From cc5f4ce2e596c361acc51fb65199639c1ed99adf Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 6 Apr 2022 22:30:19 +0200
Subject: [PATCH 01/11] coreos-base/hard-host-depends: Add packages pulled in
 by distutils eclass

---
 .../hard-host-depends/hard-host-depends-0.0.1.ebuild           | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
index 0873ae409e..3a2067df1c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/hard-host-depends/hard-host-depends-0.0.1.ebuild
@@ -50,8 +50,11 @@ RDEPEND="${RDEPEND}
 	dev-libs/libyaml
 	dev-libs/nspr
 	dev-libs/protobuf
+	dev-python/flit_core
+	dev-python/gpep517
 	dev-python/mako
 	dev-python/setuptools
+	dev-python/wheel
 	dev-util/gdbus-codegen
 	dev-util/gperf
 	>=dev-util/gtk-doc-am-1.13

From 4e38d17efa609decfb818bc595c55b5091b3678d Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 7 Apr 2022 19:15:10 +0200
Subject: [PATCH 02/11] sec-policy/selinux-base: Depend on python properly

Otherwise it was trying to pull in the latest stable python version,
which currently is 3.10, while we still are using 3.9.
---
 .../selinux-base/selinux-base-2.20200818-r2.ebuild        | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
index 50935ad704..f17de9ee5b 100644
--- a/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/selinux-base-2.20200818-r2.ebuild
@@ -4,8 +4,10 @@
 EAPI="7"
 
 # flatcar changes
+PYTHON_COMPAT=( python3_{8,9,10} )
+PYTHON_REQ_USE="xml"
 TMPFILES_OPTIONAL=1
-inherit systemd tmpfiles
+inherit systemd tmpfiles python-any-r1
 
 if [[ ${PV} == 9999* ]]; then
 	EGIT_REPO_URI="${SELINUX_GIT_REPO:-https://anongit.gentoo.org/git/proj/hardened-refpolicy.git}"
@@ -32,10 +34,10 @@ RDEPEND=">=sys-apps/policycoreutils-2.8
 	>=sys-apps/checkpolicy-2.8
 "
 DEPEND="${RDEPEND}"
-# flatcar: BDEPEND on python3[xml] - normally pulled in through policycoreutils
+# flatcar: BDEPEND on python - normally pulled in through policycoreutils
 # but we made that dep conditional on USE=python
 BDEPEND="sys-devel/m4
-    >=dev-lang/python-3[xml]
+    ${PYTHON_DEPS}
 "
 
 

From d793efce8b6042709e703f1f371ce07cff0cda1b Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Thu, 7 Apr 2022 19:23:56 +0200
Subject: [PATCH 03/11] dev-lang/python-oem: Copy from Gentoo

---
 .../dev-lang/python-oem/Manifest              |   5 +-
 .../dev-lang/python-oem/README.md             |   4 +
 .../python-oem/python-oem-3.9.12.ebuild       | 405 ++++++++++++++++++
 .../python-oem/python-oem-3.9.8.ebuild        | 189 --------
 4 files changed, 412 insertions(+), 191 deletions(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
 delete mode 100644 sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
index 4e3c4098c0..a7e7c5ade1 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/Manifest
@@ -1,2 +1,3 @@
-DIST Python-3.9.8.tar.xz 19149464 BLAKE2B 739eb22bae8b44cf5be9a24ca6ecacb80eaca65684abf1fef18b7adcac9adede2eff60e8a9ac5db2672511d180d6079c39e2ff2901ab454c0876ae8e1bfe96cc SHA512 5d5b46a242525b2e6a7f9c69c63c6d7cd985e1443a7d9b716107e75f14fef7b5c9c2e5e8a90adbbbf5f7a8b90a483d01e18c1732470e6e54b611b5aba9f99fe1
-DIST python-gentoo-patches-3.9.8.tar.xz 13192 BLAKE2B 995bead7e87b1d2eb9984012065c0f752d51e5a78dd9019270e071f83660cdab71c39e5be0104919f5af9089dede71d9c918a521f76e67c6ef1aeab5ffb58991 SHA512 80dfa3766bb5546924a5fccf4f469ce409cb8a4b0873c3d2fb737b3eb27b7c2b29337e0179624bbe077273b8e475f7921d6479ca7eb8e31ba423d0cea2f3d1cf
+DIST Python-3.9.12.tar.xz 19740524 BLAKE2B 05f2469aa53ca36221ef4976b17bfde3e5b86afd5a8114e5a7fd899f975a8e55022555ef718d5352ab68de1b7b23865a0bf713768c9c2b30d591438c9a396d25 SHA512 081981901e14149748fd35228db0b3b1d96fef227ae7404f07b8bad0fda4b02649bf31c348c94aefdaf3327565d78f9489437c2c02f647b15d41376a27a23e97
+DIST Python-3.9.12.tar.xz.asc 833 BLAKE2B 33436d0404a643215a8fd2b967ffd216201da24f374941bf65b888159ccfabcbe79b751eca2dd489b06605604338c8bbaab74aa10abbe4bcffaa54236301228e SHA512 dddaa27f8a29034f458edb6739398a5455c87fe37b6349e161865a9deedca118ffe9cb82663cc75bbe60b3b556399c0c6855f5262aac1fe90d36a3694fca65b2
+DIST python-gentoo-patches-3.9.12.tar.xz 12848 BLAKE2B 5dd66fa94b136a463d2c4be3a5b7dfad770c3905467a1d81af02a35b2783ce7d614881c915ee8f8e764c1656963d6886d9c60c6e524f512e1bc496e42d01307b SHA512 07de63e47a8e547724099062239df8fcfd254f19d38be28131e6bbb094ffbab8483861fb6a5905e60d7fa7a1a5dc06785951fa31984ecad89516b0b742c47f91
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
index 18793b7c57..8b27d3d896 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/README.md
@@ -1,5 +1,9 @@
 Modifications made:
 
