmail.pandakc.com/ http://qmail.glasswings.com.au/ http://qmail.teraren.com/ http://qmail.mirror.cdnetworks.com/ https://qmail.mirror.choon.net/ http://qmail.cbox.biz/ http://qmail.cbox.biz/ http://qmail.mirrors.ovh.net/ftp.qmail.org/ http://qmail.rasjonell.net/ http://mirrors.ntua.gr/qmail/ http://qmail.cti.gr/ http://qmail.hypergrid.it/ http://qmail.omnis.ch/ http://qmail.cavsystems.net/ https://qmail.mivzakim.net/ http://qmail.mirror.rise.ph/
 samba		https://download.samba.org/pub/samba/
 sabayon		http://sabayon.c3sl.ufpr.br/distfiles https://ftp.nluug.nl/pub/os/Linux/distr/sabayonlinux/distfiles https://ftp.rnl.tecnico.ulisboa.pt/pub/sabayon/distfiles https://ftp.fsn.hu/pub/linux/distributions/sabayon/distfiles http://cross-lfs.sabayonlinux.org/distfiles https://mirror.dkm.cz/sabayon/distfiles http://mirror.internode.on.net/pub/sabayon/distfiles https://na.mirror.garr.it/mirrors/sabayonlinux/distfiles http://distfiles.sabayon.org
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023 b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
index d1ae246d4b..43b489e494 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
@@ -4,3 +4,18 @@ move dev-python/jupyter_client dev-python/jupyter-client
 move dev-python/importlib_resources dev-python/importlib-resources
 move dev-python/importlib_metadata dev-python/importlib-metadata
 move dev-python/python-keyutils dev-python/keyutils
+move dev-python/notebook_shim dev-python/notebook-shim
+move dev-python/python-mpd dev-python/python-mpd2
+move dev-python/sphinx_celery dev-python/sphinx-celery
+move dev-python/pretty-yaml dev-python/pyaml
+move dev-python/aws-xray-sdk-python dev-python/aws-xray-sdk
+move dev-python/python-docs app-doc/python-docs
+move dev-python/flit_core dev-python/flit-core
+move dev-python/jupyter_ydoc dev-python/jupyter-ydoc
+move dev-python/jupyter_console dev-python/jupyter-console
+move dev-python/jupyter_events dev-python/jupyter-events
+move dev-python/jupyter_kernel_test dev-python/jupyter-kernel-test
+move dev-python/jupyter_server_mathjax dev-python/jupyter-server-mathjax
+move dev-python/jupyter_packaging dev-python/jupyter-packaging
+move dev-python/jupyterlab_pygments dev-python/jupyterlab-pygments
+move dev-python/sphinxcontrib-log_cabinet dev-python/sphinxcontrib-log-cabinet
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
index f833c022b1..bbdbbafa2a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2021
@@ -10,5 +10,3 @@ move dev-python/u-msgpack dev-python/u-msgpack-python
 move sci-physics/geant-vmc sci-physics/geant4_vmc
 move dev-python/beautifulsoup dev-python/beautifulsoup4
 slotmove dev-python/beautifulsoup4 4 0
-move dev-python/pyro dev-python/Pyro4
-slotmove dev-python/Pyro4 4 0
diff --git a/sdk_container/src/third_party/portage-stable/profiles/use.desc b/sdk_container/src/third_party/portage-stable/profiles/use.desc
index 04ca8e845c..2d5489acc5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/use.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/use.desc
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Keep them sorted
@@ -152,6 +152,7 @@ jpeg - Add JPEG image support
 jpeg2k - Support for JPEG 2000, a wavelet-based image compression format
 kde - Add support for software made by KDE, a free software community
 kerberos - Add kerberos support
+keyring - Enable support for freedesktop.org Secret Service API password store
 ladspa - Enable the ability to support ladspa plugins
 lame - Prefer using LAME libraries for MP3 encoding support
 lapack - Add support for the virtual/lapack numerical library
@@ -333,6 +334,7 @@ usb - Add USB support to applications that have optional USB support (e.g. cups)
 v4l - Enable support for video4linux (using linux-headers or userspace libv4l libraries)
 vaapi - Enable Video Acceleration API for hardware decoding
 vala - Enable bindings for dev-lang/vala
+valgrind - Enable annotations for accuracy. May slow down runtime slightly. Safe to use even if not currently using dev-util/valgrind
 vanilla - Do not add extra patches which change default behaviour; DO NOT USE THIS ON A GLOBAL SCALE as the severity of the meaning changes drastically
 vcd - Video CD support
 vdpau - Enable the Video Decode and Presentation API for Unix acceleration interface
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
new file mode 100644
index 0000000000..887d476d91
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1-r2.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic libtool multilib-minimal usr-ldscript
+
+DESCRIPTION="Access control list utilities, libraries, and headers"
+HOMEPAGE="https://savannah.nongnu.org/projects/acl"
+SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="nls static-libs"
+
+RDEPEND="
+	>=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}]
+"
+DEPEND="${RDEPEND}"
+BDEPEND="nls? ( sys-devel/gettext )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.3.1-musl-1.2.4-lfs64-fix.patch"
+)
+
+src_prepare() {
+	default
+
+	# bug #580792
+	elibtoolize
+}
+
+multilib_src_configure() {
+	# Filter out -flto flags as they break getfacl/setfacl binaries
+	# bug #667372
+	filter-flags -flto*
+
+	# Broken with FORTIFY_SOURCE=3
+	# Our toolchain sets F_S=2 by default w/ >= -O2, so we need
+	# to unset F_S first, then explicitly set 2, to negate any default
+	# and anything set by the user if they're choosing 3 (or if they've
+	# modified GCC to set 3).
+	#
+	# Refs:
+	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104964
+	# https://savannah.nongnu.org/bugs/index.php?62519
+	# bug #847280
+	if is-flagq '-O[23]' || is-flagq '-Ofast' ; then
+		# We can't unconditionally do this b/c we fortify needs
+		# some level of optimisation.
+		filter-flags -D_FORTIFY_SOURCE=3
+		append-cppflags -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
+	fi
+
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/bin
+		$(use_enable static-libs static)
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
+		$(use_enable nls)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	# Tests call native binaries with an LD_PRELOAD wrapper
+	# bug #772356
+	multilib_is_native_abi && default
+}
+
+multilib_src_install() {
+	default
+
+	# Move shared libs to /
+	gen_usr_ldscript -a acl
+}
+
+multilib_src_install_all() {
+	if ! use static-libs ; then
+		find "${ED}" -type f -name "*.la" -delete || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1.ebuild
new file mode 100644
index 0000000000..517cb13a2f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.1.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic libtool multilib-minimal usr-ldscript
+
+DESCRIPTION="Access control list utilities, libraries, and headers"
+HOMEPAGE="https://savannah.nongnu.org/projects/acl"
+SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="nls static-libs"
+
+RDEPEND="
+	>=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}]
+"
+DEPEND="${RDEPEND}"
+BDEPEND="nls? ( sys-devel/gettext )"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.3.1-musl-1.2.4-lfs64-fix.patch"
+)
+
+src_prepare() {
+	default
+
+	# bug #580792
+	elibtoolize
+}
+
+multilib_src_configure() {
+	# Filter out -flto flags as they break getfacl/setfacl binaries
+	# bug #667372
+	filter-flags -flto*
+
+	local myeconfargs=(
+		--bindir="${EPREFIX}"/bin
+		$(use_enable static-libs static)
+		--libexecdir="${EPREFIX}"/usr/$(get_libdir)
+		$(use_enable nls)
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	# Tests call native binaries with an LD_PRELOAD wrapper
+	# bug #772356
+	multilib_is_native_abi && default
+}
+
+multilib_src_install() {
+	default
+
+	# Move shared libs to /
+	gen_usr_ldscript -a acl
+}
+
+multilib_src_install_all() {
+	if ! use static-libs ; then
+		find "${ED}" -type f -name "*.la" -delete || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch b/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch
new file mode 100644
index 0000000000..3b5d2c6bab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/files/acl-2.3.1-musl-1.2.4-lfs64-fix.patch
@@ -0,0 +1,37 @@
+Bug: https://bugs.gentoo.org/905910
+Upstream Bug: https://savannah.nongnu.org/bugs/index.php?64162
+
+From a9100afd77fea00b311f114a5a04108283aa681a Mon Sep 17 00:00:00 2001
+From: Violet Purcell <vimproved@inventati.org>
+Date: Mon, 8 May 2023 04:17:07 +0000
+Subject: [PATCH] musl 1.2.4 LFS64 removal fixes
+
+---
+ tools/chacl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/chacl.c b/tools/chacl.c
+index 525a7ff..8fff875 100644
+--- a/tools/chacl.c
++++ b/tools/chacl.c
+@@ -320,7 +320,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
+ {
+ 	int failed = 0;
+ 	DIR *dir;
+-	struct dirent64 *d;
++	struct dirent *d;
+ 	char *name;
+ 
+ 	if ((dir = opendir(fname)) == NULL) {
+@@ -332,7 +332,7 @@ walk_dir(acl_t acl, acl_t dacl, const char *fname)
+ 		return(0);	/* got a file, not an error */
+ 	}
+ 
+-	while ((d = readdir64(dir)) != NULL) {
++	while ((d = readdir(dir)) != NULL) {
+ 		/* skip "." and ".." entries */
+ 		if (strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0)
+ 			continue;
+-- 
+2.40.1
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
index eda49eac05..ac73eb757f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/Manifest
@@ -1,3 +1,5 @@
+DIST diffutils-3.10.tar.xz 1624240 BLAKE2B 24a90162b3d876e6378243f19a85a1f1bb4cdfe98d130dee684740a902f2987509d5830dd32df4e26678b468b96960f6f9785ffb922e828cb8b4acce0d8587f6 SHA512 219d2c815a120690c6589846271e43aee5c96c61a7ee4abbef97dfcdb3d6416652ed494b417de0ab6688c4322540d48be63b5e617beb6d20530b5d55d723ccbb
+DIST diffutils-3.10.tar.xz.sig 833 BLAKE2B 06650838d6a3327fda6b2ab09693170ec18b730b1f5981c8f3e2180b2c8a553307ae93199e4be0532a534a8a3f95e4a7b4fccbbd9e5f8d1b1cedd0816b0aac90 SHA512 91aa1fcfca224454e292540ea7813f4a0eb348f06a4374017326d524949775359fc833de597cc201c97f357eb6c675800828a6e3332572376f3554f1f2e1aca1
 DIST diffutils-3.8.tar.xz 1585120 BLAKE2B 573abbfba55c62ba30d2084ca68860e9681cfe92648407f7fb04e1aaed2e4719e2fb5a29cf25bd125d762f4dfd52f85ee91f2ec19b099365bada7fe27a0394af SHA512 279441270987e70d5ecfaf84b6285a4866929c43ec877e50f154a788858d548a8a316f2fc26ad62f7348c8d289cb29a09d06dfadce1806e3d8b4ea88c8b1aa7c
 DIST diffutils-3.8.tar.xz.sig 833 BLAKE2B 439d331d9839d8b434b7192c52628bc9e8e1c11cada28170f85c9390abc3e5e9ea86aee696a4f9260552133053194680ff54b960ed539fabec85fdff54dee3a2 SHA512 0464ac89209411993800666b45ff90243d22fbda53bf1d71c6870d565b39cc8d9c54c141b9d297a181ce74ad8fb5313953f416bced179ff7728a52a3e9a4f5a5
 DIST diffutils-3.9.tar.xz 1587916 BLAKE2B d43ed9f1643ac46b69083755974fc9611ad00c3b98b08332c681223d17d762567562233b51342a16f7dad8f28dfc5536999143594e33a64e6624001a71787c8f SHA512 d43280cb1cb2615a8867d971467eb9a3fa037fe9a411028068036f733dab42b10d42767093cea4de71e62b2659a3ec73bd7d1a8f251befd49587e32802682d0f
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.10.ebuild
new file mode 100644
index 0000000000..afcdb4c15e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.10.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/diffutils.asc
+inherit verify-sig
+
+DESCRIPTION="Tools to make diffs and compare files"
+HOMEPAGE="https://www.gnu.org/software/diffutils/"
+
+if [[ ${PV} == *_p* ]] ; then
+	# Subscribe to the 'platform-testers' ML to find these.
+	# Useful to test on our especially more niche arches and report issues upstream.
+	MY_COMMIT="17-cc36"
+	MY_P=${PN}-$(ver_cut 1-2).${MY_COMMIT}
+	SRC_URI="https://meyering.net/diff/${MY_P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://meyering.net/diff/${MY_P}.tar.xz.sig )"
+	S="${WORKDIR}"/${MY_P}
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="nls"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-diffutils )
+"
+
+src_prepare() {
+	default
+
+	# Needed because of ${P}-diff-D-option-regression.patch
+	#touch man/diff.1 || die
+}
+
+src_configure() {
+	# Disable automagic dependency over libsigsegv; see bug #312351.
+	export ac_cv_libsigsegv=no
+
+	# required for >=glibc-2.26, bug #653914
+	use elibc_glibc && export gl_cv_func_getopt_gnu=yes
+
+	local myeconfargs=(
+		# Interferes with F_S (sets F_S=2)
+		--disable-gcc-warnings
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR}"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		$(use_enable nls)
+	)
+	econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.9-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.9-r1.ebuild
index 44589c8405..c7ed3f50d2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.9-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/diffutils/diffutils-3.9-r1.ebuild
@@ -20,7 +20,7 @@ if [[ ${PV} == *_p* ]] ; then
 else
 	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
index f634b83cf2..be3226d998 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/Manifest
@@ -1,3 +1,4 @@
 DIST gawk-5.2.1.tar.xz 3411420 BLAKE2B 5dbbfe92ed4c11a38b2f995e9267dd2e392a9f393af1c63aaf3c5dd6d1681c01db900e05a118831125f914fcffe2218de7f30891ccc6f64abc5f572aef5feeff SHA512 f81da3e61987d1460326dc79fdbabacfd4660219bf66ec8ba18877500fd24e160761e401a5b868067f82bec46a6a808098f3f6a1f4c8b710e439cd3f99ffa56c
 DIST gawk-5.2.1.tar.xz.sig 488 BLAKE2B 5dcdc9ae90d4744a968cc750526a9c1c38915f85c56c2eca80b219ba8519c927ab55b7f569d55054b0499f7bf37d3413b97e9d3cf36f5573f9ecd4855663064e SHA512 97a9cfb069f235bef31892ec6e5c56ee6a8733129ae3d02e871d5407de4d7a6140fc0a87001b2b21e3cffd714d1b4d164876de47144dfdce6dea92c670ed0217
-DIST gawk-5.2.1c.tar.gz 6645383 BLAKE2B b4cf841f56f5646f95c746ad9f8d5e526fc98c4f057fa439edea8d38b5db06c8f3d3984e91378fbafaa35ef7c0c9f83810704262df85efd91a8d5ec4e946a06c SHA512 8324b7a1bac9afa3aeda1ad2c4d1d89c52e55712852105dac2797994f84bb9408b458e0d0f93f582fde040672cd70bf0eae1e65c2eba235f4db07a39aaa640d7
+DIST gawk-5.2.2.tar.xz 3402872 BLAKE2B 49dd69d3e2414867d60fe42b74b39bc6858114aeeb9305ade7bfd64f1933b3c93d59d127362b614cb4b73e29279ed3b4ea9fa0da94fce98ca9925980d17b5d0c SHA512 90611e4daba7226d5ce8230843bf479dc71c0101740c005d851ef7c5b935b6cd4c42089b858abc1619adc05ed25fc7234f993690a76d2ea0b8e61bcbb7dc5a58
+DIST gawk-5.2.2.tar.xz.sig 488 BLAKE2B ad737580d7eeb556187a3eeb269decb484398ca91b0fbf08da7f78bba92328ca2fb566b00f8e880fb7c5f0f956e49f8ab9fddc73209902c420666d5413e8a467 SHA512 563911c3771feddf64810ef2480705fd470c90380c0e258940cedeef3f15d594ef657ddab267a6d958321333d466b77c9b83be2392549c959245324950fb32ed
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.1c.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.2.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.1c.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.2.ebuild
index 07a1fcd8d2..02d5d9510a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.1c.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/gawk/gawk-5.2.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-GAWK_IS_BETA=yes
+#GAWK_IS_BETA=yes
 
 DESCRIPTION="GNU awk pattern-matching language"
 HOMEPAGE="https://www.gnu.org/software/gawk/gawk.html"
@@ -29,7 +29,7 @@ else
 	SRC_URI="mirror://gnu/gawk/${P}.tar.xz"
 	SRC_URI+=" verify-sig? ( mirror://gnu/gawk/${P}.tar.xz.sig )"
 
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 
 LICENSE="GPL-3+"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
index 36d722c609..e7ca470d19 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/Manifest
@@ -1,3 +1,3 @@
 DIST less-608.tar.gz 362346 BLAKE2B 988940745fef1222c43b0bf4edec7cc7206ded0ac5d89d3faf4dab706a249913581c2fe7aa6063cf3d717176ed07b69299d3e791ba8a60358483fe9d1bf7f7c6 SHA512 7945b7f88921832ebb1b45fba8cbb449ee0133342796b654a52c146dfff3d84db18724ee84e53349eeea6017a0ebe2d8eb5366210275981dde7bb7190118fa66
-DIST less-629-beta.tar.gz 374918 BLAKE2B 0276006cf81f310a3d25add7cfaedfd678b03f99d48b75eb462fb6dda6e171c495fa6af170257fb286a35b0d6f380136c5d37b6d9a088ee08d42d4f32033afcb SHA512 5b5d7f86b0e2d00d65257b1d27511fdab21fda52f60102f7dd6c31d1314edcf75754dc9a268c03ebfe08ffc7b88f3b7cad0fa5a9504d66b11bc13f5f52cab558
-DIST less-632-beta.tar.gz 375440 BLAKE2B 26c27a2e25882a4ce34e5e6e83bc0af784c8d4e8ac20691e0e31f1021bfb30f96e07024a6ff1ad634f7812875e0d920bd52394ccdba47a2a944ba7de92aa4c97 SHA512 5104f1fd76cdd59dfa957a61f8ccffe7c6e79345b94a5961abbd30f2d059f2b6d4b359a27dd5528993e5e1248c655439c1e4a39fd92234e4af23c7167f69f066
+DIST less-632.tar.gz 375440 BLAKE2B 26c27a2e25882a4ce34e5e6e83bc0af784c8d4e8ac20691e0e31f1021bfb30f96e07024a6ff1ad634f7812875e0d920bd52394ccdba47a2a944ba7de92aa4c97 SHA512 5104f1fd76cdd59dfa957a61f8ccffe7c6e79345b94a5961abbd30f2d059f2b6d4b359a27dd5528993e5e1248c655439c1e4a39fd92234e4af23c7167f69f066
+DIST less-633.tar.gz 375733 BLAKE2B e9df180794af365f86734c6b8fde766c1bba42b111717ee5e1cf11001fc7ec3d78910db9bb7c51a76816086f599808b1b60f514011ec40e37650d6bc4f8b3d5c SHA512 a29aaf72abca07fb29d12f218bbd422a39e3898b3d53e8dbd5265ae47ecf68b88c3381aa3a9bf7caa8db1e2d8e2c138b333f0d69fddd4cf014e39118c53f7fb1
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-632_beta.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-632.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-apps/less/less-632_beta.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/less/less-632.ebuild
index 77a01bd02a..e621da4d1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-632_beta.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-632.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}"/${MY_P/?beta}
 LICENSE="|| ( GPL-3 BSD-2 )"
 SLOT="0"
 if [[ ${PV} != 9999 && ${PV} != *_beta* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 IUSE="pcre"
 # As of 623_beta, lesstest is not included in dist tarballs
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-629_beta.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-633.ebuild
similarity index 89%
rename from sdk_container/src/third_party/portage-stable/sys-apps/less/less-629_beta.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/less/less-633.ebuild
index 3dc457ca05..e621da4d1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-629_beta.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-633.ebuild
@@ -21,14 +21,14 @@ inherit autotools
 MY_PV=${PV/_beta/-beta}
 MY_P=${PN}-${MY_PV}
 DESCRIPTION="Excellent text file viewer"
-HOMEPAGE="http://www.greenwoodsoftware.com/less/"
-[[ ${PV} != 9999 ]] && SRC_URI="http://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
+HOMEPAGE="https://www.greenwoodsoftware.com/less/"
+[[ ${PV} != 9999 ]] && SRC_URI="https://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
 S="${WORKDIR}"/${MY_P/?beta}
 