+- Drop `pgo` and `lto` USE flags, so flags passed to configure are
+  `--without-lto` and `--disable-optimizations`. Also drop `pgo` code
+  in `src_configure` and `src_compile`.
+
 - We are not running any tests, so drop the `test` use flag and
   `src_test` function. Drop also `pkg_pretend` and `pkg_setup`
   functions as they were only doing some stuff if `test` use flag was
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
new file mode 100644
index 0000000000..110efb768a
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
@@ -0,0 +1,405 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils \
+	python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="https://www.python.org/"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
+IUSE="bluetooth build examples gdbm hardened lto +ncurses pgo +readline +sqlite +ssl test tk wininst +xml"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	dev-lang/python-exec[python_targets_python3_9(-)]
+	dev-libs/libffi:=
+	sys-apps/util-linux:=
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+	xml? ( >=dev-libs/expat-2.1:= )
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils[extra-filters(+)] )
+"
+BDEPEND="
+	virtual/awk
+	virtual/pkgconfig
+	sys-devel/autoconf-archive
+	verify-sig? ( sec-keys/openpgp-keys-python )
+	!sys-devel/gcc[libffi(-)]
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat, libffi and zlib are not used.
+	rm -fr Modules/expat || die
+	rm -fr Modules/_ctypes/libffi* || die
+	rm -fr Modules/zlib || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" \
+		setup.py || die "sed failed to replace @@GENTOO_LIBDIR@@"
+
+	# force correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	use bluetooth || export ac_cv_header_bluetooth_bluetooth_h=no
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	use xml       || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if ! use xml; then
+		ewarn "You have configured Python without XML support."
+		ewarn "This is NOT a recommended configuration as you"
+		ewarn "may face problems parsing any XML documents."
+	fi
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	if [[ "$(gcc-major-version)" -ge 4 ]]; then
+		append-flags -fwrapv
+	fi
+
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/show_bug.cgi?id=50309
+	if is-flagq -O3; then
+		is-flagq -fstack-protector-all && replace-flags -O3 -O2
+		use hardened && replace-flags -O3 -O2
+	fi
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	tc-export CXX
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	use ncurses && append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+
+	local dbmliborder
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
+		export PROFILE_TASK="-m test -j${jobs} --pgo-extended -x test_gdb -u-network"
+
+		# All of these seem to occasionally hang for PGO inconsistently
+		# They'll even hang here but be fine in src_test sometimes.
+		# bug #828535 (and related: bug #788022)
+		PROFILE_TASK+=" -x test_socket -x test_asyncio -x test_httpservers -x test_logging -x test_multiprocessing_fork -x test_xmlrpc"
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			PROFILE_TASK+=" -x test_distutils"
+		fi
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-system-ffi
+
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict /usr/lib/python3.9/site-packages
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# Skip failing tests.
+	local skipped_tests="gdb"
+
+	if use sparc ; then
+		# bug #788022
+		skipped_tests+=" multiprocessing_fork"
+		skipped_tests+=" multiprocessing_forkserver"
+	fi
+
+	for test in ${skipped_tests}; do
+		mv "${S}"/Lib/test/test_${test}.py "${T}"
+	done
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+
+	local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
+
+	emake test EXTRATESTOPTS="-u-network -j${jobs}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local result=$?
+
+	for test in ${skipped_tests}; do
+		mv "${T}/test_${test}.py" "${S}"/Lib/test
+	done
+
+	elog "The following tests have been skipped:"
+	for test in ${skipped_tests}; do
+		elog "test_${test}.py"
+	done
+
+	elog "If you would like to run them, you may:"
+	elog "cd '${EPREFIX}/usr/lib/python${PYVER}/test'"
+	elog "and run the tests separately."
+
+	if [[ ${result} -ne 0 ]]; then
+		die "emake test failed"
+	fi
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	use sqlite || rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	use tk || rm -r "${ED}/usr/bin/idle${PYVER}" "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \
+		emake --no-print-directory -s -f - 2>/dev/null)
+	newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	local -x EPYTHON=python${PYVER}
+	# if not using a cross-compiler, use the fresh binary
+	if ! tc-is-cross-compiler; then
+		local -x PYTHON=./python
+		local -x LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}${PWD}
+	else
+		local -x PYTHON=${EPREFIX}/usr/bin/${EPYTHON}
+	fi
+
+	echo "EPYTHON='${EPYTHON}'" > epython.py || die
+	python_domodule epython.py
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" \
+		"${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" \
+		"${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" \
+		"${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" \
+		"${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" \