 LICENSE="|| ( GPL-3 BSD-2 )"
 SLOT="0"
 if [[ ${PV} != 9999 && ${PV} != *_beta* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 IUSE="pcre"
 # As of 623_beta, lesstest is not included in dist tarballs
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
index 77a01bd02a..e621da4d1e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-9999.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}"/${MY_P/?beta}
 LICENSE="|| ( GPL-3 BSD-2 )"
 SLOT="0"
 if [[ ${PV} != 9999 && ${PV} != *_beta* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 fi
 IUSE="pcre"
 # As of 623_beta, lesstest is not included in dist tarballs
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
index c17111a04a..a2fd80a3bf 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/Manifest
@@ -1,3 +1,4 @@
 DIST portage-3.0.44.tar.bz2 1140911 BLAKE2B 06f584e6e37bbb309b9bb0e29ba4381eadd4ae6246aeb1045e3a5c5dcb33d74f74e74aa3f2325acbf37e16a535095c433f2796ed042f73cea5e208150e210cb0 SHA512 d40c95f3a31c5e2ae35374243c40c8d1f6b47b7c89f6a711a12d8744cb6848a85443298c0f947475b32acf52332e7f09b1e85915149ab8363930c0404f08410e
 DIST portage-3.0.45.3.tar.bz2 1146552 BLAKE2B 0506124bf47d71df699c2ecb2846b19f68b39813409e141fe292e237093eeb4f3d6fb771f6328624e0182322f71f42e629c2c58a2c590efb8697fa61b03d73a4 SHA512 89757efb71127249356c7d4ea1a05de7409285abaf045b2c6b5ddd463bef997db497df6ea3a05085656eced49bee625732bfb2d0771b7592f883f8712e547415
 DIST portage-3.0.46.tar.bz2 1148375 BLAKE2B d97698eb3341a8d04980e021e5be8650193baf60c1ba34c11ccc79c147a256f152cb5c3a455798f38ee93164666dba31d3f510837c2924c1190f657fe1019b77 SHA512 0aa43d58cb23ff5931d31b2ebf724b0f9cb163d7e452c120f2917b9a1fac1cad7930c28dd40e6482a3f4e66ff05e1340e7135aa9d0eca60182c04f573c094afb
+DIST portage-3.0.47.tar.bz2 1148789 BLAKE2B 268589c37a6bdc36377f3e407b16bebfb9876adc1d89ee7576f3ebbee42bc0799f5a225dfd53ffedeeded91ca4403383d4811b4f104448c1b2fc6c277ca94ef1 SHA512 abbd2446d0da0b5d298a235c2cc7d2d4e001e9f012b6e22149fed4514b52dc938b0377b2551f45e3505b9dddeedd7170951ff967310708ec3b93610b775a7c02
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.47.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.47.ebuild
new file mode 100644
index 0000000000..0ffe05fb58
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/portage/portage-3.0.47.ebuild
@@ -0,0 +1,286 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DISTUTILS_EXT=1
+PYTHON_COMPAT=( pypy3 python3_{9..11} )
+PYTHON_REQ_USE='bzip2(+),threads(+)'
+TMPFILES_OPTIONAL=1
+
+inherit distutils-r1 linux-info toolchain-funcs tmpfiles prefix
+
+DESCRIPTION="The package management and distribution system for Gentoo"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
+SRC_URI="https://gitweb.gentoo.org/proj/portage.git/snapshot/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+SLOT="0"
+IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux test xattr"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	app-arch/xz-utils
+	test? ( dev-vcs/git )
+"
+DEPEND="
+	!build? ( $(python_gen_impl_dep 'ssl(+)') )
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/sed-4.0.5 sys-devel/patch
+	doc? ( app-text/xmlto ~app-text/docbook-xml-dtd-4.4 )
+	apidoc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-epytext[${PYTHON_USEDEP}]
+	)
+"
+# Require sandbox-2.2 for bug #288863.
+# For whirlpool hash, require python[ssl] (bug #425046).
+# For compgen, require bash[readline] (bug #445576).
+# app-portage/gemato goes without PYTHON_USEDEP since we're calling
+# the executable.
+RDEPEND="
+	acct-user/portage
+	app-arch/zstd
+	>=app-arch/tar-1.27
+	dev-lang/python-exec:2
+	>=sys-apps/baselayout-2.9
+	>=sys-apps/findutils-4.4
+	!build? (
+		>=sys-apps/sed-4.0.5
+		>=app-shells/bash-5.0:0[readline]
+		>=app-admin/eselect-1.2
+		rsync-verify? (
+			>=app-portage/gemato-14.5[${PYTHON_USEDEP}]
+			>=sec-keys/openpgp-keys-gentoo-release-20220101
+			>=app-crypt/gnupg-2.2.4-r2[ssl(-)]
+		)
+	)
+	elibc_glibc? ( >=sys-apps/sandbox-2.2 )
+	elibc_musl? ( >=sys-apps/sandbox-2.2 )
+	kernel_linux? ( sys-apps/util-linux )
+	>=app-misc/pax-utils-0.1.17
+	selinux? ( >=sys-libs/libselinux-2.0.94[python,${PYTHON_USEDEP}] )
+	xattr? ( kernel_linux? (
+		>=sys-apps/install-xattr-0.3
+	) )
+	!<app-admin/logrotate-3.8.0
+	!<app-portage/gentoolkit-0.4.6
+	!<app-portage/repoman-2.3.10
+	!~app-portage/repoman-3.0.0
+"
+PDEPEND="
+	!build? (
+		>=net-misc/rsync-2.6.4
+		>=sys-apps/coreutils-6.4
+		>=sys-apps/file-5.44-r3
+	)
+"
+# coreutils-6.4 rdep is for date format in emerge-webrsync #164532
+# NOTE: FEATURES=installsources requires debugedit and rsync
+
+pkg_pretend() {
+	local CONFIG_CHECK="~IPC_NS ~PID_NS ~NET_NS ~UTS_NS"
+
+	if use native-extensions && tc-is-cross-compiler; then
+		einfo "Disabling USE=native-extensions for cross-compilation (bug #612158)"
+	fi
+
+	check_extra_config
+}
+
+python_prepare_all() {
+	local PATCHES=(
+	)
+
+	distutils-r1_python_prepare_all
+
+	sed -e "s:^VERSION = \"HEAD\"$:VERSION = \"${PV}\":" -i lib/portage/__init__.py || die
+
+	if use gentoo-dev; then
+		einfo "Disabling --dynamic-deps by default for gentoo-dev..."
+		sed -e 's:\("--dynamic-deps", \)\("y"\):\1"n":' \
+			-i lib/_emerge/create_depgraph_params.py || \
+			die "failed to patch create_depgraph_params.py"
+
+		einfo "Enabling additional FEATURES for gentoo-dev..."
+		echo 'FEATURES="${FEATURES} ipc-sandbox network-sandbox strict-keepdir warn-on-large-env"' \
+			>> cnf/make.globals || die
+	fi
+
+	if use native-extensions && ! tc-is-cross-compiler; then
+		printf "[build_ext]\nportage_ext_modules=true\n" >> \
+			setup.cfg || die
+	fi
+
+	if ! use ipc ; then
+		einfo "Disabling ipc..."
+		sed -e "s:_enable_ipc_daemon = True:_enable_ipc_daemon = False:" \
+			-i lib/_emerge/AbstractEbuildProcess.py || \
+			die "failed to patch AbstractEbuildProcess.py"
+	fi
+
+	if use xattr && use kernel_linux ; then
+		einfo "Adding FEATURES=xattr to make.globals ..."
+		echo -e '\nFEATURES="${FEATURES} xattr"' >> cnf/make.globals \
+			|| die "failed to append to make.globals"
+	fi
+
+	if use build || ! use rsync-verify; then
+		sed -e '/^sync-rsync-verify-metamanifest/s|yes|no|' \
+			-e '/^sync-webrsync-verify-signature/s|yes|no|' \
+			-i cnf/repos.conf || die "sed failed"
+	fi
+
+	if [[ -n ${EPREFIX} ]] ; then
+		einfo "Setting portage.const.EPREFIX ..."
+		hprefixify -e "s|^(EPREFIX[[:space:]]*=[[:space:]]*\").*|\1${EPREFIX}\"|" \
+			-w "/_BINARY/" lib/portage/const.py
+
+		einfo "Prefixing shebangs ..."
+		> "${T}/shebangs" || die
+		while read -r -d $'\0' ; do
+			local shebang=$(head -n1 "$REPLY")
+			if [[ ${shebang} == "#!"* && ! ${shebang} == "#!${EPREFIX}/"* ]] ; then
+				echo "${REPLY}" >> "${T}/shebangs" || die
+			fi
+		done < <(find . -type f -executable ! -name etc-update -print0)
+
+		if [[ -s ${T}/shebangs ]]; then
+			xargs sed -i -e "1s:^#!:#!${EPREFIX}:" < "${T}/shebangs" || die "sed failed"
+		fi
+
+		einfo "Adjusting make.globals, repos.conf and etc-update ..."
+		hprefixify cnf/{make.globals,repos.conf} bin/etc-update
+
+		if use prefix-guest ; then
+			sed -e "s|^\(main-repo = \).*|\\1gentoo_prefix|" \
+				-e "s|^\\[gentoo\\]|[gentoo_prefix]|" \
+				-e "s|^\(sync-uri = \).*|\\1rsync://rsync.prefix.bitzolder.nl/gentoo-portage-prefix|" \
+				-i cnf/repos.conf || die "sed failed"
+		fi
+	fi
+
+	cd "${S}/cnf" || die
+	if [[ -f "make.conf.example.${ARCH}".diff ]] ; then
+		patch make.conf.example "make.conf.example.${ARCH}".diff || \
+			die "Failed to patch make.conf.example"
+	else
+		eerror ""
+		eerror "Portage does not have an arch-specific configuration for this arch."
+		eerror "Please notify the arch maintainer about this issue. Using generic."
+		eerror ""
+	fi
+}
+
+python_compile_all() {
+	local targets=()
+	use doc && targets+=( docbook )
+	use apidoc && targets+=( apidoc )
+
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+}
+
+python_test() {
+	esetup.py test
+}
+
+python_install() {
+	# Install sbin scripts to bindir for python-exec linking
+	# they will be relocated in pkg_preinst()
+	distutils-r1_python_install \
+		--system-prefix="${EPREFIX}/usr" \
+		--bindir="$(python_get_scriptdir)" \
+		--docdir="${EPREFIX}/usr/share/doc/${PF}" \
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html" \
+		--portage-bindir="${EPREFIX}/usr/lib/portage/${EPYTHON}" \
+		--sbindir="$(python_get_scriptdir)" \
+		--sysconfdir="${EPREFIX}/etc" \
+		"${@}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	local targets=()
+	use doc && targets+=(
+		install_docbook
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+	use apidoc && targets+=(
+		install_apidoc
+		--htmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+	)
+
+	# install docs
+	if [[ ${targets[@]} ]]; then
+		esetup.py "${targets[@]}"
+	fi
+
+	dotmpfiles "${FILESDIR}"/portage-{ccache,tmpdir}.conf
+
+	# Due to distutils/python-exec limitations
+	# these must be installed to /usr/bin.
+	local sbin_relocations='archive-conf dispatch-conf emaint env-update etc-update fixpackages regenworld'
+	einfo "Moving admin scripts to the correct directory"
+	dodir /usr/sbin
+	for target in ${sbin_relocations}; do
+		einfo "Moving /usr/bin/${target} to /usr/sbin/${target}"
+		mv "${ED}/usr/bin/${target}" "${ED}/usr/sbin/${target}" || die "sbin scripts move failed!"
+	done
+}
+
+pkg_preinst() {
+	if ! use build; then
+		python_setup
+		local sitedir=$(python_get_sitedir)
+		[[ -d ${D}${sitedir} ]] || die "${D}${sitedir}: No such directory"
+		env -u DISTDIR \
+			-u PORTAGE_OVERRIDE_EPREFIX \
+			-u PORTAGE_REPOSITORIES \
+			-u PORTDIR \
+			-u PORTDIR_OVERLAY \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.default_locations || die
+
+		env -u BINPKG_COMPRESS -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_compression || die
+
+		env -u FEATURES -u PORTAGE_REPOSITORIES \
+			PYTHONPATH="${D}${sitedir}${PYTHONPATH:+:${PYTHONPATH}}" \
+			"${PYTHON}" -m portage._compat_upgrade.binpkg_multi_instance || die
+	fi
+
+	# elog dir must exist to avoid logrotate error for bug #415911.
+	# This code runs in preinst in order to bypass the mapping of
+	# portage:portage to root:root which happens after src_install.
+	keepdir /var/log/portage/elog
+	# This is allowed to fail if the user/group are invalid for prefix users.
+	if chown portage:portage "${ED}"/var/log/portage{,/elog} 2>/dev/null ; then
+		chmod g+s,ug+rwx "${ED}"/var/log/portage{,/elog}
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-2.3.77"; then
+		elog "The emerge --autounmask option is now disabled by default, except for"
+		elog "portions of behavior which are controlled by the --autounmask-use and"
+		elog "--autounmask-license options. For backward compatibility, previous"
+		elog "behavior of --autounmask=y and --autounmask=n is entirely preserved."
+		elog "Users can get the old behavior simply by adding --autounmask to the"
+		elog "make.conf EMERGE_DEFAULT_OPTS variable. For the rationale for this"
+		elog "change, see https://bugs.gentoo.org/658648."
+	fi
+}
+
+pkg_postinst() {
+	# Warn about obsolete "enotice" script, bug #867010
+	local bashrc=${EROOT}/etc/portage/profile/profile.bashrc
+	if [[ -e ${bashrc} ]] && grep -q enotice "${bashrc}"; then
+		eerror "Obsolete 'enotice' script detected!"
+		eerror "Please remove this from ${bashrc} to avoid problems."
+		eerror "See bug 867010 for more details."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
index 526fe0062a..2ecd59ea0c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/Manifest
@@ -1 +1,2 @@
-DIST sed-4.8.tar.xz 1348048 BLAKE2B 62f6b6500cc9a20a35cafc2b09b12bb7da67fa0afb0b1b26153babc0023424b3126f44d29eba14c25fc4490996c90738b191c9440c66da6c120bbb9bc6f6df65 SHA512 7de25d9bc2981c63321c2223f3fbcab61d7b0df4fcf7d4394b72400b91993e1288d8bf53948ed5fffcf5a98c75265726a68ad4fb98e1d571bf768603a108c1c8
+DIST sed-4.9.tar.xz 1397092 BLAKE2B 6c7c7dc782b87c3bd0b5e826ba46c2f1dc7bd8c1159945fcf14b394711742964628774cf9f27d844b672721d7849e6c31992d82fafb9ed4118b7feb60406d1e1 SHA512 36157a4b4a2430cf421b7bd07f1675d680d9f1616be96cf6ad6ee74a9ec0fe695f8d0b1e1f0b008bbb33cc7fcde5e1c456359bbbc63f8aebdd4fedc3982cf6dc
+DIST sed-4.9.tar.xz.sig 833 BLAKE2B 256bb112aa3aec1a8d40544ef1b0a7570f35d66369047ed3d261c57f938042dcb4a169137eaed6639bcfb472e4a6fc6ebec2de243b2c4d4c0ba0e9081f92556d SHA512 ceb235850184b99017783486e182ade9db38313d20b2b34d23f54d8affe180f7a191139b993e8ec7718ca33eff732f547ca4b3b59aaf865feaae611dfeae5c46
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
index c1c3d84608..e562da12ca 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/metadata.xml
@@ -1,12 +1,12 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
-<maintainer type="project">
-	<email>base-system@gentoo.org</email>
-	<name>Gentoo Base System</name>
-</maintainer>
-<upstream>
-	<remote-id type="sourceforge">sed</remote-id>
-	<remote-id type="cpe">cpe:/a:gnu:sed</remote-id>
-</upstream>
+	<maintainer type="project">
+		<email>base-system@gentoo.org</email>
+		<name>Gentoo Base System</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="savannah">sed</remote-id>
+		<remote-id type="cpe">cpe:/a:gnu:sed</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild
deleted file mode 100644
index a8aaee8972..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.8.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic
-
-DESCRIPTION="Super-useful stream editor"
-HOMEPAGE="http://sed.sourceforge.net/"
-SRC_URI="mirror://gnu/sed/${P}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="acl nls selinux static"
-
-RDEPEND="
-	!static? (
-		acl? ( virtual/acl )
-		nls? ( virtual/libintl )
-		selinux? ( sys-libs/libselinux )
-	)
-"
-DEPEND="${RDEPEND}
-	static? (
-		acl? ( virtual/acl[static-libs(+)] )
-		nls? ( virtual/libintl[static-libs(+)] )
-		selinux? ( sys-libs/libselinux[static-libs(+)] )
-	)
-"
-BDEPEND="nls? ( sys-devel/gettext )"
-
-src_configure() {
-	local myconf=()
-	if use userland_GNU; then
-		myconf+=( --exec-prefix="${EPREFIX}" )
-	else
-		myconf+=( --program-prefix=g )
-	fi
-
-	use static && append-ldflags -static
-	myconf+=(
-		$(use_enable acl)
-		$(use_enable nls)
-		$(use_with selinux)
-	)
-	econf "${myconf[@]}"
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild
new file mode 100644
index 0000000000..c6cc118981
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/sed/sed-4.9.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/sed.asc
+inherit flag-o-matic verify-sig
+
+DESCRIPTION="Super-useful stream editor"
+HOMEPAGE="https://www.gnu.org/software/sed/"
+SRC_URI="mirror://gnu/sed/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnu/sed/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos"
+IUSE="acl nls selinux static"
+
+RDEPEND="
+	!static? (
+		acl? ( virtual/acl )
+		nls? ( virtual/libintl )
+		selinux? ( sys-libs/libselinux )
+	)
+"
+DEPEND="${RDEPEND}
+	static? (
+		acl? ( virtual/acl[static-libs(+)] )
+		nls? ( virtual/libintl[static-libs(+)] )
+		selinux? ( sys-libs/libselinux[static-libs(+)] )
+	)
+"
+BDEPEND="nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-sed )"
+
+src_configure() {
+	use static && append-ldflags -static
+
+	local myconf=(
+		--exec-prefix="${EPREFIX}"
+		$(use_enable acl)
+		$(use_enable nls)
+		$(use_with selinux)
+		# rename to gsed for better BSD compatibility
+		--program-prefix=g
+	)
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# We don't want to automagically use Valgrind for tests.
+	sed -i -e 's:valgrind --error-exitcode=1:false:' init.cfg || die
+
+	emake VERBOSE=yes check
+}
+
+src_install() {
+	default
+
+	# symlink to the standard name
+	dosym gsed /bin/sed
+	dosym gsed.1 /usr/share/man/man1/sed.1
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
index 51c46724d7..dfb6e0e930 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/Manifest
@@ -12,10 +12,9 @@ DIST binutils-2.37_p1-patches-2.tar.xz 31956 BLAKE2B 39c48628d0e2d7f3a8cf11be391
 DIST binutils-2.37_p1.tar.xz 22992196 BLAKE2B a8aa0f386d03a5b1466166ac7c40989c228351ccf0949a9b462b4d4615d70ab7e1a45351299140a42baf39c317b8007733c253eb547ee1dfadb612addde11621 SHA512 46c297ec2a7a5b81d1c6e3f16486a6dc2860a07520fe2dd8871d1eb5160065bbe2cc6b0415d5352bf12284133e5817a4e429e6077182d615e969bd1a8f52ed28
 DIST binutils-2.38-patches-4.tar.xz 193852 BLAKE2B 5a83e20008e58464ed563a6817a367e50684c59d08c47345cc546054269c42463d1651441720f865851e4e182e917df1a095c68e64226e0351b64e975d524096 SHA512 6657e547bb02898632cc45a8f1894be098aa7472b6725b65f95393e621abb127e468b4e50310720bf03f7e8d0a68bc2c47af76fc43aaa8f32b2e4a149c0c6290
 DIST binutils-2.38.tar.xz 23651408 BLAKE2B 19ede396ec97b88e632aded2f69f4684cc5053109e06c3c4a1934944e3f0ceaa9e4a2604528a440189771f778cb5d75edd510163970eeea31afba87fa256feba SHA512 8bf0b0d193c9c010e0518ee2b2e5a830898af206510992483b427477ed178396cd210235e85fd7bd99a96fc6d5eedbeccbd48317a10f752b7336ada8b2bb826d
-DIST binutils-2.39-patches-5.tar.xz 82924 BLAKE2B 2cf75f661989f22270d6afe5f3c543814eb6a331be4493016fa2871e1f10a84a123c1c51e77a19b35e46680b9fe77390cb1532ca40d470a6041fa768fed3ccd7 SHA512 4b5811b4822b3a06f590fc7d082dc0ddf18a6058ac23887254e2ee9bd63c7f06f1636e446152115c7e0b01a6c5298a0d9df6904bd1582e66504ccde80dd1ecbd
 DIST binutils-2.39-patches-6.tar.xz 92380 BLAKE2B 39f490f1134fb0e7dc80924a280d3113efe0ed094ee15de97c42ab751c83d2f5aa7448966d8cbbcde722b2af4999a36c1e5aa2f37ca6d2e3942b97b6d90ff152 SHA512 213cd7a86da83987966675f3195e843d898ca4ff412dfc29fd33ed80adb7bbf80a0b2919cd8e7dd49208c73a621ab7b720970f2259418bdc82ed2a568ff62064
 DIST binutils-2.39.tar.xz 25167756 BLAKE2B ac6a5296c6586d53eaadcbffc5c399a6d79edf72450b9bb8b3525ce525129cef3d2eb90c85ef3bb3270b5a03b0e1ffb8f0b705f028158726f9777ebb8685066f SHA512 68e038f339a8c21faa19a57bbc447a51c817f47c2e06d740847c6e9cc3396c025d35d5369fa8c3f8b70414757c89f0e577939ddc0d70f283182504920f53b0a3
-DIST binutils-2.40-patches-2.tar.xz 183760 BLAKE2B 447f1c40ac8212b1e91f6f2137f87958c3f4e2366b11b9979d9d09d52e9fcde9a9d74f0c1871616157e001f505849fceb2097a512f434b9c848885e367a07c35 SHA512 30efbfcbd2d936c74d9480e4f2f4b8dcd30abcd0f1b22d21d20558002fdb8c90bd2fe97e3f27c2905714dcfd1297cac2646ede1e2c3d9fbf159f93c8cf01a290
 DIST binutils-2.40-patches-3.tar.xz 259432 BLAKE2B 03b9024e658a5860d54b9087f3e1cc4b417a2501d6a1744c44759bbc99cabd5938058ba2909b16cc999208187998094aa6ab5464e5ed54b87ea0b1eef007e85c SHA512 f2f3e38f5c0c2928ed0588ee42be74d43486d209b43249f73ae133c4c1f81491c86b14df2ddecbc37df6fe80b27b0eab6c3f319e44854e91596dfbd3ec37b8aa
 DIST binutils-2.40-patches-4.tar.xz 264420 BLAKE2B 70acdc15f64a45cda49ebd7c252d909db2fe659f5c2c0866c50fd710415fd34bd88f9c5cd5ba07beef1e7de7fe827bb40f835fb79ff10e00fc50451e3a8cab33 SHA512 5f0a080841cb3a032cbe7b135ba38bebeae0b0e444623887bdcb92a3adcf804701524eff840f108a9544293f5ac307b4a8d9509176abfeaea6c461b2ea5c0886
+DIST binutils-2.40-patches-5.tar.xz 293628 BLAKE2B b7ed1d1fbf38b420661f984b9519b3d863da45b2a873773a521310021b0c1d5d7c24c152adb3e8a999d40f5619c0e54962114590ec9528380089977af0c30b74 SHA512 6e6df932b18ca20fe245b3ff8d3d06dbdae4daadaec3b668fa44e086d4e8ff56439681b2d810ebc74173b6348020edacb176e8c3cbf20657cce04297b97f4f83
 DIST binutils-2.40.tar.xz 25241484 BLAKE2B 8d799f7c595f878b9af5b17a490021dd8b8300ac2fe0ed8574c012929d22d2d0493e003a3e631a9436e8e712da801779b777c566167fe42b0bde119ffa5ad1c2 SHA512 a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r4.ebuild
deleted file mode 100644
index 3adccc27a4..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r4.ebuild
+++ /dev/null
@@ -1,499 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit libtool flag-o-matic gnuconfig strip-linguas toolchain-funcs
-
-DESCRIPTION="Tools necessary to build programs"
-HOMEPAGE="https://sourceware.org/binutils/"
-
-LICENSE="GPL-3+"
-IUSE="cet default-gold doc gold gprofng multitarget +nls pgo +plugins static-libs test vanilla"
-REQUIRED_USE="default-gold? ( gold )"
-
-# Variables that can be set here  (ignored for live ebuilds)
-# PATCH_VER          - the patchset version
-#                      Default: empty, no patching
-# PATCH_BINUTILS_VER - the binutils version in the patchset name
-#                    - Default: PV
-# PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
-#                      for the patchsets
-
-PATCH_VER=5
-PATCH_DEV=dilfridge
-
-if [[ ${PV} == 9999* ]]; then
-	inherit git-r3
-	SLOT=${PV}
-else
-	PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-	PATCH_DEV=${PATCH_DEV:-dilfridge}
-	SRC_URI="mirror://gnu/binutils/binutils-${PV}.tar.xz https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PV}.tar.xz"
-	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
-		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-#
-# The cross-compile logic
-#
-export CTARGET=${CTARGET:-${CHOST}}
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY} == cross-* ]] ; then
-		export CTARGET=${CATEGORY#cross-}
-	fi
-fi
-is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
-
-#
-# The dependencies
-#
-RDEPEND="
-	>=sys-devel/binutils-config-3
-	sys-libs/zlib
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	doc? ( sys-apps/texinfo )
-	test? (
-		dev-util/dejagnu
-		sys-devel/bc
-	)
-	nls? ( sys-devel/gettext )
-	sys-devel/flex
-	app-alternatives/yacc
-"
-
-RESTRICT="!test? ( test )"
-
-MY_BUILDDIR=${WORKDIR}/build
-
-src_unpack() {
-	if [[ ${PV} == 9999* ]] ; then
-		EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/toolchain/binutils-patches.git"
-		EGIT_CHECKOUT_DIR=${WORKDIR}/patches-git
-		git-r3_src_unpack
-		mv patches-git/9999 patch || die
-
-		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
-		S=${WORKDIR}/binutils
-		EGIT_CHECKOUT_DIR=${S}
-		git-r3_src_unpack
-	else
-		unpack ${P/-hppa64/}.tar.xz
-
-		cd "${WORKDIR}" || die
-		unpack binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz
-
-		# _p patch versions are Gentoo specific tarballs ...
-		local dir=${P%_p?}
-		dir=${dir/-hppa64/}
-
-		S=${WORKDIR}/${dir}
-	fi
-
-	cd "${WORKDIR}" || die
-	mkdir -p "${MY_BUILDDIR}" || die
-}
-
-src_prepare() {
-	local patchsetname
-	if [[ ${PV} == 9999* ]] ; then
-		patchsetname="from git master"
-	else
-		patchsetname="${PATCH_BINUTILS_VER}-${PATCH_VER}"
-	fi
-
-	if [[ -n ${PATCH_VER} ]] || [[ ${PV} == 9999* ]] ; then
-		if ! use vanilla; then
-			einfo "Applying binutils patchset ${patchsetname}"
-			eapply "${WORKDIR}/patch"
-			einfo "Done."
-		fi
-	fi
-
-	# Make sure our explicit libdir paths don't get clobbered, bug #562460
-	sed -i \
-		-e 's:@bfdlibdir@:@libdir@:g' \
-		-e 's:@bfdincludedir@:@includedir@:g' \
-		{bfd,opcodes}/Makefile.in || die
-
-	# Fix locale issues if possible, bug #122216
-	if [[ -e ${FILESDIR}/binutils-configure-LANG.patch ]] ; then
-		einfo "Fixing misc issues in configure files"
-		for f in $(find "${S}" -name configure -exec grep -l 'autoconf version 2.13' {} +) ; do
-			ebegin "  Updating ${f/${S}\/}"
-			patch "${f}" "${FILESDIR}"/binutils-configure-LANG.patch >& "${T}"/configure-patch.log \
-				|| eerror "Please file a bug about this"
-			eend $?
-		done
-	fi
-
-	# Apply things from PATCHES and user dirs
-	default
-
-	# Run misc portage update scripts
-	gnuconfig_update
-	elibtoolize --portage --no-uclibc
-}
-
-toolchain-binutils_bugurl() {
-	printf "https://bugs.gentoo.org/"
-}
-toolchain-binutils_pkgversion() {
-	printf "Gentoo ${PV}"
-	[[ -n ${PATCH_VER} ]] && printf " p${PATCH_VER}"
-}
-
-src_configure() {
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	# Setup some paths
-	LIBPATH=/usr/$(get_libdir)/binutils/${CTARGET}/${PV}
-	INCPATH=${LIBPATH}/include
-	DATAPATH=/usr/share/binutils-data/${CTARGET}/${PV}
-	if is_cross ; then
-		TOOLPATH=/usr/${CHOST}/${CTARGET}
-	else
-		TOOLPATH=/usr/${CTARGET}
-	fi
-	BINPATH=${TOOLPATH}/binutils-bin/${PV}
-
-	# Make sure we filter $LINGUAS so that only ones that
-	# actually work make it through, bug #42033
-	strip-linguas -u */po
-
-	# Keep things sane
-	strip-flags
-
-	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
-	# https://github.com/gentoo/gentoo/pull/28355
-	# mold needs this too but right now tc-ld-is-mold is also not available
-	if tc-ld-is-lld; then
-		append-ldflags -Wl,--undefined-version
-	fi
-
-	use elibc_musl && append-ldflags -Wl,-z,stack-size=2097152
-
-	local x
-	echo
-	for x in CATEGORY CBUILD CHOST CTARGET CFLAGS LDFLAGS ; do
-		einfo "$(printf '%10s' ${x}:) ${!x}"
-	done
-	echo
-
-	cd "${MY_BUILDDIR}" || die
-	local myconf=()
-
-	if use plugins ; then
-		myconf+=( --enable-plugins )
-	fi
-	# enable gold (installed as ld.gold) and ld's plugin architecture
-	if use gold ; then
-		myconf+=( --enable-gold )
-		if use default-gold; then
-			myconf+=( --enable-gold=default )
-		fi
-	fi
-
-	if use nls ; then
-		myconf+=( --without-included-gettext )
-	else
-		myconf+=( --disable-nls )
-	fi
-
-	myconf+=( --with-system-zlib )
-
-	# For bi-arch systems, enable a 64bit bfd. This matches the bi-arch
-	# logic in toolchain.eclass. bug #446946
-	#
-	# We used to do it for everyone, but it's slow on 32bit arches. bug #438522
-	case $(tc-arch) in
-		ppc|sparc|x86) myconf+=( --enable-64-bit-bfd ) ;;
-	esac
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	[[ -n ${CBUILD} ]] && myconf+=( --build=${CBUILD} )
-
-	is_cross && myconf+=(
-		--with-sysroot="${EPREFIX}"/usr/${CTARGET}
-		--enable-poison-system-directories
-	)
-
-	myconf+=( --enable-secureplt )
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	myconf+=(
-		--prefix="${EPREFIX}"/usr
-		--host=${CHOST}
-		--target=${CTARGET}
-		--datadir="${EPREFIX}"${DATAPATH}
-		--datarootdir="${EPREFIX}"${DATAPATH}
-		--infodir="${EPREFIX}"${DATAPATH}/info
-		--mandir="${EPREFIX}"${DATAPATH}/man
-		--bindir="${EPREFIX}"${BINPATH}
-		--libdir="${EPREFIX}"${LIBPATH}
-		--libexecdir="${EPREFIX}"${LIBPATH}
-		--includedir="${EPREFIX}"${INCPATH}
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		# Newer versions (>=2.27) offer a configure flag now.
-		--enable-relro
-		# Newer versions (>=2.24) make this an explicit option, bug #497268
-		--enable-install-libiberty
-		# Available from 2.35 on
-		--enable-textrel-check=warning
-
-		# These hardening options are available from 2.39+ but
-		# they unconditionally enable the behaviour even on arches
-		# where e.g. execstacks can't be avoided.
-		# See https://sourceware.org/bugzilla/show_bug.cgi?id=29592.
-		#--enable-warn-execstack
-		#--enable-warn-rwx-segments
-		#--disable-default-execstack (or is it --enable-default-execstack=no? docs are confusing)
-
-		# Things to think about
-		#--enable-deterministic-archives
-
-		# Works better than vapier's patch, bug #808787
-		--enable-new-dtags
-
-		--disable-jansson
-		--disable-werror
-		--with-bugurl="$(toolchain-binutils_bugurl)"
-		--with-pkgversion="$(toolchain-binutils_pkgversion)"
-		$(use_enable static-libs static)
-		# Disable modules that are in a combined binutils/gdb tree, bug #490566
-		--disable-{gdb,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# Change SONAME to avoid conflict across
-		# {native,cross}/binutils, binutils-libs. bug #666100
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)
-
-		# Avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		# Avoid automagic dev-libs/msgpack dep, bug #865875
-		--without-msgpack
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-
-		# We can enable this by default in future, but it's brand new
-		# in 2.39 with several bugs:
-		# - Doesn't build on musl (https://sourceware.org/bugzilla/show_bug.cgi?id=29477)
-		# - No man pages (https://sourceware.org/bugzilla/show_bug.cgi?id=29521)
-		# - Broken at runtime without Java (https://sourceware.org/bugzilla/show_bug.cgi?id=29479)
-		# - binutils-config (and this ebuild?) needs adaptation first (https://bugs.gentoo.org/865113)
-		$(use_enable gprofng)
-	)
-
-	if ! is_cross ; then
-		myconf+=( $(use_enable pgo pgo-build lto) )
-
-		if use pgo ; then
-			export BUILD_CFLAGS="${CFLAGS}"
-		fi
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}" || die
-
-	# Prevent makeinfo from running if doc is unset.
-	if ! use doc ; then
-		sed -i \
-			-e '/^MAKEINFO/s:=.*:= true:' \
-			Makefile || die
-	fi
-}
-
-src_compile() {
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	emake V=1 tooldir="${EPREFIX}${TOOLPATH}" all
-
-	# only build info pages if the user wants them
-	if use doc ; then
-		emake V=1 info
-	fi
-
-	# we nuke the manpages when we're left with junk
-	# (like when we bootstrap, no perl -> no manpages)
-	find . -name '*.1' -a -size 0 -delete
-}
-
-src_test() {
-	cd "${MY_BUILDDIR}" || die
-
-	# bug #637066
-	filter-flags -Wall -Wreturn-type
-
-	emake -k V=1 check
-}
-
-src_install() {
-	local x d
-
-	cd "${MY_BUILDDIR}" || die
-
-	# see Note [tooldir hack for ldscripts]
-	emake V=1 DESTDIR="${D}" tooldir="${EPREFIX}${LIBPATH}" install
-	rm -rf "${ED}"/${LIBPATH}/bin || die
-	use static-libs || find "${ED}" -name '*.la' -delete
-
-	# Newer versions of binutils get fancy with ${LIBPATH}, bug #171905
-	cd "${ED}"/${LIBPATH} || die
-	for d in ../* ; do
-		[[ ${d} == ../${PV} ]] && continue
-		mv ${d}/* . || die
-		rmdir ${d} || die
-	done
-
-	# Now we collect everything intp the proper SLOT-ed dirs
-	# When something is built to cross-compile, it installs into
-	# /usr/$CHOST/ by default ... we have to 'fix' that :)
-	if is_cross ; then
-		cd "${ED}"/${BINPATH} || die
-		for x in * ; do
-			mv ${x} ${x/${CTARGET}-} || die
-		done
-
-		if [[ -d ${ED}/usr/${CHOST}/${CTARGET} ]] ; then
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/include "${ED}"/${INCPATH}
-			mv "${ED}"/usr/${CHOST}/${CTARGET}/lib/* "${ED}"/${LIBPATH}/
-			rm -r "${ED}"/usr/${CHOST}/{include,lib}
-		fi
-	fi
-
-	insinto ${INCPATH}
-	local libiberty_headers=(
-		# Not all the libiberty headers.  See libiberty/Makefile.in:install_to_libdir.
-		demangle.h
-		dyn-string.h
-		fibheap.h
-		hashtab.h
-		libiberty.h
-		objalloc.h
-		splay-tree.h
-	)
-	doins "${libiberty_headers[@]/#/${S}/include/}"
-	if [[ -d ${ED}/${LIBPATH}/lib ]] ; then
-		mv "${ED}"/${LIBPATH}/lib/* "${ED}"/${LIBPATH}/ || die
-		rm -r "${ED}"/${LIBPATH}/lib || die
-	fi
-
-	# Generate an env.d entry for this binutils
-	insinto /etc/env.d/binutils
-	cat <<-EOF > "${T}"/env.d
-		TARGET="${CTARGET}"
-		VER="${PV}"
-		LIBPATH="${EPREFIX}${LIBPATH}"
-	EOF
-	newins "${T}"/env.d ${CTARGET}-${PV}
-
-	# Handle documentation
-	if ! is_cross ; then
-		cd "${S}" || die
-		dodoc README
-
-		docinto bfd
-		dodoc bfd/ChangeLog* bfd/README bfd/PORTING bfd/TODO
-
-		docinto binutils
-		dodoc binutils/ChangeLog binutils/NEWS binutils/README
-
-		docinto gas
-		dodoc gas/ChangeLog* gas/CONTRIBUTORS gas/NEWS gas/README*
-
-		docinto gprof
-		dodoc gprof/ChangeLog* gprof/TEST gprof/TODO gprof/bbconv.pl
-
-		docinto ld
-		dodoc ld/ChangeLog* ld/README ld/NEWS ld/TODO
-
-		docinto libiberty
-		dodoc libiberty/ChangeLog* libiberty/README
-
-		docinto opcodes
-		dodoc opcodes/ChangeLog*
-	fi
-
-	# Remove shared info pages
-	rm -f "${ED}"/${DATAPATH}/info/{dir,configure.info,standards.info}
-
-	# Trim all empty dirs
-	find "${ED}" -depth -type d -exec rmdir {} + 2>/dev/null
-}
-
-pkg_postinst() {
-	# Make sure this ${CTARGET} has a binutils version selected
-	[[ -e ${EROOT}/etc/env.d/binutils/config-${CTARGET} ]] && return 0
-	binutils-config ${CTARGET}-${PV}
-}
-
-pkg_postrm() {
-	local current_profile=$(binutils-config -c ${CTARGET})
-
-	# If no other versions exist, then uninstall for this
-	# target ... otherwise, switch to the newest version
-	# Note: only do this if this version is unmerged.  We
-	#       rerun binutils-config if this is a remerge, as
-	#       we want the mtimes on the symlinks updated (if
-	#       it is the same as the current selected profile)
-	if [[ ! -e ${EPREFIX}${BINPATH}/ld ]] && [[ ${current_profile} == ${CTARGET}-${PV} ]] ; then
-		local choice=$(binutils-config -l | grep ${CTARGET} | awk '{print $2}')
-		choice=${choice//$'\n'/ }
-		choice=${choice/* }
-		if [[ -z ${choice} ]] ; then
-			binutils-config -u ${CTARGET}
-		else
-			binutils-config ${choice}
-		fi
-	elif [[ $(CHOST=${CTARGET} binutils-config -c) == ${CTARGET}-${PV} ]] ; then
-		binutils-config ${CTARGET}-${PV}
-	fi
-}
-
-# Note [slotting support]
-# -----------------------
-# Gentoo's layout for binutils files is non-standard as Gentoo
-# supports slotted installation for binutils. Many tools
-# still expect binutils to reside in known locations.
-# binutils-config package restores symlinks into known locations,
-# like:
-#    /usr/bin/${CTARGET}-<tool>
-#    /usr/bin/${CHOST}/${CTARGET}/lib/ldscrips
-#    /usr/include/
-#
-# Note [tooldir hack for ldscripts]
-# ---------------------------------
-# Build system does not allow ./configure to tweak every location
-# we need for slotting binutils hence all the shuffling in
-# src_install(). This note is about SCRIPTDIR define handling.
-#
-# SCRIPTDIR defines 'ldscripts/' directory location. SCRIPTDIR value
-# is set at build-time in ld/Makefile.am as: 'scriptdir = $(tooldir)/lib'
-# and hardcoded as -DSCRIPTDIR='"$(scriptdir)"' at compile time.
-# Thus we can't just move files around after compilation finished.
-#
-# Our goal is the following:
-# - at build-time set scriptdir to point to symlinked location:
-#   ${TOOLPATH}: /usr/${CHOST} (or /usr/${CHOST}/${CTARGET} for cross-case)
-# - at install-time set scriptdir to point to slotted location:
-#   ${LIBPATH}: /usr/$(get_libdir)/binutils/${CTARGET}/${PV}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r5.ebuild
index 7c9fd71129..c1b0195fae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.39-r5.ebuild
@@ -33,7 +33,7 @@ else
 	[[ -z ${PATCH_VER} ]] || SRC_URI="${SRC_URI}
 		https://dev.gentoo.org/~${PATCH_DEV}/distfiles/binutils-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
 	SLOT=$(ver_cut 1-2)
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 fi
 