+			"${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild
deleted file mode 100644
index 42b146ebc3..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.8.ebuild
+++ /dev/null
@@ -1,189 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="7"
-WANT_LIBTOOL="none"
-
-inherit autotools check-reqs flag-o-matic multiprocessing \
-	python-utils-r1 toolchain-funcs verify-sig
-
-MY_PV=${PV/_rc/rc}
-MY_P="Python-${MY_PV%_p*}"
-PYVER=$(ver_cut 1-2)
-PATCHSET="python-gentoo-patches-${MY_PV}"
-
-DESCRIPTION="An interpreted, interactive, object-oriented programming language"
-HOMEPAGE="https://www.python.org/"
-SRC_URI="https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz
-	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
-	https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/python/${PATCHSET}.tar.xz
-	verify-sig? (
-		https://www.python.org/ftp/python/${PV%_*}/${MY_P}.tar.xz.asc
-	)"
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="PSF-2"
-SLOT="${PYVER}"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="hardened"
-
-# Do not add a dependency on dev-lang/python to this ebuild.
-# If you need to apply a patch which requires python for bootstrapping, please
-# run the bootstrap code on your dev box and include the results in the
-# patchset. See bug 447752.
-
-DEPEND="app-arch/bzip2:=
-	app-arch/xz-utils:=
-	sys-apps/util-linux:=
-	>=sys-libs/zlib-1.1.3:=
-	virtual/libcrypt:=
-	virtual/libintl"
-BDEPEND="
-	virtual/awk
-	virtual/pkgconfig
-	sys-devel/autoconf-archive
-	verify-sig? ( app-crypt/openpgp-keys-python )
-	!sys-devel/gcc[libffi(-)]"
-
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
-
-# large file tests involve a 2.5G file being copied (duplicated)
-CHECKREQS_DISK_BUILD=5500M
-
-src_unpack() {
-	if use verify-sig; then
-		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
-	fi
-	default
-}
-
-src_prepare() {
-	# Ensure that internal copies of zlib are not used.
-	rm -fr Modules/zlib || die
-
-	local PATCHES=(
-		"${WORKDIR}/${PATCHSET}"
-	)
-
-	default
-
-	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" \
-		setup.py || die "sed failed to replace @@GENTOO_LIBDIR@@"
-
-	# force correct number of jobs
-	# https://bugs.gentoo.org/737660
-	local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
-	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
-	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local disable
-	# disable automagic bluetooth headers detection
-	export ac_cv_header_bluetooth_bluetooth_h=no
-	disable+=" gdbm"
-	disable+=" _curses _curses_panel"
-	disable+=" readline"
-	disable+=" _sqlite3"
-	export PYTHON_DISABLE_SSL="1"
-	disable+=" _tkinter"
-	export PYTHON_DISABLE_MODULES="${disable}"
-
-	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
-		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
-	fi
-
-	if [[ "$(gcc-major-version)" -ge 4 ]]; then
-		append-flags -fwrapv
-	fi
-
-	filter-flags -malign-double
-
-	# https://bugs.gentoo.org/show_bug.cgi?id=50309
-	if is-flagq -O3; then
-		is-flagq -fstack-protector-all && replace-flags -O3 -O2
-		use hardened && replace-flags -O3 -O2
-	fi
-
-	# https://bugs.gentoo.org/700012
-	if is-flagq -flto || is-flagq '-flto=*'; then
-		append-cflags $(test-flags-CC -ffat-lto-objects)
-	fi
-
-	if tc-is-cross-compiler; then
-		# Force some tests that try to poke fs paths.
-		export ac_cv_file__dev_ptc=no
-		export ac_cv_file__dev_ptmx=yes
-	fi
-
-	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
-	tc-export CXX
-
-	local dbmliborder
-
-	local myeconfargs=(
-		# glibc-2.30 removes it; since we can't cleanly force-rebuild
-		# Python on glibc upgrade, remove it proactively to give
-		# a chance for users rebuilding python before glibc
-		ac_cv_header_stropts_h=no
-
-		--prefix=/usr/share/oem/python
-		--with-platlibdir=$(get_libdir)
-		--disable-shared
-		--enable-ipv6
-		--infodir='/discard/info'
-		--mandir='/discard/man'
-		--includedir='/discard/include'
-		--with-computed-gotos
-		--with-dbmliborder="${dbmliborder}"
-		--with-libc=
-		--enable-loadable-sqlite-extensions
-		--without-ensurepip
-		--without-system-expat
-		--without-system-ffi
-	)
-
-	OPT="" econf "${myeconfargs[@]}"
-
-	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
-		eerror "configure has detected that the sem_open function is broken."
-		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
-		die "Broken sem_open function (bug 496328)"
-	fi
-}
-
-src_compile() {
-	# Ensure sed works as expected
-	# https://bugs.gentoo.org/594768
-	local -x LC_ALL=C
-	# Prevent using distutils bundled by setuptools.
-	# https://bugs.gentoo.org/823728
-	export SETUPTOOLS_USE_DISTUTILS=stdlib
-
-	emake CPPFLAGS= CFLAGS= LDFLAGS=
-}
-
-src_install() {
-	local prefix=/usr/share/oem/python
-	local eprefix="${ED}${prefix}"
-	local elibdir="${eprefix}/$(get_libdir)"
-	local epythonplatlibdir="${elibdir}/python${PYVER}"
-	local bindir="${prefix}/bin"
-	local ebindir="${eprefix}/bin"
-
-	emake DESTDIR="${D}" altinstall
-
-	# Remove static library
-	rm "${elibdir}"/libpython*.a || die
-
-	rm -r "${epythonplatlibdir}/"{sqlite3,test/test_sqlite*} || die
-	rm -r "${ebindir}/idle${PYVER}" "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
-
-	# create a simple versionless 'python' symlink
-	dosym "python${PYVER}" "${bindir}/python"
-	dosym "python${PYVER}" "${bindir}/python3"
-
-	rm -r "${ED}/discard" || die
-}