 #
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
index d8c2553ece..b6d2c543fe 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils/binutils-2.40-r5.ebuild
@@ -19,7 +19,7 @@ IUSE="cet doc gold gprofng multitarget +nls pgo +plugins static-libs test vanill
 # PATCH_DEV          - Use download URI https://dev.gentoo.org/~{PATCH_DEV}/distfiles/...
 #                      for the patchsets
 
-PATCH_VER=2
+PATCH_VER=5
 PATCH_DEV=dilfridge
 
 if [[ ${PV} == 9999* ]]; then
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/bison/bison-3.8.2-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/bison/bison-3.8.2-r2.ebuild
index 42bf81dc87..85df0c845d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/bison/bison-3.8.2-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/bison/bison-3.8.2-r2.ebuild
@@ -91,7 +91,7 @@ pkg_postinst() {
 		if [[ -e ${EROOT}/usr/bin/yacc ]] ; then
 			# bug #886123
 			ewarn "${EROOT}/usr/bin/yacc exists but is not a symlink."
-			ewarn "This is expected during Prefix bootstrap and unsual otherwise."
+			ewarn "This is expected during Prefix bootstrap and unusual otherwise."
 			ewarn "Moving away unexpected ${EROOT}/usr/bin/yacc to .bak."
 			mv "${EROOT}/usr/bin/yacc" "${EROOT}/usr/bin/yacc.bak" || die
 		fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
index ba7fe333bd..766d8b19ae 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
@@ -1,2 +1,3 @@
 DIST gcc-config-2.10.tar.xz 18040 BLAKE2B de902fcf9169290a09988b56fa75f1bf24f702ce98a8fe37b6d4fe090bab615716c32a9e219d25a2257c60099eb4424b86cc1a1565c1b4f3dbcd6c9acad6f340 SHA512 cced56c52d97cbace5fb7e1fc9c73b413454bc5c53641c9429a7da88a0b31db2c70a8b90a4b4b0fbe1e732f21a5f979a4721a7bc8537666f8277b7755bd4af52
+DIST gcc-config-2.11.tar.xz 18068 BLAKE2B 0d76321adea9eff545e042ad847b70a5b3d8ecb8c248fdf58f71c88a7b03c0aca39f7d39e332808b89c3f6d0fb3fc3114bc2d8dfa1ade6460c0b12c3420d876f SHA512 38ea52c2d16287fc2c8efa0ee76e24563851b4fa1ee7dce601507df1530e7a867281f178ad4228505eb2aaf46164024a18825cd6771d847ff1a60a85d6e96d3e
 DIST gcc-config-2.8.tar.xz 17968 BLAKE2B aa34e681ef0c86bb846d89b816b46276f5c7c32974c785a9611a903a4fe165c997a34664abe17aa4d8720a96f194054e5d8c371a6c9270b1c235d7539094436c SHA512 5e91df44fb7782b9ad41ed06fbd53f74868c059f892c6c2b8195ebaa899905dd9f502562887f1a3765dd6b61698e956d01c6fa6f97a535cf16e26e70fcd902ba
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild
new file mode 100644
index 0000000000..1b01042208
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/gcc-config.git"
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Utility to manage compilers"
+HOMEPAGE="https://gitweb.gentoo.org/proj/gcc-config.git/"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="+cc-wrappers +native-symlinks"
+
+RDEPEND=">=sys-apps/gentoo-functions-0.10"
+
+_emake() {
+	emake \
+		PV="${PVR}" \
+		SUBLIBDIR="$(get_libdir)" \
+		USE_CC_WRAPPERS="$(usex cc-wrappers)" \
+		USE_NATIVE_LINKS="$(usex native-symlinks)" \
+		TOOLCHAIN_PREFIX="${CHOST}-" \
+		"$@"
+}
+
+src_compile() {
+	_emake
+}
+
+src_install() {
+	_emake DESTDIR="${D}" install
+}
+
+pkg_postinst() {
+	# Do we have a valid multi ver setup ?
+	local x
+	for x in $(gcc-config -C -l 2>/dev/null | awk '$NF == "*" { print $2 }') ; do
+		gcc-config ${x}
+	done
+
+	# USE flag change can add or delete files in /usr/bin worth recaching
+	if [[ ! ${ROOT} && -f ${EPREFIX}/usr/share/eselect/modules/compiler-shadow.eselect ]] ; then
+		eselect compiler-shadow update all
+	fi
+
+	if ! has_version "sys-devel/gcc[gcj(-)]" && [[ -x "${EROOT}"/usr/bin/gcj ]] ; then
+		# Warn about obsolete /usr/bin/gcj for bug #804178
+		ewarn "Obsolete GCJ wrapper found: ${EROOT}/usr/bin/gcj!"
+		ewarn "Please delete this file unless you know it is needed (e.g. custom gcj install)."
+		ewarn "If you have no idea what this means, please delete the file:"
+		ewarn " rm ${EROOT}/usr/bin/gcj"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index cea6532a14..9a933fea44 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,30 +1,32 @@
-DIST gcc-10-20230119.tar.xz 72112952 BLAKE2B 6e28cba9f6ff5c9f9231828bb400c82b8658a4f9c0166c28a6a12d71728d4460904152a8c84bbeff88c06b7f9378937b7b61bf4a871a10c56bd005170dc5fde2 SHA512 6cbb567ef1da1b6fa65892b6e71c3b7cd37e0c483e049720ea1987d444a0e7b4eb15d1e99f4e35995acdce560a811a779574eeba52bb252c61325accedd6a5c5
-DIST gcc-10-20230302.tar.xz 72112120 BLAKE2B 8647639d9c6aef31b63566b006bb2980ca974e4aac4f5ced5f12a4f7fe0e9bda1e456d31f13dc478ab187d5e739ac850dd7dcc9db421ece1cadc50c952dbbed4 SHA512 97f72699b1a38de0dfb95253dc1602400fb05c2466b3682e51a4793d17db62e1d55b8d19211c3326e5369aace2a74345059b4b1c1a61a1f2c1c75a0aa9ec3e0e
-DIST gcc-10-20230419.tar.xz 72143336 BLAKE2B ffe2c39a0e99900d0c147908b3e2ebefff24460ec77b4835ae8ecd21bdc7e5b45865dbca16ff92e5ec7df6d0fa6c7629a77e2cf7d4113696bb6b25e42f6e24d8 SHA512 d1465b4b2f5c5d80c9d8fd6c4843246dea40c0d71925de47cdcb4ba2c426457dca876fefe7a2e46bd8bd933d28203aaab65dac12a981a2451716ff24584a40e8
+DIST gcc-10-20230426.tar.xz 72118868 BLAKE2B d87cfd78d96585877abc20ed213e4d2fba36556279a5bce5d185de34a59f8cde1250d7322543533922ef224ac8508c1d3fe597c652a648e6e7f08bc19cb2f11c SHA512 805fbb840e6bd8cdd53f954b13c768c0ea0635c099094f6f0b0b04f00120dcde7cf3950a01e199d674b39ff764e9119a548b2f7a156ab2b5d598bd68ed56ce24
+DIST gcc-10-20230503.tar.xz 72130916 BLAKE2B f0dd2c3afd7c59061672f2d0a6291a8c4ba97060199e3a590a2077af69daf269610008e3ce85a00231a8392fd8f53b4c75ec4ec0e0feb360600705b8e88e41fc SHA512 ed3dbadc6445b5db699309a9f5bd047454d863135a1a3c2e379a7f51bfbf0f49dd176239ccb312e9dd0f7e93be35862867b85d761db2ca6943ae08cd2b0503ed
+DIST gcc-10-20230510.tar.xz 72137544 BLAKE2B 8f0c4cf89e03e7c7589ae67875c35933837f71da5526b2f38c71d557dbb113849d3e66e8f6d03cfc51ab0d047b4e7cf066301ad8805a8c0797a379feefc4f6dd SHA512 b83cc9a8939a5d4d5cf44ff49d082bd66d8f0e4059a25279fa9fe8e458d0c8fc17a9718188821d64e7afcc47000310f8578e00f18d86079abd6b551a8b75fe42
+DIST gcc-10-20230517.tar.xz 72135000 BLAKE2B 8ec87088ace2bf7cc355357b8c9b12e61646366ee1204a360f3be0dcc8b7d426ba5fbb7eb46b4da4c937f5b63d2181a3935f2894f40556f1472dd2a91197b38e SHA512 ae685e1e3fc3460ea49bd86b2b583ef97c71ed279cce6f06b293bd9c7f7ac5ae477b2f2057c4ed927114249e41f6f7978f13db678cd92935dc1250bdd11c94c5
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
-DIST gcc-10.5.0-patches-4.tar.xz 17880 BLAKE2B f368b741fd42199c85b770ec45a5232d27295cf7796163251f24fa963f2264c473e161bb34e66b43c4b227e41859d540a66331111392478b280b289d359806c6 SHA512 94f7fbd1b4672f0378c85ac3a96f7954cd22bd7cc1013c32519bbe1cae0ebb5183e14469c61dfc9d931b8d1c261f2ead1c4b47278104d1b5189a0c787aabc40e
-DIST gcc-10.5.0-patches-5.tar.xz 17324 BLAKE2B e97b471fb6115fd0421be8a6390f7d88312de7ac0132fde3aa43dbf2a49d3bc640ec05f766f20363f033adeaf0430e90c42b5a6f92a422d1a82128f119e769f6 SHA512 2589b8a3be0bc60dd7b205ef9955dfd1ba525508879b30ee8057779d2677783c7c13a0bf901bc2a126e15c52d440663e6fe22a299d935e0706a037406e1cfb31
-DIST gcc-11-20221209.tar.xz 76240768 BLAKE2B 3be0f1ece4473bbbf10f7242102f330a6e246c8481da5bd32620dcb15d2acd008bad60d2576a301f03e444e3d93a3c72d5184740c6fb3de2bc05e1863b68a0bc SHA512 33d9581d434c012526eb4d49a4453cf77c57b459fd43f84e49bc764745e0772939eac007e119269f4f1989755df8678613732a84474c691b0c2452237c5b38a3
-DIST gcc-11-20230120.tar.xz 76201244 BLAKE2B 07bc819dad3e2ee3747f09f43fd73a4263f06274362728174b32d9ead52ea95c25ea6a192397378b9b4c4f958285d97488d28e425c26129d23f143b1a8668fbc SHA512 81f71aeb706b4ccb89e2af5201770fd72cc3190b9b5eac0b5a25a522626b9c4015a2e5d13e4bd1360ac0f7f1be27df51fc530c15ce3c3d782f39f34d5c58803e
-DIST gcc-11-20230303.tar.xz 76131828 BLAKE2B ad73cf9b11f4a70be922ebc2a934e8d5f863582ebb662fe74c71b5880c9d6617cc80233456bde70a7867d788fa1f72262f1ef069f23ff85a423c5eede3e7d3c7 SHA512 3b310b87f7d7423a727f2348038add5b76f923b0baf528d061e45a1030eefb538f4175866dc6e7e70852a794de0ab62798965ea1e574bfe62ccae35fe4b2b00b
-DIST gcc-11-20230420.tar.xz 76157984 BLAKE2B cecfc4fc8d743f190e7ff328de0c043dcf966553657997af5bc565d37b920c942f18882cdb5fe0dbd4e623742237d45ffe3d266194fa45ded8bf54ff2f28fbde SHA512 dba75f1ce3f80f211f5c01c068bc6be538867e9e96637c5091e9f834cf0a36a7ea44447f8194951fea770bc6b97a0ba8303b710001978b4e38206ed8e7760742
+DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
+DIST gcc-11-20230427.tar.xz 76165128 BLAKE2B dd896b418c1fce35a61005d5b5c90cfd1246d37d23c2a8fc08bacd7d7ca84c353f3ccf5de2370ae5e5ca95c7ae3deab3565b3f65eb78b611dbe5ad4a256516f0 SHA512 fada917a832be5d2e15ee32f24e19fc87b851dc8e6fc75d1be6d25d3510dba408ae3ef3b245ff239c51aa3d243c95f12269695611e5c8965ba55f5aa4730778d
+DIST gcc-11-20230504.tar.xz 76185732 BLAKE2B d8bc17e7a38078e2ffe918ba70ba7ec53aada1c604b6cefc54c577f965d46634de1a94b985cb3fd8417f12217b29a67e1ff2c10c342eca85a3185ad2a4e0373c SHA512 e5c423a6049b11b8f1de776b861bd2eb86d1ce939a14c7bbe6244ee74ace2b3cf079135a846f71706f5996172d0e1e0695420938e18d990140d19bcc28dd10b5
+DIST gcc-11-20230511.tar.xz 76188960 BLAKE2B 9241ea149cfd7ebabed4e255fd60924a4759c2e4c13edf2e84e7f2c129af6740eb9a22a353e14a05c4302b3e75df2a165a6ec23adc40247aa47f483173d36e64 SHA512 c265ad11858138c63eb7379abd625b126b6d21fe69c64429b4401dbc8ed625a5e5ba0ecf96da36b497121e0d613b11abee0a97b90a8a56bf240bf142f749852e
+DIST gcc-11-20230518.tar.xz 76192980 BLAKE2B 8397a32e6f5800b3ed7be3d7f4afd03511ecd39e93b210a73d59a9a6bf9a7daf8e20524842a661597727df16548fba1a650884d7a4518d647387cd48825116de SHA512 5259726703a8769e0a170dffdb84ce605ac43289b13a9b2cbb95fa19a9abc37859176e5184ca8958e209991ebe4eb9e3ce2fe22f66c7cec1d434a630a68d50c3
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
-DIST gcc-11.4.0-patches-3.tar.xz 15200 BLAKE2B a393df941a2a31164f477d6bc0032e28319e8f0bd87200eb453708f85aa8c0bf5d67e733ee7b75cf6d14743e18cc941cee1b77a8247f8c5683d17a98cbeb280f SHA512 6f6096d95c7c62780d1070097739882393a8df5172c3a5ae811a8d4d1c98a0cd14a34f3f7e95410c8f210aec434330ac3b8876c688faeb130d7bb8fa3333ece9
-DIST gcc-11.4.0-patches-7.tar.xz 14416 BLAKE2B 3ebf62cba04cac8830a93a99d11c21347c38891db3a81493a10e02e8b7af0c86389ffbede50672dfe1189a77a67b832f8f97a1d95d43eff11db131a143b1d03d SHA512 41e2ed1ccf6d3631accccdab057877c79c99eb1b3c32f9d35628bca6c633c4f8dadb1d7f93bed2e4d7ff9f36cc9e46ea00f0e57e8af64b2e5f4b3b01285c6da3
-DIST gcc-11.4.0-patches-8.tar.xz 13788 BLAKE2B a1406d5dcd906ed51ef06bb6571c216d83f74ab5ba05d2f1783d20619ee4ae9a4aa60c15917c861c24b708621b1605411011df9d217472f92001ec1c59a22b5b SHA512 b18b068422911216063948e21f0ec01073edb45c828a351282730111642638a0a42b97394a3f7522f892fe79e30b391372c829b542ce64fd0dc58c2a83f091bf
-DIST gcc-12-20230121.tar.xz 79652428 BLAKE2B f4f0e6474d179454dc56dd05c823fca919a894e9efdc64625bb13045c7bd549a7bab59dfb4052d45d594d4484801ab5b18cf3f3d6277be54eaec24a53abd439c SHA512 b6c2486916418a64fab64c3655329bc18ca93ee4eca240e8779bd6d8280124fcd07b1aa8eff979fd317656646ecdba9353107887338354d8bd2c1f68c1609349
-DIST gcc-12-20230304.tar.xz 79683276 BLAKE2B e02622f1193ba17dd1041eae0c2f594b26806b00cfb269e683cc356d6d405ae8a49e60823ed6f814d2aac820ef01d9004f68d628a853be139fa6a70e8601ba2a SHA512 0c23a8845c8f202b0c0e4aceb3104bf76c0aca9171ba65d292057703d160fc4ce0b0d7c8876cf1bb30f998c4a5a0a8f3c4165dd4d8d316019cff0dc19aa62182
-DIST gcc-12-20230421.tar.xz 79737436 BLAKE2B 2522ecbe91513d4f008b6a3f2acfaf13f925b9f95293dcbcb04499cf69b7c6cd1c5042113a0e545ee2afd78cf99c96c36042150e450ef33ff040c9fa9fb9eefe SHA512 140ff8e4f387284e070b22f22e51f3aa09ada233dc2bca90894f4b0dbd3e9532f266c8606bea6152afed3eedb853548247f133e332e23f7c6bf380fa61b54b96
-DIST gcc-12.2.0-musl-patches-7.tar.xz 3652 BLAKE2B 295ea907efea854a3c2447d472bedb24714d78b7b725476b1eac3898d89c0c549da8e69db28911205bb3293f62cf344a90ade0898ecf5fed57ff00fcf8547a9f SHA512 7a7a440bc08de8dcb37c080ea0c27904adaaadaaaafaab24d90becd2d009243dcfc886d8f674ce3ccddb4ebb5ad17f04d841064d9ec2e2e2e96a1afac3002111
-DIST gcc-12.2.0-patches-10.tar.xz 14252 BLAKE2B 99368db982227728a6a9e2b1f694999f041f38db4a3806b6a740c86218735f9b561197bc150423a3caad0b5fd335c95d1aca130a519754423cd44a083e655373 SHA512 f7f0d8185e908926046f579793dba5916dc27392b85bfe50a7e70c213c3ba29479dfdb1b27514765b76bc897c4dbb530680e59c4deca7a245a808ed566120e4c
-DIST gcc-12.2.0-patches-13.tar.xz 13756 BLAKE2B df0388a669458f2991951d2f4027badbff3f802e6a0422478206b5cdda76e70b531a474d2ac42817e9e7f8200e9ac35ca8276af539839b4ebb2e22903ec25a23 SHA512 2970de9d2806d59c5d0f77e66000860c816ebd674489db8114f48f6aa11575644154431480222580b520b9e312647b06f94ab38959a49a8cda818158d6babf1d
-DIST gcc-12.2.0-patches-15.tar.xz 15352 BLAKE2B 36e5a0fa40d1a202da02187bc752f20868375e5e2d95b88b2d5f90625da223286cd006f258d390a004d0fa9d019e04063bb79900590333854b5d668233c7a91c SHA512 150ec959d45c883bf15b9801baf53665b78d57aeb6fe135af6eadad5fff36fb38431e51f95e5e3bf4c43b54e873f16f26d7746bf4c81ac57fff7acbff0db342a
-DIST gcc-13-20230422.tar.xz 83937896 BLAKE2B b1643c351a9af6aac9718cde8606e19dc8845b179fa0b71caf7dfa3aba91692d5959733ebb27b714a0aa457944947b57575b669137af8629e6e4503ad64d94e8 SHA512 cfc67ce04ebc2b436ad555f3e0beb20235759d7d4b3a612ce2d7f1b82024b6af4b375cb191541ecfb95e7f8d7a624e53b7e6014f85505497d04ee42cf266bb9a
-DIST gcc-13.1.0-RC-20230421.tar.xz 91762984 BLAKE2B e939f1c9d672c32cbdfc9be12367265a9c4c68a7d7fa33c32e78b449504e2228158c27a6f37982ce5a8b5790fa0886676bab4c8528a6f0717b03122382334072 SHA512 bc0bb66d6ef875e5e36c9836ee0294af46e19d2d50eb85ec2a599d6e5e67bfd994f88067debc7c42ea63a64737a90aced44ec006b4d67a134260872128050c16
-DIST gcc-13.1.0-musl-patches-1.tar.xz 3528 BLAKE2B c572ab4a0fb929b16ec36b3a3616cdcccd62f7ee27ded8077008b9beb50539db64cc251ff8a3eade54e8ebfe1012f8f32d0802379bf8ffb0f1b8ce7c8457da37 SHA512 ffb7dfa54a9d23b5333664e915efd9f18a43cd696f4ff5669a8b072a0e9cf4978de53e315123542441a2533e4f269de0bb7d90ee7a37d3a7517b7cda6ea06681
-DIST gcc-13.1.0-patches-10.tar.xz 12444 BLAKE2B e9cf63925ee8fdc3381fa68b6827c835072e26a89c478b7e0f48c9fa91c3dc524116fab01597ad82c9867908cf39da5d1cea1add64318ce47a25094ffdd665fe SHA512 81401b288c66b19f493a8306820a07118b0052cf827d3fcee107192a05230d81fa130899053ef88a2ef453e9d5f24f2929e1d2f54a424fa97a82feef2499be24
-DIST gcc-13.1.0-patches-9.tar.xz 11720 BLAKE2B c26a2924fa8aab318a1f4a4974ca4aeba255f3605fa0cbf448a4e48b6f3e9359012aeae15726299059257b93043c5cdd86bf1b2f2fffd4b9a096ab411a0503ba SHA512 98e48abaa664ea18bf00ba7bdb29cc1e908cc55ba9d12d52061e86fc917753ade8e38a190c04d23c63102808ac5a9e8ecf085dcc29a1568a329ceb5d43cf0290
-DIST gcc-14-20230423.tar.xz 83968044 BLAKE2B 0ea88ec50e20b6936b6fe56179b8cd254e739c61143b6d80dd6b10b2c063e89a9459bdf5371bf80fddd52dd2bafa79197bd4ccb0728d19382b70938ba87f7069 SHA512 ed5955316b2ed5df1300cb3526542cd6adaca0b99692f4dfb6b1c68b5e075b863599eb0ad43aca2b15b535be5a117f5be4ab7823bf810e0fdd8681faa8c7160d
+DIST gcc-11.4.0-patches-10.tar.xz 13852 BLAKE2B 54937d13e30e2a5303c7e197fae09eeed35ca0b9783625e02578fcee829b5503fb22d664366322b304df7d01ae807d00af7c93db3e3ceebe4851e15647724f87 SHA512 31b4d7a2e7cc589e92e12c3583d13d41c523cafbd309bc0532df9b68ea2473c89daef4c0edd3ce2917b5823d81a7792f145b9449f16277d0d64c22ceff50bbb9
+DIST gcc-11.4.0-patches-9.tar.xz 14704 BLAKE2B 9aa2ecbac493d3040694e9930738e57d59a764b90ab92b91709c319b883f28ad108767e5d11e8b62af40bf1e583d5ff83a03e8c895f904bc6f41315ce9ab4f0a SHA512 ac8b7c6c382ffacc4e9d08299440fc237fa366ec36fb8eb7a8d426b64a4186384a262e6380dc83ed7f7240125ce26a8435c8a4e0e13976ef2652067a7129bd17
+DIST gcc-12-20230428.tar.xz 79744932 BLAKE2B f9d0000cdd2f1b0af79f281851b3b0fe0ac50f14468844e1ee596f8ed1ccf33f55c7617464d88df7e4b3435d58fedecf640592e0661fd1be9ba163acd26dae68 SHA512 992f9cd71f9910efea401048540ba2b43360170f76ce992cf356b1ab383240f481e29c5b0ad32fa4efb2bdbb397477506cb83a825268cfbdd2cde7044d43c758
+DIST gcc-12-20230512.tar.xz 79749352 BLAKE2B a2dd7c780d2adf1915cb01f6835d6f95242376d9d7c14ec0fea8e905858f0ce20b90dd3f47fef983b9d1a6f519f0c3d4cfa41d887f477454378a12407e9aaeb8 SHA512 3bf04b2489b0b0d062f8e8e66c31622fe7aa6ef6c9ba7d51f387eae714a813a089594cebdb046fa04e53da24a9788879711eedb054c3a37721035386b94ff0f0
+DIST gcc-12-20230519.tar.xz 79757700 BLAKE2B 81c18adedc9f0eae729a72814a47ae496c9ae78f13e9cf2f442b3ea09c577e84e3261a6004d1634125bbc77c39298328a0879eea1dab26966b85f9f10887f114 SHA512 cd24ad69a6c47a95384d8fd4fcb7e895f8fb4d8e0c4b74d1300943fa8198624e3c40b0bd7702cb78f40849a09b5069e50e36bc191bd206b36c956ca25126ee02
+DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
+DIST gcc-12.3.0-patches-2.tar.xz 14236 BLAKE2B 06c43662c9abb0fa3cf90d5e2273c69aecb9158e6cf6f23c04754ed5d686be2616e81e2502eb16f4298ddd50518ca7677e13249da9e9b091162d3931ff65e4fe SHA512 b0d4b85dbf1a54aaaa1997203b872e3106906b4ad49cde57e1428bc22b2f8e2d73b8cb10ae0d0b792aebaf664594da4d1dea04c44ddc34e59047410766db04d1
+DIST gcc-12.3.0.tar.xz 85491976 BLAKE2B a239749089e284887435b9fabc360a36764be1095f4c78eeac6f056f91dd23c49dab2ebec5da32a81bcc08fe8277dd3c714ad114ad725d24317faac03354d595 SHA512 8fb799dfa2e5de5284edf8f821e3d40c2781e4c570f5adfdb1ca0671fcae3fb7f794ea783e80f01ec7bfbf912ca508e478bd749b2755c2c14e4055648146c204
+DIST gcc-13-20230506.tar.xz 83939392 BLAKE2B 439a139f6ef4b4c3afb5d3e4db69f2a4aa24a410c7b9c6689e58b2eec6383388ebbbd8a6f7be1d5cba2aac770ec7758a8b4b6bae80c63475a3b72372d1bef283 SHA512 5255500c92a72fe066b110efb20c73da217ddaf38d726b1a8f051dd27b6a613f3b4379762cdf4310823113e9bc75a31d6d72c060b20216a2a6bcd34800a2e1e1
+DIST gcc-13-20230513.tar.xz 83957000 BLAKE2B c1d17c383b5735744952ef61fa34f0129b304cae78dbeb0e780a81ec4dbfbbc438f8546770da973155ec5f9250d36be587a8491c88d4424b1123f47ba24d52eb SHA512 a82e38d273a668e4a8ad33282cb74661d125babcc6165eb0ada5da471154b2ed2894bf1fa462f0345f9d817e733b155c09a971885f3b7c04398ebcdd3b5551f5
+DIST gcc-13-20230520.tar.xz 83959400 BLAKE2B 7be5d333a2447923c547ed76bab86fb9a1206dde1ffeb8be0a2cb95f8e99910aa40479f221374aaf5bdea5dd7514b3d69347512d9cebb91dd23f585541efa43a SHA512 d6c8626822855f71cc58b6b36ebb38092aaf12fa9aa40b8d70fb3edc9f4c614fbf47626ea5cc1ec631bc47b5d64911bfdb7cfc6924f27a54016b1f8c9c7588d7
+DIST gcc-13.1.0.tar.xz 87451196 BLAKE2B b956a773cffe8b43bd6c9a99fe614f53f665438925a6b320975d301f547923e45d4d6fa577a143467fb03e0a9c1bab2b6719a1011d672367f3e644433a2d7606 SHA512 6cf06dfc48f57f5e67f7efe3248019329a14d690c728d9f2f7ef5fa0d58f1816f309586ba7ea2eac20d0b60a2d1b701f68392e9067dd46f827ba0efd7192db33
+DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
+DIST gcc-13.2.0-patches-1.tar.xz 15792 BLAKE2B 2ffa9ac013c0f9a91eb93e87e3bc6c378d02cca32ad3f8a84d1249e257eb02b206ec10fa425738a4bae2ffb7db8506afcee2a8dd855357e4b48636608aa24e50 SHA512 917ea178f3696724f9ec08aebb6976f03c5edf8ee21bb4bad7e2d820507452f6dace6e847c4f342a52870642550f34da0346ee635a60ba0c1bff667e0e31d195
+DIST gcc-13.2.0-patches-2.tar.xz 12392 BLAKE2B 40ca4c230166e39d237e4b939669e51b991f58d0e1787c43f2bf468447de478604d28b6e9b20f5991bd01b9efad4860b30567c8df5d823cf6fc47678f9e6b672 SHA512 d00f559b2d6ad98f97a9328d2ce1593553fff727033690dfc13f520775e977b674fe14cc1ec7ab52b246e091a055812eaf4f93306145a4d2ad87a55707a3717b
+DIST gcc-14-20230507.tar.xz 84069364 BLAKE2B 579df5cf4b0d16aa29248259e235dd7c05454c8c5b999928cbf200d52997e0615391e06308e9e0a72f7a1f1903cb86305137eceb97cd8ddd0cf40b4a21a05a86 SHA512 1598b9565bc9554e91d5be2b58d8c0861b72e97b79aa952c084ae4731c0cd1ca37d107a70b6a26235bf59322c1f4de435389906b4fe6f29b6e65e1b566aff5ea
+DIST gcc-14-20230514.tar.xz 84081088 BLAKE2B e385298bac832374a4773bb4a30fa42f66262378417ce3850c62d69300c76e7a9feae8fb51285edabd9ffed423ac4b688c52bc18d76aa700f255e951ca60f237 SHA512 839a7fbe1210f54b0bcb26e10f9ac26d262924f8d19eef62e33a8bc066c00a549a0b49cff088f5e23656c66f26a28c0721e376cfdd97a54f6a9b2ba3680f5e01
+DIST gcc-14-20230521.tar.xz 84139108 BLAKE2B 5db3844cfa92f2462871581e8d33b3f70d94fa9ddf203055e83c03fdeb60145dcedd1e8d6d2040bc56cdf6213b530a835da3c7b0766fbd538d2f690f5a74ff70 SHA512 8cc629c3f847c34ed35ca84d020a3d7a98ca5e29d15a3073cbfe303ec6c47ef938581283826773fa41268fda77fe723ce1669c4e31e5b2b0f5569d5782c0ebb2
 DIST gcc-14.0.0-musl-patches-1.tar.xz 3576 BLAKE2B 692baee8a7709905d53aeb150d73a3721c4ba47ee5f397cfb1b5be905cf003ca02b60c94ee294d90ac39645cd5cdf186c7a3aa950c47d8cf680c128ed705b807 SHA512 0592ab98a7142e404623a6511c67dff61e9ade32c3fb2c0e75b456306e0af3799ad13252b50b3d2fdd31e5815d7f0b16b0ad63ab8386fe4d78729fc9c182d617
 DIST gcc-14.0.0-patches-1.tar.xz 11612 BLAKE2B a3b0f3952cf7a6fb095817f4727ccb5cff24607a5c2bb67d280da4651177132ddcf398243998271c509ccaf3445d4843ff691a12d5c394dad8d9c70fc4a8120d SHA512 66701c2e4fd1a031ffcb353a3a9cd1fe25d3d62167065523097e41a3e48adf4218ecf08e382e3ea22014c561ba3a15681650c5538cda91d38c69cbbf04503a74
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-12.3-ccache-ICE.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-12.3-ccache-ICE.patch
new file mode 100644
index 0000000000..9a170f5db7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-12.3-ccache-ICE.patch
@@ -0,0 +1,67 @@
+https://bugs.gentoo.org/906310
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109850
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109241
+
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=396a4e76afec30d2461638f569cae18955eb4ad2
+
+From 396a4e76afec30d2461638f569cae18955eb4ad2 Mon Sep 17 00:00:00 2001
+From: Jason Merrill <jason@redhat.com>
+Date: Wed, 22 Mar 2023 16:11:47 -0400
+Subject: [PATCH] c++: local class in nested generic lambda [PR109241]
+
+In this testcase, the tree walk to look for bare parameter packs was
+confused by finding a type with no TREE_BINFO.  But it should be fine that
+it's unset; we already checked for unexpanded packs at parse time.
+
+I also tried doing the partial instantiation of the local class, which is
+probably the long-term direction we want to go, but for stage 4 let's go
+with this safer change.
+
+	PR c++/109241
+
+gcc/cp/ChangeLog:
+
+	* pt.cc (find_parameter_packs_r): Handle null TREE_BINFO.
+
+gcc/testsuite/ChangeLog:
+
+	* g++.dg/cpp1y/lambda-generic-local-class2.C: New test.
+--- a/gcc/cp/pt.cc
++++ b/gcc/cp/pt.cc
+@@ -4106,10 +4106,14 @@ find_parameter_packs_r (tree *tp, int *walk_subtrees, void* data)
+     case TAG_DEFN:
+       t = TREE_TYPE (t);
+       if (CLASS_TYPE_P (t))
+-	/* Local class, need to look through the whole definition.  */
+-	for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
+-	  cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
+-			ppd, ppd->visited);
++	{
++	  /* Local class, need to look through the whole definition.
++	     TYPE_BINFO might be unset for a partial instantiation.  */
++	  if (TYPE_BINFO (t))
++	    for (tree bb : BINFO_BASE_BINFOS (TYPE_BINFO (t)))
++	      cp_walk_tree (&BINFO_TYPE (bb), &find_parameter_packs_r,
++			    ppd, ppd->visited);
++	}
+       else
+ 	/* Enum, look at the values.  */
+ 	for (tree l = TYPE_VALUES (t); l; l = TREE_CHAIN (l))
+--- /dev/null
++++ b/gcc/testsuite/g++.dg/cpp1y/lambda-generic-local-class2.C
+@@ -0,0 +1,13 @@
++// PR c++/109241
++// { dg-do compile { target c++14 } }
++// { dg-options "" } no pedantic
++
++void g() {
++  [](auto) {
++    [](auto) {
++      ({
++        struct A {};
++      });
++    };
++  }(1);
++}
+-- 
+2.31.1
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-13-fix-cross-fixincludes.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-13-fix-cross-fixincludes.patch
new file mode 100644
index 0000000000..e4abe01a08
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-13-fix-cross-fixincludes.patch
@@ -0,0 +1,19 @@
+Revert of https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=59e4c98173a79fcaa2c33253261409f38856c384
+for now to fix cross fixincludes builds.
+
+https://bugs.gentoo.org/905118
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -532,11 +532,7 @@ LINKER_PLUGIN_API_H = $(srcdir)/../include/plugin-api.h
+ # Default native SYSTEM_HEADER_DIR, to be overridden by targets.
+ NATIVE_SYSTEM_HEADER_DIR = @NATIVE_SYSTEM_HEADER_DIR@
+ # Default cross SYSTEM_HEADER_DIR, to be overridden by targets.
+-ifeq (@includedir@,$(prefix)/include)
+-  CROSS_SYSTEM_HEADER_DIR = @CROSS_SYSTEM_HEADER_DIR@
+-else
+-  CROSS_SYSTEM_HEADER_DIR = @includedir@
+-endif
++CROSS_SYSTEM_HEADER_DIR = @CROSS_SYSTEM_HEADER_DIR@
+ 
+ # autoconf sets SYSTEM_HEADER_DIR to one of the above.
+ # Purge it of unnecessary internal relative paths
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230119-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230426-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230119-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230426-r1.ebuild
index 5843e623d2..0219cb2d8b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230119-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230426-r1.ebuild
@@ -7,7 +7,7 @@ TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 #TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="10.5.0"
-PATCH_VER="4"
+PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230503.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230419.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230503.ebuild
index 07a2b5e91a..878de0807e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230419.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230503.ebuild
@@ -7,7 +7,7 @@ TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 #TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="10.5.0"
-PATCH_VER="5"
+PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
 