From 4bc01c9201c34aa0390d70bd18b9d722e4986e89 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 30 Nov 2021 17:06:15 +0100
Subject: [PATCH 04/11] dev-lang/python-oem: Apply Flatcar modifications

---
 .../python-oem/python-oem-3.9.12.ebuild       | 269 +++---------------
 1 file changed, 40 insertions(+), 229 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
index 110efb768a..0cdb068420 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-lang/python-oem/python-oem-3.9.12.ebuild
@@ -4,7 +4,7 @@
 EAPI="7"
 WANT_LIBTOOL="none"
 
-inherit autotools check-reqs flag-o-matic multiprocessing pax-utils \
+inherit autotools check-reqs flag-o-matic multiprocessing \
 	python-utils-r1 toolchain-funcs verify-sig
 
 MY_PV=${PV/_rc/rc}
@@ -26,41 +26,21 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="PSF-2"
 SLOT="${PYVER}"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
-IUSE="bluetooth build examples gdbm hardened lto +ncurses pgo +readline +sqlite +ssl test tk wininst +xml"
-RESTRICT="!test? ( test )"
+IUSE="hardened"
 
 # Do not add a dependency on dev-lang/python to this ebuild.
 # If you need to apply a patch which requires python for bootstrapping, please
 # run the bootstrap code on your dev box and include the results in the
 # patchset. See bug 447752.
 
-RDEPEND="
+DEPEND="
 	app-arch/bzip2:=
 	app-arch/xz-utils:=
 	dev-lang/python-exec[python_targets_python3_9(-)]
-	dev-libs/libffi:=
 	sys-apps/util-linux:=
 	>=sys-libs/zlib-1.1.3:=
 	virtual/libcrypt:=
 	virtual/libintl
-	gdbm? ( sys-libs/gdbm:=[berkdb] )
-	ncurses? ( >=sys-libs/ncurses-5.2:= )
-	readline? ( >=sys-libs/readline-4.1:= )
-	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
-	ssl? ( >=dev-libs/openssl-1.1.1:= )
-	tk? (
-		>=dev-lang/tcl-8.0:=
-		>=dev-lang/tk-8.0:=
-		dev-tcltk/blt:=
-		dev-tcltk/tix
-	)
-	xml? ( >=dev-libs/expat-2.1:= )
-"
-# bluetooth requires headers from bluez
-DEPEND="
-	${RDEPEND}
-	bluetooth? ( net-wireless/bluez )
-	test? ( app-arch/xz-utils[extra-filters(+)] )
 "
 BDEPEND="
 	virtual/awk
@@ -69,9 +49,6 @@ BDEPEND="
 	verify-sig? ( sec-keys/openpgp-keys-python )
 	!sys-devel/gcc[libffi(-)]
 "
-RDEPEND+="
-	!build? ( app-misc/mime-types )
-"
 
 VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
 
@@ -80,14 +57,6 @@ CHECKREQS_DISK_BUILD=5500M
 
 QA_PKGCONFIG_VERSION=${PYVER}
 
-pkg_pretend() {
-	use test && check-reqs_pkg_pretend
-}
-
-pkg_setup() {
-	use test && check-reqs_pkg_setup
-}
-
 src_unpack() {
 	if use verify-sig; then
 		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
@@ -96,9 +65,7 @@ src_unpack() {
 }
 
 src_prepare() {
-	# Ensure that internal copies of expat, libffi and zlib are not used.
-	rm -fr Modules/expat || die
-	rm -fr Modules/_ctypes/libffi* || die
+	# Ensure that internal copies of zlib are not used.
 	rm -fr Modules/zlib || die
 
 	local PATCHES=(
@@ -122,22 +89,15 @@ src_prepare() {
 src_configure() {
 	local disable
 	# disable automagic bluetooth headers detection
-	use bluetooth || export ac_cv_header_bluetooth_bluetooth_h=no
-	use gdbm      || disable+=" gdbm"
-	use ncurses   || disable+=" _curses _curses_panel"
-	use readline  || disable+=" readline"
-	use sqlite    || disable+=" _sqlite3"
-	use ssl       || export PYTHON_DISABLE_SSL="1"
-	use tk        || disable+=" _tkinter"
-	use xml       || disable+=" _elementtree pyexpat" # _elementtree uses pyexpat.
+	export ac_cv_header_bluetooth_bluetooth_h=no
+	disable+=" gdbm"
+	disable+=" _curses _curses_panel"
+	disable+=" readline"
+	disable+=" _sqlite3"
+	export PYTHON_DISABLE_SSL="1"
+	disable+=" _tkinter"
 	export PYTHON_DISABLE_MODULES="${disable}"
 
-	if ! use xml; then
-		ewarn "You have configured Python without XML support."
-		ewarn "This is NOT a recommended configuration as you"
-		ewarn "may face problems parsing any XML documents."
-	fi
-
 	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
 		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
 	fi
@@ -159,31 +119,16 @@ src_configure() {
 		append-cflags $(test-flags-CC -ffat-lto-objects)
 	fi
 
+	if tc-is-cross-compiler; then
+		# Force some tests that try to poke fs paths.
+		export ac_cv_file__dev_ptc=no
+		export ac_cv_file__dev_ptmx=yes
+	fi
+
 	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
 	tc-export CXX
 