@@ -36,7 +36,7 @@ EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 
 # Don't keyword live ebuilds
 #if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-#	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+#	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 #fi
 
 RDEPEND=""
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230510.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230510.ebuild
new file mode 100644
index 0000000000..878de0807e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230510.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_SUFFIX="xz"
+TOOLCHAIN_PATCH_DEV="sam"
+#TOOLCHAIN_GCC_RC=1
+PATCH_GCC_VER="10.5.0"
+PATCH_VER="6"
+MUSL_VER="2"
+MUSL_GCC_VER="10.5.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="https://gcc.gnu.org/pub/gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+#fi
+
+RDEPEND=""
+BDEPEND="${CATEGORY}/binutils"
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	if has_version '>=sys-libs/glibc-2.32-r1'; then
+		rm -v "${WORKDIR}/patch/23_all_disable-riscv32-ABIs.patch" || die
+	fi
+
+	toolchain_src_prepare
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230302.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230517.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230302.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230517.ebuild
index d8319f4435..6d1bc02f4d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230302.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230517.ebuild
@@ -7,7 +7,7 @@ TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
 #TOOLCHAIN_GCC_RC=1
 PATCH_GCC_VER="10.5.0"
-PATCH_VER="5"
+PATCH_VER="6"
 MUSL_VER="2"
 MUSL_GCC_VER="10.5.0"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20221209.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230427.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20221209.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230427.ebuild
index 4aaa59aed4..8cf6ba32a3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20221209.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230427.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="3"
+PATCH_VER="9"
 PATCH_GCC_VER="11.4.0"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230420.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230504.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230420.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230504.ebuild
index a30fa066e3..9b57b16f07 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230420.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230504.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="8"
+PATCH_VER="10"
 PATCH_GCC_VER="11.4.0"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230120-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230511.ebuild
similarity index 86%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230120-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230511.ebuild
index 4f34454575..9b57b16f07 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230120-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230511.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="7"
+PATCH_VER="10"
 PATCH_GCC_VER="11.4.0"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
@@ -27,9 +27,9 @@ inherit toolchain
 EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 
 # Don't keyword live ebuilds
-if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+#fi
 
 if [[ ${CATEGORY} != cross-* ]] ; then
 	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230303.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230518.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230303.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230518.ebuild
index 15eaa58a13..a43b016c3f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230303.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.3.1_p20230518.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 TOOLCHAIN_PATCH_SUFFIX="xz"
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="8"
+PATCH_VER="10"
 PATCH_GCC_VER="11.4.0"
 MUSL_VER="2"
 MUSL_GCC_VER="11.4.0"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230121-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild
similarity index 95%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230121-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild
index 18679bf933..bba4e8fe97 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230121-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild
@@ -4,10 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="10"
-PATCH_GCC_VER="12.2.0"
-MUSL_VER="7"
-MUSL_GCC_VER="12.2.0"
+PATCH_VER="2"
+PATCH_GCC_VER="12.3.0"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.0.ebuild
new file mode 100644
index 0000000000..963e5466b1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.0.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="12.3.0"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	# Sometimes the RCs are e.g. 12.3 and not 12.3.0...
+	#MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512-r1.ebuild
new file mode 100644
index 0000000000..922e86050a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512-r1.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="12.3.0"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	# Sometimes the RCs are e.g. 12.3 and not 12.3.0...
+	#MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+#fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-12.3-ccache-ICE.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512.ebuild
new file mode 100644
index 0000000000..4e2eee4f27
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230512.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="12.3.0"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	# Sometimes the RCs are e.g. 12.3 and not 12.3.0...
+	#MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+#fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230519.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230519.ebuild
new file mode 100644
index 0000000000..963e5466b1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230519.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="12.3.0"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	# Sometimes the RCs are e.g. 12.3 and not 12.3.0...
+	#MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.9999.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.9999.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.9999.ebuild
index bf3196502b..c46b53fc8c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.4.9999.ebuild
@@ -4,8 +4,8 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.2.0"
-MUSL_GCC_VER="12.2.0"
+PATCH_GCC_VER="12.3.0"
+MUSL_GCC_VER="12.3.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1.9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1.9999.ebuild
deleted file mode 100644
index 70b6d6a567..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1.9999.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.1.0"
-MUSL_GCC_VER="13.1.0"
-
-if [[ $(ver_cut 3) == 9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=$(($(ver_cut 3) - 9998))
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$(($(ver_cut 2) - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-fi
-
-inherit toolchain
-
-# Needs to be after inherit (for now?), bug #830908
-EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-
-# Don't keyword live ebuilds
-if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.0-r1.ebuild
new file mode 100644
index 0000000000..6dc4f3880e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.0-r1.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="1"
+PATCH_GCC_VER="13.2.0"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230421.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230506.ebuild
similarity index 79%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230421.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230506.ebuild
index 6f5a697b6f..10a0c8381b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230421.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230506.ebuild
@@ -4,10 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="15"
-PATCH_GCC_VER="12.2.0"
-MUSL_VER="7"
-MUSL_GCC_VER="12.2.0"
+PATCH_VER="2"
+PATCH_GCC_VER="13.2.0"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -23,7 +23,7 @@ elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
 	# Cheesy hack for RCs
 	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
 	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="https://gcc.gnu.org/pub/gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
 	TOOLCHAIN_SET_S=no
 	S="${WORKDIR}"/${MY_P}
 fi
@@ -48,7 +48,15 @@ if [[ ${CATEGORY} != cross-* ]] ; then
 fi
 
 src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
 	toolchain_src_prepare
 
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
 	eapply_user
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230513.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230513.ebuild
new file mode 100644
index 0000000000..880709fcab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230513.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="13.2.0"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230520.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230520.ebuild
new file mode 100644
index 0000000000..880709fcab
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230520.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_VER="2"
+PATCH_GCC_VER="13.2.0"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
+
+if [[ $(ver_cut 3) == 9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+	else
+		MY_PV_2=$(($(ver_cut 2) - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.$(($(ver_cut 3) - 9998))
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+# Needs to be after inherit (for now?), bug #830908
+EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+
+# Don't keyword live ebuilds
+if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230304.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.9999.ebuild
similarity index 81%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230304.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.9999.ebuild
index 8f9d881b3c..94cabe9d1d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230304.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.9999.ebuild
@@ -4,10 +4,8 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="13"
-PATCH_GCC_VER="12.2.0"
-MUSL_VER="7"
-MUSL_GCC_VER="12.2.0"
+PATCH_GCC_VER="13.2.0"
+MUSL_GCC_VER="13.2.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -35,7 +33,7 @@ EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 
 # Don't keyword live ebuilds
 if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 if [[ ${CATEGORY} != cross-* ]] ; then
@@ -46,7 +44,15 @@ if [[ ${CATEGORY} != cross-* ]] ; then
 	DEPEND="${RDEPEND}"
 	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
 fi
+
 src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
 	toolchain_src_prepare
 
 	eapply_user
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230423.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230507.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230423.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230507.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230421.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230514.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230421.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230514.ebuild
index f0ad71e33e..1b25d3519a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230421.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230514.ebuild
@@ -3,12 +3,11 @@
 
 EAPI=8
 
-TOOLCHAIN_GCC_RC=1
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="9"
-PATCH_GCC_VER="13.1.0"
+PATCH_VER="1"
+PATCH_GCC_VER="14.0.0"
 MUSL_VER="1"
-MUSL_GCC_VER="13.1.0"
+MUSL_GCC_VER="14.0.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -33,11 +32,13 @@ fi
 
 inherit toolchain
 
+# Needs to be after inherit (for now?), bug #830908
+#EGIT_BRANCH=master
+
 # Don't keyword live ebuilds
-if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 #	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	KEYWORDS="~loong"
-fi
+#fi
 
 if [[ ${CATEGORY} != cross-* ]] ; then
 	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230422.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230521.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230422.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230521.ebuild
index def3a11ef4..1b25d3519a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.0.1_pre20230422.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230521.ebuild
@@ -4,10 +4,10 @@
 EAPI=8
 
 TOOLCHAIN_PATCH_DEV="sam"
-PATCH_VER="10"
-PATCH_GCC_VER="13.1.0"
+PATCH_VER="1"
+PATCH_GCC_VER="14.0.0"
 MUSL_VER="1"
-MUSL_GCC_VER="13.1.0"
+MUSL_GCC_VER="14.0.0"
 
 if [[ $(ver_cut 3) == 9999 ]] ; then
 	MY_PV_2=$(ver_cut 2)
@@ -32,11 +32,13 @@ fi
 
 inherit toolchain
 
+# Needs to be after inherit (for now?), bug #830908
+#EGIT_BRANCH=master
+
 # Don't keyword live ebuilds
-if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+#if ! tc_is_live && [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 #	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	KEYWORDS="~loong"
-fi
+#fi
 