-	# Fix implicit declarations on cross and prefix builds. Bug #674070.
-	use ncurses && append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
-
 	local dbmliborder
-	if use gdbm; then
-		dbmliborder+="${dbmliborder:+:}gdbm"
-	fi
-
-	if use pgo; then
-		local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
-		export PROFILE_TASK="-m test -j${jobs} --pgo-extended -x test_gdb -u-network"
-
-		# All of these seem to occasionally hang for PGO inconsistently
-		# They'll even hang here but be fine in src_test sometimes.
-		# bug #828535 (and related: bug #788022)
-		PROFILE_TASK+=" -x test_socket -x test_asyncio -x test_httpservers -x test_logging -x test_multiprocessing_fork -x test_xmlrpc"
-
-		if has_version "app-arch/rpm" ; then
-			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
-			PROFILE_TASK+=" -x test_distutils"
-		fi
-	fi
 
 	local myeconfargs=(
 		# glibc-2.30 removes it; since we can't cleanly force-rebuild
@@ -191,20 +136,22 @@ src_configure() {
 		# a chance for users rebuilding python before glibc
 		ac_cv_header_stropts_h=no
 
-		--enable-shared
+		--prefix=/usr/share/oem/python
+		--with-platlibdir=$(get_libdir)
+		--disable-shared
 		--enable-ipv6
-		--infodir='${prefix}/share/info'
-		--mandir='${prefix}/share/man'
+		--infodir='/discard/info'
+		--mandir='/discard/man'
+		--includedir='/discard/include'
 		--with-computed-gotos
 		--with-dbmliborder="${dbmliborder}"
 		--with-libc=
 		--enable-loadable-sqlite-extensions
 		--without-ensurepip
-		--with-system-expat
-		--with-system-ffi
-
-		$(use_with lto)
-		$(use_enable pgo optimizations)
+		--without-system-expat
+		--without-system-ffi
+		--without-lto
+		--disable-optimizations
 	)
 
 	# disable implicit optimization/debugging flags
@@ -237,169 +184,33 @@ src_compile() {
 	# bug #831897
 	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
 
-	if use pgo ; then
-		# bug 660358
-		local -x COLUMNS=80
-		local -x PYTHONDONTWRITEBYTECODE=
-
-		addpredict /usr/lib/python3.9/site-packages
-	fi
-
 	# also need to clear the flags explicitly here or they end up
 	# in _sysconfigdata*
 	emake CPPFLAGS= CFLAGS= LDFLAGS=
 
 	# Restore saved value from above.
 	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
-
-	# Work around bug 329499. See also bug 413751 and 457194.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E python
-	else
-		pax-mark m python
-	fi
-}
-
-src_test() {
-	# Tests will not work when cross compiling.
-	if tc-is-cross-compiler; then
-		elog "Disabling tests due to crosscompiling."
-		return
-	fi
-
-	# Skip failing tests.
-	local skipped_tests="gdb"
-
-	if use sparc ; then
-		# bug #788022
-		skipped_tests+=" multiprocessing_fork"
-		skipped_tests+=" multiprocessing_forkserver"
-	fi
-
-	for test in ${skipped_tests}; do
-		mv "${S}"/Lib/test/test_${test}.py "${T}"
-	done
-
-	# bug 660358
-	local -x COLUMNS=80
-	local -x PYTHONDONTWRITEBYTECODE=
-
-	local jobs=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)")
-
-	emake test EXTRATESTOPTS="-u-network -j${jobs}" \
-		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
-	local result=$?
-
-	for test in ${skipped_tests}; do
-		mv "${T}/test_${test}.py" "${S}"/Lib/test
-	done
-
-	elog "The following tests have been skipped:"
-	for test in ${skipped_tests}; do
-		elog "test_${test}.py"
-	done
-
-	elog "If you would like to run them, you may:"
-	elog "cd '${EPREFIX}/usr/lib/python${PYVER}/test'"
-	elog "and run the tests separately."
-
-	if [[ ${result} -ne 0 ]]; then
-		die "emake test failed"
-	fi
 }
 
 src_install() {
-	local libdir=${ED}/usr/lib/python${PYVER}
+	local prefix=/usr/share/oem/python
+	local eprefix="${ED}${prefix}"
+	local elibdir="${eprefix}/$(get_libdir)"
+	local epythonplatlibdir="${elibdir}/python${PYVER}"
+	local bindir="${prefix}/bin"
+	local ebindir="${eprefix}/bin"
 
 	emake DESTDIR="${D}" altinstall
 
 	# Remove static library
-	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+	rm "${elibdir}"/libpython*.a || die
 
-	# Fix collisions between different slots of Python.
-	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+	rm -r "${epythonplatlibdir}/"{sqlite3,test/test_sqlite*} || die
+	rm -r "${ebindir}/idle${PYVER}" "${epythonplatlibdir}/"{idlelib,tkinter,test/test_tk*} || die
 
-	# Cheap hack to get version with ABIFLAGS
-	local abiver=$(cd "${ED}/usr/include"; echo python*)
-	if [[ ${abiver} != python${PYVER} ]]; then
-		# Replace python3.X with a symlink to python3.Xm
-		rm "${ED}/usr/bin/python${PYVER}" || die
-		dosym "${abiver}" "/usr/bin/python${PYVER}"
-		# Create python3.X-config symlink
-		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
-		# Create python-3.5m.pc symlink
-		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
-	fi
+	# create a simple versionless 'python' symlink
+	dosym "python${PYVER}" "${bindir}/python"
+	dosym "python${PYVER}" "${bindir}/python3"
 
-	# python seems to get rebuilt in src_install (bug 569908)
-	# Work around it for now.
-	if has_version dev-libs/libffi[pax-kernel]; then
-		pax-mark E "${ED}/usr/bin/${abiver}"
-	else
-		pax-mark m "${ED}/usr/bin/${abiver}"
-	fi
-
-	use sqlite || rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
-	use tk || rm -r "${ED}/usr/bin/idle${PYVER}" "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
-
-	dodoc Misc/{ACKS,HISTORY,NEWS}
-
-	if use examples; then
-		docinto examples
-		find Tools -name __pycache__ -exec rm -fr {} + || die
-		dodoc -r Tools
-	fi
-	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
-	local libname=$(printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' | \
-		emake --no-print-directory -s -f - 2>/dev/null)
-	newins "${S}"/Tools/gdb/libpython.py "${libname}"-gdb.py
-
-	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
-	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
-	sed \
-		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
-		-e "s:@PYDOC@:pydoc${PYVER}:" \
-		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
-		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
-
-	local -x EPYTHON=python${PYVER}
-	# if not using a cross-compiler, use the fresh binary
-	if ! tc-is-cross-compiler; then
-		local -x PYTHON=./python
-		local -x LD_LIBRARY_PATH=${LD_LIBRARY_PATH+${LD_LIBRARY_PATH}:}${PWD}
-	else
-		local -x PYTHON=${EPREFIX}/usr/bin/${EPYTHON}
-	fi
-
-	echo "EPYTHON='${EPYTHON}'" > epython.py || die
-	python_domodule epython.py
-
-	# python-exec wrapping support
-	local pymajor=${PYVER%.*}
-	local scriptdir=${D}$(python_get_scriptdir)
-	mkdir -p "${scriptdir}" || die
-	# python and pythonX
-	ln -s "../../../bin/${abiver}" \
-		"${scriptdir}/python${pymajor}" || die
-	ln -s "python${pymajor}" "${scriptdir}/python" || die
-	# python-config and pythonX-config
-	# note: we need to create a wrapper rather than symlinking it due
-	# to some random dirname(argv[0]) magic performed by python-config
-	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
-		#!/bin/sh
-		exec "${abiver}-config" "\${@}"
-	EOF
-	chmod +x "${scriptdir}/python${pymajor}-config" || die
-	ln -s "python${pymajor}-config" \
-		"${scriptdir}/python-config" || die
-	# 2to3, pydoc
-	ln -s "../../../bin/2to3-${PYVER}" \
-		"${scriptdir}/2to3" || die
-	ln -s "../../../bin/pydoc${PYVER}" \
-		"${scriptdir}/pydoc" || die
-	# idle
-	if use tk; then
-		ln -s "../../../bin/idle${PYVER}" \
-			"${scriptdir}/idle" || die
-	fi
+	rm -r "${ED}/discard" || die
 }

From 23041be4c2f594cdd0cff052aafe65a9782c091d Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 8 Apr 2022 11:52:28 +0200
Subject: [PATCH 05/11] profiles: Mask python 3.10

It seems to be picked up for some reason during SDK build, instead of
using python 3.9.9:

emerge: there are no ebuilds to satisfy "dev-lang/python-exec[python_targets_python3_10(-)]".
(dependency required by "dev-lang/python-3.10.2_p1::portage-stable" [ebuild])
(dependency required by "sec-policy/selinux-base-2.20200818-r2::coreos" [ebuild])
(dependency required by "sec-policy/selinux-base-policy-2.20200818-r2::coreos" [ebuild])
(dependency required by "sec-policy/selinux-unconfined-2.20200818-r2::portage-stable" [ebuild])
---
 .../coreos-overlay/profiles/coreos/base/package.mask          | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
index b6be334a2d..7d04948e69 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask
@@ -17,3 +17,7 @@
 # libxcrypt -> glibc -> python), and also we need to update gcc to
 # version 10 or later.
 >=virtual/libcrypt-2
+
+# Python 3.10 is stable in portage-stable, so avoid picking it
+# up. Drop this when we switch to it.
+>=dev-lang/python-3.10

From a7339931a4fc6d0cb21dfb7d95b1e62d3d0d37c6 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Mon, 11 Apr 2022 13:55:09 +0200
Subject: [PATCH 06/11] dev-python/distro-oem: Bump to 1.7.0

---
 .../dev-python/distro-oem/Manifest            |  2 +-
 ....6.0-r1.ebuild => distro-oem-1.7.0.ebuild} | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)
 rename sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/{distro-oem-1.6.0-r1.ebuild => distro-oem-1.7.0.ebuild} (56%)

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
index 2f76217d5a..fbb1ae14b6 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/Manifest
@@ -1 +1 @@
-DIST distro-1.6.0.tar.gz 69377 BLAKE2B 69119c3acfc12327a55e8b16f4e183fe1b039e965a5432081d83c6e5d0f6367846c403eb34764f2436beec173d3ceaa5265e0e1e7d786d1008e84772426ef049 SHA512 1682a52e617ba440eb0fac28ed653dd3bbc53012e3dc81099d792f088d399c1a6aba62d638e7b50aad88de2cd0935579a0bdd29a9abb5aad9d0c68bd90311268
+DIST distro-1.7.0.tar.gz 58164 BLAKE2B 22bbd2daf9cac589530eac9a58767db6b9e389b77719516f7386a9377b49ba4c9b696165701acc42366b760b9a632c70a2243a58c12a367fef2a0a770a4aea44 SHA512 14516ecab33ee8c57c35a8279eb515fd699031fabac7d8886092ea98696797d55503179870aeb513a85e1a66c7e69f2f60bb6ea9fc935be975cb5135e1917ecc
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
similarity index 56%
rename from sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild
rename to sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
index e7c12f03f3..146f015bd5 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.6.0-r1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/distro-oem/distro-oem-1.7.0.ebuild
@@ -1,14 +1,17 @@
-# Copyright 2021 Microsoft Corporation
+# Copyright 2021-2022 Microsoft Corporation
 # Distributed under the terms of GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 MY_PN='distro'
 MY_P="${MY_PN}-${PV}"
 