 if [[ ${CATEGORY} != cross-* ]] ; then
 	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
index a0aff53697..67374f76c3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/metadata.xml
@@ -100,7 +100,6 @@
 		</flag>
 		<flag name="ssp">Build packages with stack smashing protection on by default</flag>
 		<flag name="systemtap">enable systemtap static probe points</flag>
-		<flag name="valgrind">Enable valgrind annotations for gcc internals (useful for gcc debugging).</flag>
 		<flag name="vtv">
 			Build support for virtual table verification (a C++ hardening feature).
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/files/gdb-13.1-musl-lfs.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/files/gdb-13.1-musl-lfs.patch
new file mode 100644
index 0000000000..d7778e3059
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/files/gdb-13.1-musl-lfs.patch
@@ -0,0 +1,23 @@
+https://bugs.gentoo.org/905922
+https://sourceware.org/bugzilla/show_bug.cgi?id=30450
+https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=2e977d9901393ea1bacbe1896af0929e968bc811
+
+From 2e977d9901393ea1bacbe1896af0929e968bc811 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Wed, 22 Feb 2023 16:28:22 -0800
+Subject: [PATCH] gdbserver/linux-low.cc: Fix a typo in ternary operator
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+--- a/gdbserver/linux-low.cc
++++ b/gdbserver/linux-low.cc
+@@ -5390,7 +5390,7 @@ proc_xfer_memory (CORE_ADDR memaddr, unsigned char *readbuf,
+       if (lseek (fd, memaddr, SEEK_SET) != -1)
+ 	bytes = (readbuf != nullptr
+ 		 ? read (fd, readbuf, len)
+-		 ? write (fd, writebuf, len));
++		 : write (fd, writebuf, len));
+ #endif
+ 
+       if (bytes < 0)
+-- 
+2.31.1
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-12.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-12.1-r3.ebuild
deleted file mode 100644
index 8eb1d3628d..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-12.1-r3.ebuild
+++ /dev/null
@@ -1,293 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-inherit flag-o-matic python-single-r1 strip-linguas toolchain-funcs
-
-export CTARGET=${CTARGET:-${CHOST}}
-
-if [[ ${CTARGET} == ${CHOST} ]] ; then
-	if [[ ${CATEGORY} == cross-* ]] ; then
-		export CTARGET=${CATEGORY#cross-}
-	fi
-fi
-
-is_cross() { [[ ${CHOST} != ${CTARGET} ]] ; }
-
-case ${PV} in
-	9999*)
-		# live git tree
-		EGIT_REPO_URI="https://sourceware.org/git/binutils-gdb.git"
-		inherit git-r3
-		SRC_URI=""
-		;;
-	*.*.50.2???????)
-		# weekly snapshots
-		SRC_URI="ftp://sourceware.org/pub/gdb/snapshots/current/gdb-weekly-${PV}.tar.xz"
-		;;
-	*)
-		# Normal upstream release
-		SRC_URI="mirror://gnu/gdb/${P}.tar.xz
-			ftp://sourceware.org/pub/gdb/releases/${P}.tar.xz"
-		;;
-esac
-
-DESCRIPTION="GNU debugger"
-HOMEPAGE="https://sourceware.org/gdb/"
-SRC_URI="${SRC_URI}
-	${PATCH_DEV:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${P}-patches-${PATCH_VER}.tar.xz}
-	${PATCH_VER:+mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz}"
-
-LICENSE="GPL-3+ LGPL-2.1+"
-SLOT="0"
-
-if [[ ${PV} != 9999* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-fi
-
-IUSE="cet guile lzma multitarget nls +python +server sim source-highlight test vanilla xml xxhash"
-REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
-
-# In fact, gdb's test suite needs some work to get passing.
-# See e.g. https://sourceware.org/gdb/wiki/TestingGDB.
-# As of 11.2, on amd64: "# of unexpected failures    8600"
-# Also, ia64 kernel crashes when gdb testsuite is running.
-RESTRICT="
-	ia64? ( test )
-	!test? ( test )
-	test
-"
-
-RDEPEND="
-	dev-libs/mpfr:0=
-	dev-libs/gmp:=
-	>=sys-libs/ncurses-5.2-r2:0=
-	>=sys-libs/readline-7:0=
-	sys-libs/zlib
-	elibc_glibc? ( net-libs/libnsl:= )
-	lzma? ( app-arch/xz-utils )
-	python? ( ${PYTHON_DEPS} )
-	guile? ( >=dev-scheme/guile-2.0 )
-	xml? ( dev-libs/expat )
-	source-highlight? (
-		dev-util/source-highlight
-	)
-	xxhash? (
-		dev-libs/xxhash
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	app-arch/xz-utils
-	sys-apps/texinfo
-	app-alternatives/yacc
-	nls? ( sys-devel/gettext )
-	source-highlight? ( virtual/pkgconfig )
-	test? ( dev-util/dejagnu )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
-	"${FILESDIR}"/${P}-readline-8.2-build.patch
-	"${FILESDIR}"/${P}-core-file-detach.patch
-	"${FILESDIR}"/${P}-configure-clang16.patch
-)
-
-pkg_setup() {
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	strip-linguas -u bfd/po opcodes/po
-
-	# Avoid using ancient termcap from host on Prefix systems
-	sed -i -e 's/termcap tinfow/tinfow/g' \
-		gdb/configure{.ac,} || die
-}
-
-gdb_branding() {
-	printf "Gentoo ${PV} "
-
-	if ! use vanilla && [[ -n ${PATCH_VER} ]] ; then
-		printf "p${PATCH_VER}"
-	else
-		printf "vanilla"
-	fi
-
-	[[ -n ${EGIT_COMMIT} ]] && printf " ${EGIT_COMMIT}"
-}
-
-src_configure() {
-	strip-unsupported-flags
-
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	local myconf=(
-		# portage's econf() does not detect presence of --d-d-t
-		# because it greps only top-level ./configure. But not
-		# gnulib's or gdb's configure.
-		--disable-dependency-tracking
-
-		--with-pkgversion="$(gdb_branding)"
-		--with-bugurl='https://bugs.gentoo.org/'
-		--disable-werror
-		# Disable modules that are in a combined binutils/gdb tree. bug #490566
-		--disable-{binutils,etc,gas,gold,gprof,ld}
-
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		$(use_enable test unit-tests)
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-
-		# We need to set both configure options, --with-sysroot and --libdir,
-		# to fix cross build issues that happen when configuring gmp.
-		# We explicitly need --libdir. Having only --with-sysroot without
-		# --libdir would not fix the build issues.
-		# For some reason, it is not enough to set only --with-sysroot,
-		# also not enough to pass --with-gmp-xxx options.
-		--with-sysroot="${ESYSROOT}"
-		--libdir="${ESYSROOT}/usr/$(get_libdir)"
-	)
-
-	local sysroot="${EPREFIX}/usr/${CTARGET}"
-
-	is_cross && myconf+=(
-		--with-sysroot="${sysroot}"
-		--includedir="${sysroot}/usr/include"
-		--with-gdb-datadir="\${datadir}/gdb/${CTARGET}"
-	)
-
-	# gdbserver only works for native targets (CHOST==CTARGET).
-	# it also doesn't support all targets, so rather than duplicate
-	# the target list (which changes between versions), use the
-	# "auto" value when things are turned on, which is triggered
-	# whenever no --enable or --disable is given
-	if is_cross || use !server ; then
-		myconf+=( --disable-gdbserver )
-	fi
-
-	myconf+=(
-		--enable-64-bit-bfd
-		--disable-install-libbfd
-		--disable-install-libiberty
-		--enable-obsolete
-		# This only disables building in the readline subdir.
-		# For gdb itself, it'll use the system version.
-		--disable-readline
-		--with-system-readline
-		# This only disables building in the zlib subdir.
-		# For gdb itself, it'll use the system version.
-		--without-zlib
-		--with-system-zlib
-		--with-separate-debug-dir="${EPREFIX}"/usr/lib/debug
-		$(use_with xml expat)
-		$(use_with lzma)
-		$(use_enable nls)
-		$(use_enable sim)
-		$(use_enable source-highlight)
-		$(use multitarget && echo --enable-targets=all)
-		$(use_with python python "${EPYTHON}")
-		$(use_with xxhash)
-		$(use_with guile)
-	)
-
-	if use sparc-solaris || use x86-solaris ; then
-		# Disable largefile support
-		# https://sourceware.org/ml/gdb-patches/2014-12/msg00058.html
-		myconf+=( --disable-largefile )
-	fi
-
-	# source-highlight is detected with pkg-config: bug #716558
-	export ac_cv_path_pkg_config_prog_path="$(tc-getPKG_CONFIG)"
-
-	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
-
-	# ensure proper compiler is detected for Clang builds: bug #831202
-	export GCC_FOR_TARGET="${CC_FOR_TARGET:-$(tc-getCC)}"
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake V=1
-}
-
-src_install() {
-	emake V=1 DESTDIR="${D}" install
-
-	find "${ED}"/usr -name libiberty.a -delete || die
-
-	# Delete translations that conflict with binutils-libs. bug #528088
-	# Note: Should figure out how to store these in an internal gdb dir.
-	if use nls ; then
-		find "${ED}" \
-			-regextype posix-extended -regex '.*/(bfd|opcodes)[.]g?mo$' \
-			-delete || die
-	fi
-
-	# Don't install docs when building a cross-gdb
-	if [[ ${CTARGET} != ${CHOST} ]] ; then
-		rm -rf "${ED}"/usr/share/{doc,info,locale} || die
-		local f
-		for f in "${ED}"/usr/share/man/*/* ; do
-			if [[ ${f##*/} != ${CTARGET}-* ]] ; then
-				mv "${f}" "${f%/*}/${CTARGET}-${f##*/}" || die
-			fi
-		done
-		return 0
-	fi
-
-	# Install it by hand for now:
-	# https://sourceware.org/ml/gdb-patches/2011-12/msg00915.html
-	# Only install if it exists due to the twisted behavior (see
-	# notes in src_configure above).
-	[[ -e gdbserver/gdbreplay ]] && dobin gdbserver/gdbreplay
-
-	docinto gdb
-	dodoc gdb/CONTRIBUTE gdb/README gdb/MAINTAINERS \
-		gdb/NEWS gdb/PROBLEMS
-	docinto sim
-	dodoc sim/{MAINTAINERS,README-HACKING}
-
-	if use server ; then
-		docinto gdbserver
-		dodoc gdbserver/README
-	fi
-
-	if [[ -n ${PATCH_VER} ]] ; then
-		dodoc "${WORKDIR}"/extra/gdbinit.sample
-	fi
-
-	# Remove shared info pages
-	rm -f "${ED}"/usr/share/info/{annotate,bfd,configure,ctf-spec,standards}.info*
-
-	if use python ; then
-		python_optimize "${ED}"/usr/share/gdb/python/gdb
-	fi
-}
-
-pkg_postinst() {
-	# Portage doesn't unmerge files in /etc
-	rm -vf "${EROOT}"/etc/skel/.gdbinit
-
-	if use prefix && [[ ${CHOST} == *-darwin* ]] ; then
-		ewarn "gdb is unable to get a mach task port when installed by Prefix"
-		ewarn "Portage, unprivileged.  To make gdb fully functional you'll"
-		ewarn "have to perform the following steps:"
-		ewarn "  % sudo chgrp procmod ${EPREFIX}/usr/bin/gdb"
-		ewarn "  % sudo chmod g+s ${EPREFIX}/usr/bin/gdb"
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.1.90_p20230429.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.1.90_p20230429.ebuild
index d75794a286..e6030f4783 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.1.90_p20230429.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gdb/gdb-13.1.90_p20230429.ebuild
@@ -111,6 +111,7 @@ BDEPEND="
 PATCHES=(
 	"${FILESDIR}"/${PN}-8.3.1-verbose-build.patch
 	"${FILESDIR}"/${PN}-13.1-Wenum-constexpr-conversion-clang16.patch
+	"${FILESDIR}"/${PN}-13.1-musl-lfs.patch
 )
 
 pkg_setup() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
index 60579c5263..d704bd09bd 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/Manifest
@@ -1 +1,2 @@
 DIST gnuconfig-20221007.tar.xz 71208 BLAKE2B 9112bd82af083043d5eae3a5ffde8174df842f3a817b1b42c17e3202a9189cff8e9f422e956e1cdd82e326949a23e27a353f72f98a6f63818e5a67096f650fed SHA512 91ca2faca02d5d78f937da70a4af026b1ba585519b9eaa2463cacd79f0f6a85ef6e1f7e0bed4243474b6e880c0b6387ca09f00eb2d40a27c3a26b6817b1bb70a
+DIST gnuconfig-20230121.tar.xz 71276 BLAKE2B c136c11f2836cc01c4a75b54853b14943b1e4b29a99102360b436854b1a6e445f578fea494b5c7fe2f744d35941c0ea888a08a386dff716b99dd231a308bffcf SHA512 5ac6c50b9c0abe7c007717aeff2d2d6a8e616d7c8514ed22489ad0164c16966cf44f2312bc3295765f5beaf98bb14022d91c5c59e9fb41e920617092a22d42ec
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230121.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230121.ebuild
new file mode 100644
index 0000000000..f0b59ba79f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-20230121.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 99999999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/r/config.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris ~x86-winnt"
+	S="${WORKDIR}"
+fi
+
+DESCRIPTION="Updated config.sub and config.guess file from GNU"
+HOMEPAGE="https://savannah.gnu.org/projects/config"
+
+LICENSE="GPL-3+-with-autoconf-exception"
+SLOT="0"
+
+maint_pkg_create() {
+	cd "${S}" || die
+
+	emake ChangeLog
+	local ver=$(gawk '{ gsub(/-/, "", $1); print $1; exit }' ChangeLog)
+	[[ ${#ver} != 8 ]] && die "invalid version '${ver}'"
+
+	local tar="${T}/gnuconfig-${ver}.tar.xz"
+	tar -Jcf "${tar}" ./* || die "creating tar failed"
+	einfo "Packaged tar now available:"
+	einfo "$(du -b "${tar}")"
+}
+
+src_unpack() {
+	if [[ ${PV} == 99999999 ]] ; then
+		git-r3_src_unpack
+		maint_pkg_create
+	else
+		unpack ${A}
+	fi
+}
+
+src_install() {
+	insinto /usr/share/${PN}
+	doins config.{sub,guess}
+	fperms +x /usr/share/${PN}/config.{sub,guess}
+	dodoc ChangeLog
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-99999999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-99999999.ebuild
index a5dfaf70c8..f0b59ba79f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-99999999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gnuconfig/gnuconfig-99999999.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 if [[ ${PV} == 99999999 ]] ; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/r/config.git"
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
index 89e7bd6be0..d863cd1019 100644
--- a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/Manifest
@@ -5,6 +5,7 @@ DIST intel-microcode-collection-20220508.tar.xz 9444060 BLAKE2B 1737143f5227d955
 DIST intel-microcode-collection-20220809.tar.xz 9863700 BLAKE2B 266deba0890cc68de72dab28cb76b9aedd81258c2da1c1c00a19f927c73e9856c9dc6a18c08a768d1df2d5c5c3b21aab13446cdb4f84e13078ff2124859cdb00 SHA512 4c35e26d5887e9182dce5cf4cce46d4cfe8cab926e833396a645561adab775b8a5eac9a27f50a4c83887c50e56384917680a596eb02d50f1a14a56e8c163f4c2
 DIST intel-microcode-collection-20221102.tar.xz 11125112 BLAKE2B 6054a3278b694ee4b1d1a92ad586ce37cbbfbead1fc7100541f7b71fb0b9e0eb9fd9560a459f8ba861eb95595a89b79e8dbb8ef2e70ef6513245e206fecd3667 SHA512 76426f6f491a17302bc312cfd1d58849d42ffa8d454c05ab086f493de20cd24d328a7b05689493e1fa70c025097c61fd09fd765bc02485ba6efe81d0fac014cd
 DIST intel-microcode-collection-20230212.tar.xz 13213352 BLAKE2B b2548908632cc65e997186e7af60a35ba4a44edb88263f5018c1cc9619299816c6184352653076413b95fb914f799b765e4fa6a5c46513d1425bde353e4dcde2 SHA512 27f2aacbf409acb005f83f0f486b59128ebac4c8d6b1b329cff7e33b237a8d47e579c6afb064d7a9ff634ad652ae0c2b9bc9302e6269007e12bd4aa391075430
+DIST intel-microcode-collection-20230512.tar.xz 12924124 BLAKE2B 3593d9dd9d46281471e1ef335bb8e3fccee99cf484256b9f3b1f2fd0af1d1266c0237bf7cf97314e229f0e3ae622de68bdbe2cf3d9ed4b74ca9189f2aa7bf226 SHA512 9d65406898a8e82e66ab9ff684166eaf61a2b42c765d6f55603985176cdf7600b1f95626da0f1fc25d781212ce2c80ac108d0174371390e0e2c2ab7dd48c7b0d
 DIST intel-ucode-sig_0x406e3-rev_0xd6.bin 101376 BLAKE2B 66d55867954d69dda1425febd93bb8c89f7aa836d504f8b5fee127f8505bcf2246f4fcc55cc245bc5e532528d60cca2eee278de7ab5174dc2862db7982a2b36f SHA512 248066b521bf512b5d8e4a8c7e921464ce52169c954d6e4ca580d8c172cd789519e22b4cf56c212e452b4191741f0202019f7061d322c9433b5af9ce5413b567
 DIST microcode-20210608.tar.gz 4782451 BLAKE2B 2eac43aaa7832365e428bf2de20797ef42293a53087545920d205bd3b11a3d8ca2afb33931af5d36b8f3a224b9c22ed89ff828acc8afdcfa1b8220884c55ae89 SHA512 61acd2e76aa019fa0002fbf56c503791080a937ff93d81e020f8f0cc089dc08928b4c7e9884f713b886e2f9d4a8409fea59e39f628ef534a588515e1c3fc861d
 DIST microcode-20220207.tar.gz 4590237 BLAKE2B 8c47a330794615b6684084976b6bb9e8800cd2869f81ecc33b28b54441b220a645502c0ade0cbd58e91879a652ff6bca181800004de477fc74033413ea4b1c8f SHA512 efa9f80815947cf2be371e7da7185634cbacefe779d1d6dfef0c15b78ccae7d2740ea6681b967a19dfbcc3014edce5bcdcdba87c9dea1f19d0415a03fca9e936
@@ -13,3 +14,4 @@ DIST microcode-20220510.tar.gz 5912115 BLAKE2B 5f8c238b00970ddda132dbcf9059df759
 DIST microcode-20220809.tar.gz 5929894 BLAKE2B 3765995c88b67aff78fe8c4280b3293c60a2013f2b8c9ec155a2ef187af55a7e562c73a000e45828cf5309e2c1b644dac5849347130b1a98c831bdad117df437 SHA512 1c91df1cbba33953f4ad19cc53215cad843c61a08509596fad32a84b4f0012d9d29bce64b58eb405c345af7f646d5982e45227570ce3605780be6e8bf31a63e1
 DIST microcode-20221108.tar.gz 6436305 BLAKE2B e149e001656f45e8da9a83817a6f83fc6663edbfc8a98b27ab4f9d326f0999921aea03f1ea3628d35978ad5534e017f2d394d1d00d0c992aee54a539a582abf2 SHA512 d86bee1269d31d3028f0d2b7d4886795b96d8f1f9d5dbd5149c2dd4cec3b0319fd869f8138f283e2135ecb0bb6387cfd3c2ef1f597b4194a250ac4f2df7f15a4
 DIST microcode-20230214.tar.gz 12088391 BLAKE2B d98d054a8cfd66e3d0549d1e8f4a4745cad342d45f36a82d2f2f51fedc29635125fdad95ee4970069e134facc1ab3092b97837c6f8744ffedf220a5d3d022dd5 SHA512 6456cd6719923eeacb1f9d6d7372efd2bcd0de9e04350c722543ff41e45c7715ba52a2d330ad5818fbf44ea9df6b2ac482d6f8bd420b191427881dcfe3bd81e2
+DIST microcode-20230512.tar.gz 12654272 BLAKE2B 302aedf0b57719d1009be0dea513da7290b41842117951a0081f866024d5380c65850638ee3d2e87c8d9efcac4da58650463b0c31373d661fe74b8a3a380e099 SHA512 e21c82846f7f5e2c8d9559931e90389a7d21f8a59fbdec4c5b11fe43f010a21d3e9f27d67be12fe98b3dbdf26558a8ed74dc149bedd93f4b7728795dc6e86d48
diff --git a/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230512_p20230512.ebuild b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230512_p20230512.ebuild
new file mode 100644
index 0000000000..215705bf7f
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-firmware/intel-microcode/intel-microcode-20230512_p20230512.ebuild
@@ -0,0 +1,281 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit linux-info mount-boot
+
+# Find updates by searching and clicking the first link (hopefully it's the one):
+# https://www.intel.com/content/www/us/en/search.html?keyword=Processor+Microcode+Data+File
+
+COLLECTION_SNAPSHOT="${PV##*_p}"
+INTEL_SNAPSHOT="${PV/_p*}"
+#NUM="28087"
+#https://downloadcenter.intel.com/Detail_Desc.aspx?DwnldID=${NUM}
+#https://downloadmirror.intel.com/${NUM}/eng/microcode-${INTEL_SNAPSHOT}.tgz
+DESCRIPTION="Intel IA32/IA64 microcode update data"
+HOMEPAGE="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files http://inertiawar.com/microcode/"
+SRC_URI="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/archive/microcode-${INTEL_SNAPSHOT}.tar.gz
+	https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/raw/437f382b1be4412b9d03e2bbdcda46d83d581242/intel-ucode/06-4e-03 -> intel-ucode-sig_0x406e3-rev_0xd6.bin
+	https://dev.gentoo.org/~mpagano/dist/intel-microcode/intel-microcode-collection-${COLLECTION_SNAPSHOT}.tar.xz
+	https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/intel-microcode-collection-${COLLECTION_SNAPSHOT}.tar.xz"
+
+LICENSE="intel-ucode"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~x86"
+IUSE="hostonly initramfs +split-ucode vanilla"
+REQUIRED_USE="|| ( initramfs split-ucode )"
+
+BDEPEND=">=sys-apps/iucode_tool-2.3"
+
+# !<sys-apps/microcode-ctl-1.17-r2 due to bug #268586
+RDEPEND="hostonly? ( sys-apps/iucode_tool )"
+
+RESTRICT="binchecks strip"
+
+S=${WORKDIR}
+
+# Blacklist bad microcode here.
+# 0x000406f1 aka 06-4f-01 aka CPUID 406F1 require newer microcode loader
+MICROCODE_BLACKLIST_DEFAULT="-s !0x000406f1"
+
+# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31
+MICROCODE_BLACKLIST_DEFAULT+=" -s !0x000406e3,0xc0,eq:0x00dc"
+
+# https://bugs.gentoo.org/722768
+MICROCODE_BLACKLIST_DEFAULT+=" -s !0x000406e3,0xc0,eq:0x00da"
+
+# https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/commit/49bb67f32a2e3e631ba1a9a73da1c52e1cac7fd9
+MICROCODE_BLACKLIST_DEFAULT+=" -s !0x000806c1,0x80,eq:0x0068"
+
+# In case we want to set some defaults ...
+MICROCODE_SIGNATURES_DEFAULT=""
+
+# Advanced users only!
+# Set MIRCOCODE_SIGNATURES to merge with:
+# only current CPU: MICROCODE_SIGNATURES="-S"
+# only specific CPU: MICROCODE_SIGNATURES="-s 0x00000f4a -s 0x00010676"
+# exclude specific CPU: MICROCODE_SIGNATURES="-s !0x00000686"
+
+# Package Maintenance instructions :
+# 1. The ebuild is in the form of intel-microcode-<INTEL_SNAPSHOT>_p<COLLECTION_SNAPSHOT>.ebuild
+# 2. The INTEL_SNAPSHOT upstream is located at: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files
+# 3. The COLLECTION_SNAPSHOT is created manually using the following steps:
+#   a. Clone the repository https://github.com/platomav/CPUMicrocodes
+#   b. Rename the Intel directory to intel-microcode-collection-<YYYYMMDD>
+#   c. From the CPUMicrocodes directory tar and xz compress the contents of intel-microcode-collection-<YYYYMMDD>:
+#      tar -cJf intel-microcode-collection-<YYYYMMDD>.tar.xz intel-microcode-collection-<YYYYMMDD>/
+#   d. This file can go in your devspace, add the URL to SRC_URI if it's not there
+#      https://dev.gentoo.org/~<dev nick>/dist/intel-microcode/intel-microcode-collection-${COLLECTION_SNAPSHOT}.tar.xz
+
+pkg_pretend() {
+	use initramfs && mount-boot_pkg_pretend
+}
+
+src_prepare() {
+	default
+
+	if cd Intel-Linux-Processor-Microcode-Data* &>/dev/null; then
+		# new tarball format from GitHub
+		mv * ../ || die "Failed to move Intel-Linux-Processor-Microcode-Data*"
+		cd .. || die
+		rm -r Intel-Linux-Processor-Microcode-Data* || die
+	fi
+
+	mkdir intel-ucode-old || die
+	cp "${DISTDIR}"/intel-ucode-sig_0x406e3-rev_0xd6.bin "${S}"/intel-ucode-old/ || die
+
+	# Prevent "invalid file format" errors from iucode_tool
+	rm -f "${S}"/intel-ucod*/list || die
+
+	# https://gitlab.com/iucode-tool/iucode-tool/-/issues/4
+	rm "${S}"/intel-microcode-collection-${COLLECTION_SNAPSHOT}/cpu106C0_plat01_ver00000007_2007-08-24_PRD_923CDFA3.bin || die
+
+	# Remove non-microcode file from list
+	rm -f "${S}"/intel-microcode-collection-${COLLECTION_SNAPSHOT}/LICENSE || die
+	rm -f "${S}"/intel-ucode*/LICENSE || die
+}
+
+src_install() {
+	# This will take ALL of the upstream microcode sources:
+	# - microcode.dat
+	# - intel-ucode/
+	# In some cases, they have not contained the same content (eg the directory has newer stuff).
+	MICROCODE_SRC=(
+		"${S}"/intel-ucode/
+		"${S}"/intel-ucode-with-caveats/
+		"${S}"/intel-ucode-old/
+	)
+
+	# Allow users who are scared about microcode updates not included in Intel's official
+	# microcode tarball to opt-out and comply with Intel marketing
+	if ! use vanilla; then
+		MICROCODE_SRC+=( "${S}"/intel-microcode-collection-${COLLECTION_SNAPSHOT} )
+	fi
+
+	# These will carry into pkg_preinst via env saving.
+	: ${MICROCODE_BLACKLIST=${MICROCODE_BLACKLIST_DEFAULT}}
+	: ${MICROCODE_SIGNATURES=${MICROCODE_SIGNATUES_DEFAULT}}
+
+	opts=(
+		${MICROCODE_BLACKLIST}
+		${MICROCODE_SIGNATURES}
+		# be strict about what we are doing
+		--overwrite
+		--strict-checks
+		--no-ignore-broken
+		# we want to install latest version
+		--no-downgrade
+		# show everything we find
+		--list-all
+		# show what we selected
+		--list
+	)
+
+	# The earlyfw cpio needs to be in /boot because it must be loaded before
+	# rootfs is mounted.
+	use initramfs && dodir /boot && opts+=( --write-earlyfw="${ED}/boot/intel-uc.img" )
+
+	keepdir /lib/firmware/intel-ucode
+	opts+=( --write-firmware="${ED}/lib/firmware/intel-ucode" )
+
+	iucode_tool \
+		"${opts[@]}" \
+		"${MICROCODE_SRC[@]}" \
+		|| die "iucode_tool ${opts[@]} ${MICROCODE_SRC[@]}"
+
+	dodoc releasenote.md
+}
+
+pkg_preinst() {
+	if [[ ${MICROCODE_BLACKLIST} != ${MICROCODE_BLACKLIST_DEFAULT} ]]; then
+		ewarn "MICROCODE_BLACKLIST is set to \"${MICROCODE_BLACKLIST}\" instead of default \"${MICROCODE_BLACKLIST_DEFAULT}\". You are on your own!"
+	fi
+
+	if [[ ${MICROCODE_SIGNATURES} != ${MICROCODE_SIGNATURES_DEFAULT} ]]; then
+		ewarn "Package was created using advanced options:"
+		ewarn "MICROCODE_SIGNATURES is set to \"${MICROCODE_SIGNATURES}\" instead of default \"${MICROCODE_SIGNATURES_DEFAULT}\"!"
+	fi
+
+	# Make sure /boot is available if needed.
+	use initramfs && mount-boot_pkg_preinst
+
+	local _initramfs_file="${ED}/boot/intel-uc.img"
+
+	if use hostonly; then
+		# While this output looks redundant we do this check to detect
+		# rare cases where iucode_tool was unable to detect system's processor(s).
+		local _detected_processors=$(iucode_tool --scan-system 2>&1)
+		if [[ -z "${_detected_processors}" ]]; then
+			ewarn "Looks like iucode_tool was unable to detect any processor!"
+		else
+			einfo "Only installing ucode(s) for ${_detected_processors#iucode_tool: system has } due to USE=hostonly ..."
+		fi
+
+		opts=(
+			--scan-system
+			# be strict about what we are doing
+			--overwrite
+			--strict-checks
+			--no-ignore-broken
+			# we want to install latest version
+			--no-downgrade
+			# show everything we find
+			--list-all
+			# show what we selected
+			--list
+		)
+
+		# The earlyfw cpio needs to be in /boot because it must be loaded before
+		# rootfs is mounted.
+		use initramfs && opts+=( --write-earlyfw=${_initramfs_file} )
+
+		if use split-ucode; then
+			opts+=( --write-firmware="${ED}/lib/firmware/intel-ucode" )
+		fi
+
+		opts+=( "${ED}/lib/firmware/intel-ucode-temp" )
+
+		mv "${ED}"/lib/firmware/intel-ucode{,-temp} || die
+		keepdir /lib/firmware/intel-ucode
+
+		iucode_tool "${opts[@]}" || die "iucode_tool ${opts[@]}"
+
+		rm -r "${ED}"/lib/firmware/intel-ucode-temp || die
+
+	elif ! use split-ucode; then # hostonly disabled
+		rm -r "${ED}"/lib/firmware/intel-ucode || die
+	fi
+
+	# Because it is possible that this package will install not one single file
+	# due to user selection which is still somehow unexpected we add the following
+	# check to inform user so that the user has at least a chance to detect
+	# a problem/invalid select.
+	local _has_installed_something=
+	if use initramfs && [[ -s "${_initramfs_file}" ]]; then
+		_has_installed_something="yes"
+	elif use split-ucode; then
+		_has_installed_something=$(find "${ED}/lib/firmware/intel-ucode" -maxdepth 0 -not -empty -exec echo yes \;)
+	fi
+
+	if use hostonly && [[ -n "${_has_installed_something}" ]]; then
+		elog "You only installed ucode(s) for all currently available (=online)"
+		elog "processor(s). Remember to re-emerge this package whenever you"
+		elog "change the system's processor model."
+		elog ""
+	elif [[ -z "${_has_installed_something}" ]]; then
+		ewarn "WARNING:"
+		if [[ ${MICROCODE_SIGNATURES} != ${MICROCODE_SIGNATURES_DEFAULT} ]]; then
+			ewarn "No ucode was installed! Because you have created this package"
+			ewarn "using MICROCODE_SIGNATURES variable please double check if you"
+			ewarn "have an invalid select."
+			ewarn "It's rare but it is also possible that just no ucode update"
+			ewarn "is available for your processor(s). In this case it is safe"
+			ewarn "to ignore this warning."
+		else
+			ewarn "No ucode was installed! It's rare but it is also possible"
+			ewarn "that just no ucode update is available for your processor(s)."
+			ewarn "In this case it is safe to ignore this warning."
+		fi
+
+		ewarn ""
+
+		if use hostonly; then
+			ewarn "Unset \"hostonly\" USE flag to install all available ucodes."
+			ewarn ""
+		fi
+	fi
+}
+
+pkg_prerm() {
+	# Make sure /boot is mounted so that we can remove /boot/intel-uc.img!
+	use initramfs && mount-boot_pkg_prerm
+}
+
+pkg_postrm() {
+	# Don't forget to umount /boot if it was previously mounted by us.
+	use initramfs && mount-boot_pkg_postrm
+}
+
+pkg_postinst() {
+	# Don't forget to umount /boot if it was previously mounted by us.
+	use initramfs && mount-boot_pkg_postinst
+
+	# We cannot give detailed information if user is affected or not:
+	# If MICROCODE_BLACKLIST wasn't modified, user can still use MICROCODE_SIGNATURES
+	# to to force a specific, otherwise blacklisted, microcode. So we
+	# only show a generic warning based on running kernel version:
+	if kernel_is -lt 4 14 34; then
+		ewarn "${P} contains microcode updates which require"
+		ewarn "additional kernel patches which aren't yet included in kernel <4.14.34."
+		ewarn "Loading such a microcode through kernel interface from an unpatched kernel"
+		ewarn "can crash your system!"
+		ewarn ""
+		ewarn "Those microcodes are blacklisted per default. However, if you have altered"
+		ewarn "MICROCODE_BLACKLIST or MICROCODE_SIGNATURES, you maybe have unintentionally"
+		ewarn "re-enabled those microcodes...!"
+		ewarn ""
+		ewarn "Check \"${EROOT}/usr/share/doc/${PN}-*/releasenot*\" if your microcode update"
+		ewarn "requires additional kernel patches or not."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.5-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.5-r4.ebuild
index 1a6835db10..2dc05ea69a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.5-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.46.5-r4.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r1.ebuild
index 786735ef49..580ff96d90 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r1.ebuild
@@ -44,6 +44,8 @@ PATCHES=(
 	# upgrade. See bug #904093 and bug #904048.
 	"${FILESDIR}"/${PN}-1.47.0-disable-metadata_csum_seed-and-orphan_file-by-default.patch
 
+	"${FILESDIR}"/e2fsprogs-1.47.0-parallel-make.patch
+
 	# Upstream patches (can usually removed with next version bump)
 )
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/files/e2fsprogs-1.47.0-parallel-make.patch b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/files/e2fsprogs-1.47.0-parallel-make.patch
new file mode 100644
index 0000000000..3396aa467d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/files/e2fsprogs-1.47.0-parallel-make.patch
@@ -0,0 +1,68 @@
+From 711ed1823c7676533d5f6d5e4d1558a792d43837 Mon Sep 17 00:00:00 2001
+From: David Seifert <soap@gentoo.org>
+Date: Tue, 25 Apr 2023 21:53:19 +0200
+Subject: [PATCH] Add missing Makefile dependencies
+
+* With very high -j parallelism, we get failures in Gentoo:
+
+  In file included from lib/ext2fs/blknum.c:15:
+  lib/ext2fs/ext2fs.h:105:10: fatal error: ext2fs/ext2_err.h: No such file or directory
+    105 | #include <ext2fs/ext2_err.h>
+        |          ^~~~~~~~~~~~~~~~~~~
+  compilation terminated.
+  In file included from lib/ext2fs/fallocate.c:19:
+  lib/ext2fs/ext2fs.h:105:10: fatal error: ext2fs/ext2_err.h: No such file or directory
+    105 | #include <ext2fs/ext2_err.h>
+        |          ^~~~~~~~~~~~~~~~~~~
+
+Bug: https://bugs.gentoo.org/806875#c17
+Signed-off-by: David Seifert <soap@gentoo.org>
+---
+ lib/ext2fs/Makefile.in | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/lib/ext2fs/Makefile.in b/lib/ext2fs/Makefile.in
+index 798ff609..2c4e0277 100644
+--- a/lib/ext2fs/Makefile.in
++++ b/lib/ext2fs/Makefile.in
+@@ -731,6 +731,12 @@ blkmap64_rb.o: $(srcdir)/blkmap64_rb.c $(top_builddir)/lib/config.h \
+  $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
+  $(srcdir)/hashmap.h $(srcdir)/bitops.h $(srcdir)/bmap64.h $(srcdir)/rbtree.h \
+  $(srcdir)/compiler.h
++blknum.o: $(srcdir)/blknum.c $(top_builddir)/lib/config.h \
++ $(srcdir)/ext2_fs.h $(top_builddir)/lib/ext2fs/ext2_types.h \
++ $(srcdir)/ext2fs.h $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h \
++ $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
++ $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
++ $(srcdir)/hashmap.h $(srcdir)/bitops.h $(srcdir)/bmap64.h
+ block.o: $(srcdir)/block.c $(top_builddir)/lib/config.h \
+  $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2_fs.h \
+  $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2fs.h \
+@@ -842,6 +848,12 @@ extent.o: $(srcdir)/extent.c $(top_builddir)/lib/config.h \
+  $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
+  $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
+  $(srcdir)/hashmap.h $(srcdir)/bitops.h $(srcdir)/e2image.h
++fallocate.o: $(srcdir)/fallocate.c $(top_builddir)/lib/config.h \
++ $(srcdir)/ext2_fs.h $(top_builddir)/lib/ext2fs/ext2_types.h \
++ $(srcdir)/ext2fs.h $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h \
++ $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
++ $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
++ $(srcdir)/hashmap.h $(srcdir)/bitops.h $(srcdir)/bmap64.h
+ fileio.o: $(srcdir)/fileio.c $(top_builddir)/lib/config.h \
+  $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2_fs.h \
+  $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2fs.h \
+@@ -1049,6 +1061,12 @@ openfs.o: $(srcdir)/openfs.c $(top_builddir)/lib/config.h \
+  $(srcdir)/ext2_io.h $(top_builddir)/lib/ext2fs/ext2_err.h \
+  $(srcdir)/ext2_ext_attr.h $(srcdir)/hashmap.h $(srcdir)/bitops.h \
+  $(srcdir)/e2image.h
++orphan.o: $(srcdir)/orphan.c $(top_builddir)/lib/config.h \
++ $(srcdir)/ext2_fs.h $(top_builddir)/lib/ext2fs/ext2_types.h \
++ $(srcdir)/ext2fs.h $(srcdir)/ext2_fs.h $(srcdir)/ext3_extents.h \
++ $(top_srcdir)/lib/et/com_err.h $(srcdir)/ext2_io.h \
++ $(top_builddir)/lib/ext2fs/ext2_err.h $(srcdir)/ext2_ext_attr.h \
++ $(srcdir)/hashmap.h $(srcdir)/bitops.h $(srcdir)/bmap64.h
+ progress.o: $(srcdir)/progress.c $(top_builddir)/lib/config.h \
+  $(top_builddir)/lib/dirpaths.h $(srcdir)/ext2fs.h \
+  $(top_builddir)/lib/ext2fs/ext2_types.h $(srcdir)/ext2_fs.h \
+-- 
+2.40.0
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
index 31e181dc6f..851d59cd36 100644
--- a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/Manifest
@@ -10,6 +10,7 @@ DIST gentoo-headers-5.4-2.tar.xz 11352 BLAKE2B 0ff989dbfff9070c291efe1a8b9254627
 DIST gentoo-headers-6.0-0.tar.xz 1164 BLAKE2B c288c6581224235367e8bfbd726d3e5ffa19b88b4950bbf4d5df0985835b25794986bbd0018a116455acc001c87f7e3b9290f6ba5ce16278ba4bfe02b9f402e1 SHA512 6bb5d7342e30a7e7bc0ecef5c2f95f3d78e8877b77c427728a3ca4614a13738c6d24f725c7047b896a868ee8a0ba1aea92355aebdf6723f08e6d4fd8c0c1c7d6
 DIST gentoo-headers-6.1-0.tar.xz 1172 BLAKE2B 6929760733cd4a89228554b57b1027ccf887b6c7e56b45f71db9926e9328e2f0cf28b2f386eaaaef461cb2e05e4b1c088ffafea308f25254409f56c381bea2ca SHA512 14c3629a3c3aded37655ed277d718ed8398a08e231682f88037f1feb0c0727ef298f5e17626372fe890606930c027a3a59d8266bac746960651a90443beab5c5
 DIST gentoo-headers-6.2-1.tar.xz 1172 BLAKE2B e357616353d4e756477c87b9e3a31c07758f9cc883076796e960d79083c3bbe22f4df215f068b4950cc8c35685a49355c7d1059b283bbd03784bd4152bd4f506 SHA512 9e08c87404821fbea00972484a24e73b53ed9c4471e9a7785b2433f2b96bc884eeba2b82788ea01eb8147450e53d9eb8e8bb21968de45d036f83bf2bbeb13b77
+DIST gentoo-headers-6.3-1.tar.xz 1172 BLAKE2B 1203030d430d98fec697da541707927fe8f2027420d88f4287dde4ccdf660366e6dac0b422c0e9f9b4381d5e27a9c8a861093c3d31cb8861d4e9dbd472c37ca5 SHA512 8809047184b60e7366d4016ec5b7bf13797ab29e9d415004b15678f6a3574d1350a6f8f934256ee3dccb6eb4b7d122f29e8dcadb55f5c9cc27583075eb21321b
 DIST gentoo-headers-base-3.18.tar.xz 3776668 BLAKE2B 837a675ecf05ec270549d0ba6b9dcb98fb0e40f22007ebfa3e430152b7149dcfa29c8bbe38c737add07f75642234f1633c1d5ae0170788e8d4f765faf00bbdbe SHA512 6615c604e5e618d26fff5a61691f7827bb05be9790db6c9f8e16e3842bce8f056f9928f85ae5714710b75743b0d0804faba4ba9c76e934e1de22dc03ef6d5535
 DIST gentoo-headers-base-4.14.tar.xz 8017944 BLAKE2B e967a3f26fa002f62af72c165cf960e855f5d84dd105b3f136e5ae24f4cdfc9e5f8b217a83955b325ca4bd6bda0a9d4c4de02d8d79fd4aa72191bc63db96183a SHA512 2a4e83a9ee36ffa85b59ebac1e12f4f1c572825b767928a42c4748d924d04f0536bab4d9375ca68c11ad867c226f386c40c7c4d0158d1ab00c838eb5b2f9f21a
 DIST gentoo-headers-base-4.19.tar.xz 7956220 BLAKE2B 5b6868188b6cb505556b8f307972be6b27c0201e8287f6a2c4d0ac8bf16cfe048cb05afacf879731ba81de5e2a8c5afc4adad007e00b12efb8b2a158a666f4dd SHA512 ef0f159cb31651bf8e00c31d8ac807e64413c7bf88807e1ab4779524db10eec4726b65af0fad034a0cb2e000cd61a6008bcc174828061ffaf633c170dd09645c
@@ -22,3 +23,4 @@ DIST linux-5.4.tar.xz 109441440 BLAKE2B 193bc4a3147e147d5529956164ec4912fad5d5c6
 DIST linux-6.0.tar.xz 133886176 BLAKE2B c09a9c877ac0fac83dc31d2d04d96f0a3331d4ed78e3ad4edfd4dc077e1c11d0c49f419fdac4008b5c93d1b09c2b724e12ef0b38371ad0962908abf85dfa95fa SHA512 bac41a7aeb6e809616cee2f13dcd1c45e829dfd1ccf60aee1dc4c46b1e28532f4485c7d819a32940de84fdfbf89db80a4e919bce8a74b2948c5a01551771b714
 DIST linux-6.1.tar.xz 134728520 BLAKE2B ae60257860b2bd1bd708d183f0443afc60ebbd2b3d535c45e44c2e541bd0928530a3b62de6385dd4e4726ebbedcc0a871d4f3ffb4105b9f1f6d8ed7467f5688e SHA512 6ed2a73c2699d0810e54753715635736fc370288ad5ce95c594f2379959b0e418665cd71bc512a0273fe226fe90074d8b10d14c209080a6466498417a4fdda68
 DIST linux-6.2.tar.xz 136430892 BLAKE2B 05b63254734ea685db437cb1c00a6da63eee74d7e99f4ed2d074aaa01ac4487813ab297d337a6855cdbcbb33346b631c4256ee3b06191adfb1be3615a56bdd6d SHA512 a01bee0b968b95183934fe3504516be7ef5811944a061f5aed05ecebaa27b5eb64e33232fd0a8dd622b3c8743bfe462ef7e464d381734d111a0ad6a6d9f66ddd
+DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
diff --git a/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.3.ebuild
new file mode 100644
index 0000000000..6380dcc8a8
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-kernel/linux-headers/linux-headers-6.3.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+ETYPE="headers"
+H_SUPPORTEDARCH="alpha amd64 arc arm arm64 csky hexagon hppa ia64 loong m68k microblaze mips nios2 openrisc ppc ppc64 riscv s390 sh sparc x86 xtensa"
+inherit kernel-2
+detect_version
+
+PATCH_PV=${PV} # to ease testing new versions against not existing patches
+PATCH_VER="1"
+PATCH_DEV="sam"
+SRC_URI="${KERNEL_URI}
+	${PATCH_VER:+https://dev.gentoo.org/~${PATCH_DEV}/distfiles/sys-kernel/linux-headers/gentoo-headers-${PATCH_PV}-${PATCH_VER}.tar.xz}"
+S="${WORKDIR}/linux-${PV}"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+BDEPEND="app-arch/xz-utils
+	dev-lang/perl"
+
+[[ -n ${PATCH_VER} ]] && PATCHES=( "${WORKDIR}"/${PATCH_PV} )
+
+src_unpack() {
+	# Avoid kernel-2_src_unpack
+	default
+}
+
+src_prepare() {
+	# TODO: May need forward porting to newer versions
+	use elibc_musl && PATCHES+=(
+		"${FILESDIR}"/${PN}-5.15-remove-inclusion-sysinfo.h.patch
+	)
+
+	# Avoid kernel-2_src_prepare
+	default
+}
+
+src_install() {
+	kernel-2_src_install
+
+	find "${ED}" \( -name '.install' -o -name '*.cmd' \) -delete || die
+	# Delete empty directories
+	find "${ED}" -empty -type d -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
index a7ae177eb8..536c917e1f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/Manifest
@@ -8,11 +8,9 @@ DIST binutils-2.37_p1-patches-2.tar.xz 31956 BLAKE2B 39c48628d0e2d7f3a8cf11be391
 DIST binutils-2.37_p1.tar.xz 22992196 BLAKE2B a8aa0f386d03a5b1466166ac7c40989c228351ccf0949a9b462b4d4615d70ab7e1a45351299140a42baf39c317b8007733c253eb547ee1dfadb612addde11621 SHA512 46c297ec2a7a5b81d1c6e3f16486a6dc2860a07520fe2dd8871d1eb5160065bbe2cc6b0415d5352bf12284133e5817a4e429e6077182d615e969bd1a8f52ed28
 DIST binutils-2.38-patches-4.tar.xz 193852 BLAKE2B 5a83e20008e58464ed563a6817a367e50684c59d08c47345cc546054269c42463d1651441720f865851e4e182e917df1a095c68e64226e0351b64e975d524096 SHA512 6657e547bb02898632cc45a8f1894be098aa7472b6725b65f95393e621abb127e468b4e50310720bf03f7e8d0a68bc2c47af76fc43aaa8f32b2e4a149c0c6290
 DIST binutils-2.38.tar.xz 23651408 BLAKE2B 19ede396ec97b88e632aded2f69f4684cc5053109e06c3c4a1934944e3f0ceaa9e4a2604528a440189771f778cb5d75edd510163970eeea31afba87fa256feba SHA512 8bf0b0d193c9c010e0518ee2b2e5a830898af206510992483b427477ed178396cd210235e85fd7bd99a96fc6d5eedbeccbd48317a10f752b7336ada8b2bb826d
-DIST binutils-2.39-patches-5.tar.xz 82924 BLAKE2B 2cf75f661989f22270d6afe5f3c543814eb6a331be4493016fa2871e1f10a84a123c1c51e77a19b35e46680b9fe77390cb1532ca40d470a6041fa768fed3ccd7 SHA512 4b5811b4822b3a06f590fc7d082dc0ddf18a6058ac23887254e2ee9bd63c7f06f1636e446152115c7e0b01a6c5298a0d9df6904bd1582e66504ccde80dd1ecbd
 DIST binutils-2.39-patches-6.tar.xz 92380 BLAKE2B 39f490f1134fb0e7dc80924a280d3113efe0ed094ee15de97c42ab751c83d2f5aa7448966d8cbbcde722b2af4999a36c1e5aa2f37ca6d2e3942b97b6d90ff152 SHA512 213cd7a86da83987966675f3195e843d898ca4ff412dfc29fd33ed80adb7bbf80a0b2919cd8e7dd49208c73a621ab7b720970f2259418bdc82ed2a568ff62064
 DIST binutils-2.39.tar.xz 25167756 BLAKE2B ac6a5296c6586d53eaadcbffc5c399a6d79edf72450b9bb8b3525ce525129cef3d2eb90c85ef3bb3270b5a03b0e1ffb8f0b705f028158726f9777ebb8685066f SHA512 68e038f339a8c21faa19a57bbc447a51c817f47c2e06d740847c6e9cc3396c025d35d5369fa8c3f8b70414757c89f0e577939ddc0d70f283182504920f53b0a3
-DIST binutils-2.40-patches-1.tar.xz 12260 BLAKE2B d525502e08012080417634fd41981550362d4d799952e89f388af2a6e5db5b80e88bfdb0b5b1d2a1bcf8ebda529eefbced8fa2ae84c7fe3ddb10184e98d4b369 SHA512 140f80be786511f63651e67bf25c2992de6a21bac00a3252dcf98becc3f9379c8070ef1380d5542bbf2e1908c50dab2c7ebb651d13bb97609594fe9fd9f1f079
-DIST binutils-2.40-patches-2.tar.xz 183760 BLAKE2B 447f1c40ac8212b1e91f6f2137f87958c3f4e2366b11b9979d9d09d52e9fcde9a9d74f0c1871616157e001f505849fceb2097a512f434b9c848885e367a07c35 SHA512 30efbfcbd2d936c74d9480e4f2f4b8dcd30abcd0f1b22d21d20558002fdb8c90bd2fe97e3f27c2905714dcfd1297cac2646ede1e2c3d9fbf159f93c8cf01a290
 DIST binutils-2.40-patches-3.tar.xz 259432 BLAKE2B 03b9024e658a5860d54b9087f3e1cc4b417a2501d6a1744c44759bbc99cabd5938058ba2909b16cc999208187998094aa6ab5464e5ed54b87ea0b1eef007e85c SHA512 f2f3e38f5c0c2928ed0588ee42be74d43486d209b43249f73ae133c4c1f81491c86b14df2ddecbc37df6fe80b27b0eab6c3f319e44854e91596dfbd3ec37b8aa
 DIST binutils-2.40-patches-4.tar.xz 264420 BLAKE2B 70acdc15f64a45cda49ebd7c252d909db2fe659f5c2c0866c50fd710415fd34bd88f9c5cd5ba07beef1e7de7fe827bb40f835fb79ff10e00fc50451e3a8cab33 SHA512 5f0a080841cb3a032cbe7b135ba38bebeae0b0e444623887bdcb92a3adcf804701524eff840f108a9544293f5ac307b4a8d9509176abfeaea6c461b2ea5c0886
+DIST binutils-2.40-patches-5.tar.xz 293628 BLAKE2B b7ed1d1fbf38b420661f984b9519b3d863da45b2a873773a521310021b0c1d5d7c24c152adb3e8a999d40f5619c0e54962114590ec9528380089977af0c30b74 SHA512 6e6df932b18ca20fe245b3ff8d3d06dbdae4daadaec3b668fa44e086d4e8ff56439681b2d810ebc74173b6348020edacb176e8c3cbf20657cce04297b97f4f83
 DIST binutils-2.40.tar.xz 25241484 BLAKE2B 8d799f7c595f878b9af5b17a490021dd8b8300ac2fe0ed8574c012929d22d2d0493e003a3e631a9436e8e712da801779b777c566167fe42b0bde119ffa5ad1c2 SHA512 a37e042523bc46494d99d5637c3f3d8f9956d9477b748b3b1f6d7dfbb8d968ed52c932e88a4e946c6f77b8f48f1e1b360ca54c3d298f17193f3b4963472f6925
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r4.ebuild
deleted file mode 100644
index 75e746e1bf..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r4.ebuild
+++ /dev/null
@@ -1,153 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PATCH_VER=5
-PATCH_DEV=dilfridge
-
-inherit libtool toolchain-funcs multilib-minimal
-
-MY_PN="binutils"
-MY_P="${MY_PN}-${PV}"
-PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-PATCH_DEV=${PATCH_DEV:-dilfridge}
-
-DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
-HOMEPAGE="https://sourceware.org/binutils/"
-SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-
-LICENSE="|| ( GPL-3 LGPL-3 )"
-SLOT="0/${PV%_p?}"
-IUSE="64-bit-bfd cet multitarget nls static-libs"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-
-BDEPEND="nls? ( sys-devel/gettext )"
-DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
-# Need a newer binutils-config that'll reset include/lib symlinks for us.
-RDEPEND="${DEPEND}
-	>=sys-devel/binutils-config-5
-"
-
-S="${WORKDIR}/${MY_P%_p?}"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/bfd.h
-)
-
-src_prepare() {
-	if [[ -n ${PATCH_VER} ]] ; then
-		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
-		eapply "${WORKDIR}/patch"/*.patch
-	fi
-
-	# Fix cross-compile relinking issue, bug #626402
-	elibtoolize
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# somehow libtool/configure is messed up and (custom patch at
-		# upstream?) and misdetects (basically assumes) nm can be called
-		# with -B arg -- can't run eautoreconf (fails), so patch up
-		# manually, this would break any target that needs -B to nm
-		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
-			libctf/configure || die
-	fi
-
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	default
-}
-
-pkgversion() {
-	printf "Gentoo ${PVR}"
-	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
-}
-
-multilib_src_configure() {
-	local myconf=(
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		# Newer versions (>=2.24) make this an explicit option. #497268
-		--enable-install-libiberty
-		--disable-werror
-		--with-bugurl="https://bugs.gentoo.org/"
-		--with-pkgversion="$(pkgversion)"
-		$(use_enable static-libs static)
-		# The binutils eclass enables this flag for all bi-arch builds,
-		# but other tools often don't care about that support.  Put it
-		# beyond a flag if people really want it, but otherwise leave
-		# it disabled as it can slow things down on 32bit arches. #438522
-		$(use_enable 64-bit-bfd)
-		# This only disables building in the zlib subdir.
-		# For binutils itself, it'll use the system version. #591516
-		--without-zlib
-		--with-system-zlib
-		# We only care about the libs, so disable programs. #528088
-		--disable-{binutils,etc,ld,gas,gold,gprof,gprofng}
-		# Disable modules that are in a combined binutils/gdb tree. #490566
-		--disable-{gdb,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# We pull in all USE-flags that change ABI in an incompatible
-		# way. #666100
-		# USE=multitarget change size of global arrays
-		# USE=64-bit-bfd changes data structures of exported API
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
-
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-	)
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	use nls \
-		&& myconf+=( --without-included-gettext ) \
-		|| myconf+=( --disable-nls )
-
-	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
-		# fix underlinking in opcodes
-		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
-			"${S}"/opcodes/Makefile.in || die
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running as we don't build docs here.
-	# bug #622652
-	sed -i \
-		-e '/^MAKEINFO/s:=.*:= true:' \
-		Makefile || die
-}
-
-multilib_src_compile() {
-	emake V=1
-}
-
-multilib_src_install() {
-	emake V=1 DESTDIR="${D}" install
-
-	# Provide libiberty.h directly.
-	dosym libiberty/libiberty.h /usr/include/libiberty.h
-}
-
-multilib_src_install_all() {
-	use static-libs || find "${ED}"/usr -name '*.la' -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
index ec52714b83..b3ac3b4bd8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.39-r5.ebuild
@@ -22,7 +22,7 @@ SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
 LICENSE="|| ( GPL-3 LGPL-3 )"
 SLOT="0/${PV%_p?}"
 IUSE="64-bit-bfd cet multitarget nls static-libs"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 
 BDEPEND="nls? ( sys-devel/gettext )"
 DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r1.ebuild
deleted file mode 100644
index 09aff21304..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r1.ebuild
+++ /dev/null
@@ -1,159 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PATCH_VER=1
-PATCH_DEV=dilfridge
-
-inherit libtool toolchain-funcs multilib-minimal
-
-MY_PN="binutils"
-MY_P="${MY_PN}-${PV}"
-PATCH_BINUTILS_VER=${PATCH_BINUTILS_VER:-${PV}}
-PATCH_DEV=${PATCH_DEV:-dilfridge}
-
-DESCRIPTION="Core binutils libraries (libbfd, libopcodes, libiberty) for external packages"
-HOMEPAGE="https://sourceware.org/binutils/"
-SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_P}.tar.xz
-	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${MY_PN}-${PATCH_BINUTILS_VER}-patches-${PATCH_VER}.tar.xz"
-
-LICENSE="|| ( GPL-3 LGPL-3 )"
-SLOT="0/${PV%_p?}"
-IUSE="64-bit-bfd cet multitarget nls static-libs"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-
-BDEPEND="nls? ( sys-devel/gettext )"
-DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
-# Need a newer binutils-config that'll reset include/lib symlinks for us.
-RDEPEND="${DEPEND}
-	>=sys-devel/binutils-config-5
-"
-
-S="${WORKDIR}/${MY_P%_p?}"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/bfd.h
-)
-
-src_prepare() {
-	if [[ -n ${PATCH_VER} ]] ; then
-		einfo "Applying binutils-${PATCH_BINUTILS_VER} patchset ${PATCH_VER}"
-		eapply "${WORKDIR}/patch"/*.patch
-	fi
-
-	# Fix cross-compile relinking issue, bug #626402
-	elibtoolize
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# somehow libtool/configure is messed up and (custom patch at
-		# upstream?) and misdetects (basically assumes) nm can be called
-		# with -B arg -- can't run eautoreconf (fails), so patch up
-		# manually, this would break any target that needs -B to nm
-		sed -i -e 's/lt_cv_path_NM="$tmp_nm -B"/lt_cv_path_NM="$tmp_nm"/' \
-			libctf/configure || die
-	fi
-
-	# See https://www.gnu.org/software/make/manual/html_node/Parallel-Output.html
-	# Avoid really confusing logs from subconfigure spam, makes logs far
-	# more legible.
-	export MAKEOPTS="--output-sync=line ${MAKEOPTS}"
-
-	default
-}
-
-pkgversion() {
-	printf "Gentoo ${PVR}"
-	[[ -n ${PATCHVER} ]] && printf " p${PATCHVER}"
-}
-
-multilib_src_configure() {
-	local myconf=(
-		--enable-obsolete
-		--enable-shared
-		--enable-threads
-		# Newer versions (>=2.24) make this an explicit option. #497268
-		--enable-install-libiberty
-		--disable-werror
-		--with-bugurl="https://bugs.gentoo.org/"
-		--with-pkgversion="$(pkgversion)"
-		$(use_enable static-libs static)
-		# The binutils eclass enables this flag for all bi-arch builds,
-		# but other tools often don't care about that support.  Put it
-		# beyond a flag if people really want it, but otherwise leave
-		# it disabled as it can slow things down on 32bit arches. #438522
-		$(use_enable 64-bit-bfd)
-		# This only disables building in the zlib subdir.
-		# For binutils itself, it'll use the system version. #591516
-		--without-zlib
-		--with-system-zlib
-		# We only care about the libs, so disable programs. #528088
-		--disable-{binutils,etc,ld,gas,gold,gprof,gprofng}
-		# Disable modules that are in a combined binutils/gdb tree. #490566
-		--disable-{gdb,libdecnumber,readline,sim}
-		# Strip out broken static link flags.
-		# https://gcc.gnu.org/PR56750
-		--without-stage1-ldflags
-		# We pull in all USE-flags that change ABI in an incompatible
-		# way. #666100
-		# USE=multitarget change size of global arrays
-		# USE=64-bit-bfd changes data structures of exported API
-		--with-extra-soversion-suffix=gentoo-${CATEGORY}-${PN}-$(usex multitarget mt st)-$(usex 64-bit-bfd 64 def)
-
-		# avoid automagic dependency on (currently prefix) systems
-		# systems with debuginfod library, bug #754753
-		--without-debuginfod
-
-		# Revisit if it's useful, we do have binutils[zstd] though
-		--without-zstd
-
-		# Allow user to opt into CET for host libraries.
-		# Ideally we would like automagic-or-disabled here.
-		# But the check does not quite work on i686: bug #760926.
-		$(use_enable cet)
-	)
-
-	# mips can't do hash-style=gnu ...
-	if [[ $(tc-arch) != mips ]] ; then
-		myconf+=( --enable-default-hash-style=gnu )
-	fi
-
-	use multitarget && myconf+=( --enable-targets=all --enable-64-bit-bfd )
-
-	use nls \
-		&& myconf+=( --without-included-gettext ) \
-		|| myconf+=( --disable-nls )
-
-	if [[ ${CHOST} == *-darwin* ]] && use nls ; then
-		# fix underlinking in opcodes
-		sed -i -e 's/@SHARED_LDFLAGS@/@SHARED_LDFLAGS@ -lintl/' \
-			"${S}"/opcodes/Makefile.in || die
-	fi
-
-	ECONF_SOURCE="${S}" econf "${myconf[@]}"
-
-	# Prevent makeinfo from running as we don't build docs here.
-	# bug #622652
-	sed -i \
-		-e '/^MAKEINFO/s:=.*:= true:' \
-		Makefile || die
-}
-
-multilib_src_compile() {
-	emake V=1
-}
-
-multilib_src_install() {
-	emake V=1 DESTDIR="${D}" install
-
-	# Provided by sys-devel/gdb instead
-	rm "${ED}"/usr/share/info/sframe-spec.info || die
-
-	# Provide libiberty.h directly.
-	dosym libiberty/libiberty.h /usr/include/libiberty.h
-}
-
-multilib_src_install_all() {
-	use static-libs || find "${ED}"/usr -name '*.la' -delete
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r4.ebuild
index 728495450e..fa23899f2b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r4.ebuild
@@ -21,10 +21,14 @@ SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
 