-DESCRIPTION="OS platform information API"
-HOMEPAGE="https://github.com/python-distro/distro"
-SRC_URI="${HOMEPAGE}/releases/download/v${PV}/${MY_P}.tar.gz"
+DESCRIPTION="Reliable machine-readable Linux distribution information for Python"
+HOMEPAGE="
+	https://distro.readthedocs.io/en/latest/
+	https://pypi.org/project/distro/
+	https://github.com/python-distro/distro/"
+SRC_URI="mirror://pypi/${MY_PN:0:1}/${MY_PN}/${MY_P}.tar.gz"
 
 LICENSE="Apache-2.0"
 KEYWORDS="amd64 arm64"
@@ -30,5 +33,9 @@ src_compile() {
 
 src_install() {
 	insinto "/usr/share/oem/python/$(get_libdir)/python${DEP_PYVER}/site-packages"
-	doins "${S}/distro.py"
+	local ssd="${S}/src/distro"
+	doins "${ssd}/distro.py"
+	doins "${ssd}/__init__.py"
+	doins "${ssd}/__main__.py"
+	doins "${ssd}/py.typed"
 }

From 650892196ad259cb6bbaf60e4a652336c30a15e0 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Mon, 11 Apr 2022 13:55:54 +0200
Subject: [PATCH 07/11] dev-python/boto: Sync with Gentoo

It's from gentoo commit 99e8a93d029cb2370fb08397cdb6cd7b459b2353.
---
 .../dev-python/boto/boto-2.49.0-r4.ebuild     | 11 ++---
 .../boto/files/boto-2.49.0-py310.patch        | 44 +++++++++++++++++++
 2 files changed, 47 insertions(+), 8 deletions(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
index 00a2041688..5e32f2f4e2 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
@@ -3,7 +3,7 @@
 
 EAPI="7"
 
-PYTHON_COMPAT=( python3_{7..9} )
+PYTHON_COMPAT=( python3_{8..10} )
 DISTUTILS_USE_SETUPTOOLS=bdepend
 
 inherit distutils-r1
@@ -14,7 +14,7 @@ SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ppc ~ppc64 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+KEYWORDS="amd64 arm arm64 ppc ~ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 
 PATCHES=(
 	# taken from https://bugs.debian.org/909545
@@ -24,6 +24,7 @@ PATCHES=(
 	"${FILESDIR}"/${P}-py3-httplib-strict.patch
 	"${FILESDIR}"/${P}-py3-server-port.patch
 	"${FILESDIR}"/${P}-unbundle-six.patch
+	"${FILESDIR}"/${P}-py310.patch
 )
 
 RDEPEND=">=dev-python/six-1.12.0[${PYTHON_USEDEP}]"
@@ -50,12 +51,6 @@ src_prepare() {
 	# fix tests
 	mkdir -p "${HOME}"/.ssh || die
 	: > "${HOME}"/.ssh/known_hosts || die
-	# Flatcar: Do not import boto only for the version number in
-	# setup.py - it ends up trying to import six, which we have
-	# unbundled and the six module effectively becomes a BDEPEND
-	# instead of RDEPEND. Drop the import and define the
-	# __variable__ instead.
-	sed -i -e 's/^from boto import __version__$/__version__ = '"'${PV}'"'/' setup.py
 
 	distutils-r1_src_prepare
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
new file mode 100644
index 0000000000..7b427f1f15
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/files/boto-2.49.0-py310.patch
@@ -0,0 +1,44 @@
+diff --git a/boto/dynamodb/types.py b/boto/dynamodb/types.py
+index d9aaaa4c..3f8d8601 100644
+--- a/boto/dynamodb/types.py
++++ b/boto/dynamodb/types.py
+@@ -27,7 +27,7 @@ Python types and vice-versa.
+ import base64
+ from decimal import (Decimal, DecimalException, Context,
+                      Clamped, Overflow, Inexact, Underflow, Rounded)
+-from collections import Mapping
++from collections.abc import Mapping
+ from boto.dynamodb.exceptions import DynamoDBNumberError
+ from boto.compat import filter, map, six, long_type
+ 
+diff --git a/boto/mws/connection.py b/boto/mws/connection.py
+index 687fae74..3a1f5f80 100644
+--- a/boto/mws/connection.py
++++ b/boto/mws/connection.py
+@@ -21,7 +21,7 @@
+ import xml.sax
+ import hashlib
+ import string
+-import collections
++import collections.abc
+ from boto.connection import AWSQueryConnection
+ from boto.exception import BotoServerError
+ import boto.mws.exception
+@@ -109,7 +109,7 @@ def http_body(field):
+ def destructure_object(value, into, prefix, members=False):
+     if isinstance(value, boto.mws.response.ResponseElement):
+         destructure_object(value.__dict__, into, prefix, members=members)
+-    elif isinstance(value, collections.Mapping):
++    elif isinstance(value, collections.abc.Mapping):
+         for name in value:
+             if name.startswith('_'):
+                 continue
+@@ -117,7 +117,7 @@ def destructure_object(value, into, prefix, members=False):
+                                members=members)
+     elif isinstance(value, six.string_types):
+         into[prefix] = value
+-    elif isinstance(value, collections.Iterable):
++    elif isinstance(value, collections.abc.Iterable):
+         for index, element in enumerate(value):
+             suffix = (members and '.member.' or '.') + str(index + 1)
+             destructure_object(element, into, prefix + suffix,