 LICENSE="|| ( GPL-3 LGPL-3 )"
 SLOT="0/${PV%_p?}"
-IUSE="64-bit-bfd cet multitarget nls static-libs"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+RESTRICT="!test? ( test )"
 
-BDEPEND="nls? ( sys-devel/gettext )"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
 DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
 # Need a newer binutils-config that'll reset include/lib symlinks for us.
 RDEPEND="${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
similarity index 96%
rename from sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r2.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
index e0bbd9a31b..6ba858674d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/binutils-libs/binutils-libs-2.40-r5.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PATCH_VER=2
+PATCH_VER=5
 PATCH_DEV=dilfridge
 
 inherit libtool toolchain-funcs multilib-minimal
@@ -21,10 +21,14 @@ SRC_URI="mirror://gnu/binutils/${MY_P}.tar.xz
 
 LICENSE="|| ( GPL-3 LGPL-3 )"
 SLOT="0/${PV%_p?}"
-IUSE="64-bit-bfd cet multitarget nls static-libs"
+IUSE="64-bit-bfd cet multitarget nls static-libs test"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+RESTRICT="!test? ( test )"
 
-BDEPEND="nls? ( sys-devel/gettext )"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	test? ( dev-util/dejagnu )
+"
 DEPEND="sys-libs/zlib[${MULTILIB_USEDEP}]"
 # Need a newer binutils-config that'll reset include/lib symlinks for us.
 RDEPEND="${DEPEND}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
index 0e9fa29554..65e812b9c3 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/Manifest
@@ -1,3 +1,2 @@
-DIST libcap-2.66.tar.xz 181592 BLAKE2B e79bf10c6a3dbffe96dc97aad0bed67caa0b3805d9dcaff1e4a8a833396ee5c6da4f7f0d321b254e99a00073bc39021b9f3a4b350d93094d0df4d74889b3ca56 SHA512 ac005b622f6e065f30ce282a5c87240e7b9da75366ee537aa4835bc501b44bc242c10a4ba4dc070e2415fc7f635d1c3c4e45fbeeaf962cf7973dda82bf6377f0
-DIST libcap-2.67.tar.xz 186864 BLAKE2B bd9be22e439397a3c1726093cfee2410df93773b3139d50a1cdc10daecb666ddb9b64daded6e0ec9f2fd6defd16ea156dbd66bd55360ea266131f31ea0f0e989 SHA512 2e52c5a571cc1565e6829b0889f63216af10dfd9a86485f8ae7d0fcf4cc0db96aa21eb2ddea29e8dadf41a1194e91fb5961fe84ba07beb2ce950b6131be099d4
 DIST libcap-2.68.tar.xz 188824 BLAKE2B 659ee2b0f92ab7490e7f4c9ccd6aafa02ae36c509654fdb53a0b9da4d5ba8be2d1b5afd2073b2b1c75f9585a0593a9d3e70af59fe0c213e178782bbd11cd3b3d SHA512 ede3e1356aef22e18a46dc8ff0727500ab023bea698cf2bb822abb06625e272940afea52ad6457d0cd8cf1c7f435f1b568baf0a6bf0a08ae96fbf6d7502f9de2
+DIST libcap-2.69.tar.xz 189200 BLAKE2B 94d1fef7666a1c383a8b96f1f6092bd242164631532868b628d2f5de71b42a371d041a978ef7fbadfee3eeb433165444995d1078cd790275bc0433a7875a697e SHA512 647c307dc451517da9d089495ab959b4a6fbbe41c79f4e1e9bb663569dad630ead0c2e413dfb393319e3ea14dc9848c81b392107fe3382ce1813d278c3394a7f
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/files/libcap-2.62-ignore-RAISE_SETFCAP-install-failures.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/files/libcap-2.62-ignore-RAISE_SETFCAP-install-failures.patch
index 04c59357c4..bd1c22fcad 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/files/libcap-2.62-ignore-RAISE_SETFCAP-install-failures.patch
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/files/libcap-2.62-ignore-RAISE_SETFCAP-install-failures.patch
@@ -8,11 +8,6 @@ due to the fs not supporting it) shouldn't impair the default install.
 
 Signed-off-by: Mike Frysinger <vapier@gentoo.org>
 
-Forward ported from libcap-2.20 to libcap-2.25
-
-Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>
-diff --git a/progs/Makefile b/progs/Makefile
-index 2cb7520..6d417de 100644
 --- a/progs/Makefile
 +++ b/progs/Makefile
 @@ -39,7 +39,7 @@ install: all
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.66.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.66.ebuild
deleted file mode 100644
index 264d6b5c9a..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.66.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit multilib-minimal toolchain-funcs pam usr-ldscript
-
-if [[ ${PV} == *9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/libs/libcap/libcap.git"
-else
-	SRC_URI="https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${P}.tar.xz"
-
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-fi
-
-DESCRIPTION="POSIX 1003.1e capabilities"
-HOMEPAGE="https://sites.google.com/site/fullycapable/"
-
-# it's available under either of the licenses
-LICENSE="|| ( GPL-2 BSD )"
-SLOT="0"
-IUSE="pam static-libs tools"
-
-# While the build system optionally uses gperf, we don't DEPEND on it because
-# the build automatically falls back when it's unavailable.  #604802
-PDEPEND="pam? ( sys-libs/pam[${MULTILIB_USEDEP}] )"
-DEPEND="${PDEPEND}
-	sys-kernel/linux-headers"
-BDEPEND="
-	sys-apps/diffutils
-	tools? ( dev-lang/go )"
-
-QA_FLAGS_IGNORED="sbin/captree" # go binaries don't use LDFLAGS
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.62-ignore-RAISE_SETFCAP-install-failures.patch
-)
-
-src_prepare() {
-	default
-	multilib_copy_sources
-}
-
-run_emake() {
-	local args=(
-		AR="$(tc-getAR)"
-		CC="$(tc-getCC)"
-		OBJCOPY="$(tc-getOBJCOPY)"
-		RANLIB="$(tc-getRANLIB)"
-		exec_prefix="${EPREFIX}"
-		lib_prefix="${EPREFIX}/usr"
-		lib="$(get_libdir)"
-		prefix="${EPREFIX}/usr"
-		PAM_CAP="$(usex pam yes no)"
-		DYNAMIC=yes
-		GOLANG="$(multilib_native_usex tools yes no)"
-	)
-	emake "${args[@]}" "$@"
-}
-
-src_configure() {
-	tc-export_build_env BUILD_CC
-	multilib-minimal_src_configure
-}
-
-multilib_src_compile() {
-	run_emake
-}
-
-multilib_src_test() {
-	run_emake test
-}
-
-multilib_src_install() {
-	# no configure, needs explicit install line #444724#c3
-	run_emake DESTDIR="${D}" install
-
-	gen_usr_ldscript -a cap
-	gen_usr_ldscript -a psx
-	if ! use static-libs ; then
-		rm "${ED}"/usr/$(get_libdir)/lib{cap,psx}.a || die
-	fi
-
-	# install pam plugins ourselves
-	rm -rf "${ED}"/usr/$(get_libdir)/security || die
-
-	if use pam ; then
-		dopammod pam_cap/pam_cap.so
-		dopamsecurity '' pam_cap/capability.conf
-	fi
-}
-
-multilib_src_install_all() {
-	dodoc CHANGELOG README doc/capability.notes
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.68.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.68.ebuild
index a3341be749..f1d3b050aa 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.68.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.68.ebuild
@@ -11,7 +11,7 @@ if [[ ${PV} == *9999 ]]; then
 else
 	SRC_URI="https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/${P}.tar.xz"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 DESCRIPTION="POSIX 1003.1e capabilities"
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.67.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69.ebuild
similarity index 97%
rename from sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.67.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69.ebuild
index 2072f83214..a3341be749 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.67.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libcap/libcap-2.69.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit multilib-minimal toolchain-funcs pam usr-ldscript
 
@@ -92,5 +92,5 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
-	dodoc CHANGELOG README doc/capability.notes
+	dodoc CHANGELOG README doc/capability.md
 }