From ce54fe641dc00b51d56e36bb0edc691583922eca Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 7 Dec 2021 13:17:37 +0100
Subject: [PATCH 08/11] dev-python/boto: Apply Flatcar modifications

---
 .../coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
index 5e32f2f4e2..4dd30bd7dc 100644
--- a/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/dev-python/boto/boto-2.49.0-r4.ebuild
@@ -51,6 +51,12 @@ src_prepare() {
 	# fix tests
 	mkdir -p "${HOME}"/.ssh || die
 	: > "${HOME}"/.ssh/known_hosts || die
+	# Flatcar: Do not import boto only for the version number in
+	# setup.py - it ends up trying to import six, which we have
+	# unbundled and the six module effectively becomes a BDEPEND
+	# instead of RDEPEND. Drop the import and define the
+	# __variable__ instead.
+	sed -i -e 's/^from boto import __version__$/__version__ = '"'${PV}'"'/' setup.py
 
 	distutils-r1_src_prepare
 }

From d5c18a906f3ec9d677d26c47fb7f7af7feccd418 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Fri, 13 May 2022 14:44:22 +0200
Subject: [PATCH 09/11] profiles: Clean up python USE flags

The berkdb flag is gone, sqlite flag is already enabled by default.
---
 .../coreos-overlay/profiles/coreos/targets/generic/package.use  | 2 +-
 .../coreos-overlay/profiles/coreos/targets/sdk/package.use      | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 5fb4a7c3d1..4e67ac1a50 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -3,7 +3,7 @@
 
 app-admin/sudo		ldap sssd
 app-editors/vim		minimal
-dev-lang/python		-berkdb gdbm
+dev-lang/python		gdbm
 dev-libs/dbus-glib	tools
 dev-libs/elfutils	-utils
 dev-libs/openssl	pkcs11
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
index 4c1f3550ab..1bd1d2dcb6 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use
@@ -2,8 +2,6 @@ coreos-base/update_engine delta_generator
 
 dev-vcs/git pcre
 
-dev-lang/python sqlite
-
 dev-lang/rust rustfmt
 
 # Allow smartcard support in the SDK for image signing

From f67e139a2b644590abdda269f3ebbf0ee9134e82 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Tue, 24 May 2022 12:52:04 +0200
Subject: [PATCH 10/11] profiles: Clean up berkdb USE flags

Disabling it per-package is a no-op since we disable berkdb globally
through the make.defaults file.

Also drop redundant enabling of berkdb in sys-libs/gdbm in target
profile, because we already do it in the base profile.
---
 .../coreos-overlay/profiles/coreos/base/package.use         | 6 ++++--
 .../profiles/coreos/targets/generic/package.use             | 3 +--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
index 2d051ed4c3..35e7a8fe88 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use
@@ -16,7 +16,9 @@ sys-devel/gettext	-git
 
 sys-apps/gptfdisk -icu
 
-# for profile migration
+# for profile migration, needs to be enabled despite the fact it's
+# enabled by default in the ebuild, because berkdb is disabled
+# globally in make.defaults.
 sys-libs/gdbm berkdb
 
 dev-vcs/git -perl -iconv
@@ -54,7 +56,7 @@ net-nds/openldap minimal sasl
 sys-libs/glibc nscd
 
 # disable database build because otherwise it tries to generate a database in /etc
-dev-libs/cyrus-sasl kerberos -berkdb -gdbm
+dev-libs/cyrus-sasl kerberos -gdbm
 
 # don't build manpages for sssd
 sys-auth/sssd -python samba kerberos gssapi ssh sudo selinux
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 4e67ac1a50..c675c12b17 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -14,8 +14,7 @@ sys-apps/smartmontools	-daemon -update-drivedb -systemd
 sys-block/parted        device-mapper
 sys-fs/lvm2		-readline
 sys-libs/ncurses	minimal
-sys-libs/pam		-berkdb audit
-sys-libs/gdbm		berkdb
+sys-libs/pam		audit
 
 # enable journal gateway, bootctl and container features
 sys-apps/systemd audit gnuefi importd http nat

From c070fd41c423fad40b0224e0132820f649d8cda1 Mon Sep 17 00:00:00 2001
From: Krzesimir Nowak <knowak@microsoft.com>
Date: Wed, 25 May 2022 07:24:28 +0200
Subject: [PATCH 11/11] changelog: Add an entry

---
 .../changelog/updates/2022-05-23-python-update.md               | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md

diff --git a/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md
new file mode 100644
index 0000000000..d850c9c262
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/changelog/updates/2022-05-23-python-update.md
@@ -0,0 +1,2 @@
+- OEM: python ([3.9.12](https://www.python.org/downloads/release/python-3912/))
+- OEM: distro ([1.7.0](https://github.com/python-distro/distro/releases/tag/v1.7.0))