diff --git a/changelog/security/2024-04-23-weekly-updates.md b/changelog/security/2024-04-23-weekly-updates.md
new file mode 100644
index 0000000000..096c577301
--- /dev/null
+++ b/changelog/security/2024-04-23-weekly-updates.md
@@ -0,0 +1,5 @@
+- expat ([CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425), [CVE-2024-28757](https://nvd.nist.gov/vuln/detail/CVE-2024-28757))
+- gnutls ([CVE-2024-28834](https://nvd.nist.gov/vuln/detail/CVE-2024-28834), [CVE-2024-28835](https://nvd.nist.gov/vuln/detail/CVE-2024-28835))
+- intel-microcode ([CVE-2023-22655](https://nvd.nist.gov/vuln/detail/CVE-2023-22655), [CVE-2023-28746](https://nvd.nist.gov/vuln/detail/CVE-2023-28746), [CVE-2023-38575](https://nvd.nist.gov/vuln/detail/CVE-2023-38575), [CVE-2023-39368](https://nvd.nist.gov/vuln/detail/CVE-2023-39368), [CVE-2023-43490](https://nvd.nist.gov/vuln/detail/CVE-2023-43490))
+- less ([CVE-2024-32487](https://nvd.nist.gov/vuln/detail/CVE-2024-32487))
+- python ([CVE-2023-6597](https://nvd.nist.gov/vuln/detail/CVE-2023-6597), [CVE-2024-0450](https://nvd.nist.gov/vuln/detail/CVE-2024-0450), [gh-81194](https://github.com/python/cpython/issues/81194), [gh-113659](https://github.com/python/cpython/issues/113659), [gh-102388](https://github.com/python/cpython/issues/102388), [gh-114572](https://github.com/python/cpython/issues/114572), [gh-115243](https://github.com/python/cpython/issues/115243))
diff --git a/changelog/updates/2024-04-23-weekly-updates.md b/changelog/updates/2024-04-23-weekly-updates.md
new file mode 100644
index 0000000000..309a0da634
--- /dev/null
+++ b/changelog/updates/2024-04-23-weekly-updates.md
@@ -0,0 +1,5 @@
+- expat ([2.6.2](https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes) (includes [2.6.1](https://github.com/libexpat/libexpat/blob/R_2_6_1/expat/Changes) and [2.6.0](https://github.com/libexpat/libexpat/blob/R_2_6_0/expat/Changes)))
+- gnutls ([3.8.5](https://lists.gnupg.org/pipermail/gnutls-help/2024-April/004846.html) (includes [3.8.4](https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html)))
+- intel-microcode ([20240312](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20240312))
+- libunistring ([1.2](https://savannah.gnu.org/news/?id=10599))
+- python ([3.11.9](https://www.get-python.org/downloads/release/python-3119/))
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 491a253e32..06da3e49da 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -23,9 +23,6 @@
 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
-# Needed for addressing CVE-2023-50246, CVE-2023-50268
-=app-misc/jq-1.7.1 ~amd64
-
 # Required for addressing CVE-2022-3715.
 =app-shells/bash-5.2_p26 ~amd64 ~arm64
 
@@ -36,12 +33,18 @@
 =dev-embedded/u-boot-tools-2021.04_rc2 ~arm64
 =dev-lang/nasm-2.15.05 ~arm64
 
+# Keep versions on both arches in sync.
+=dev-lang/python-3.11.9 ~amd64
+
 # Accept unstable host Rust compilers.
 =dev-lang/rust-1.77.2 ~amd64 ~arm64
 
 # Needed by arm64-native SDK.
 =dev-lang/yasm-1.3.0-r1 ~arm64
 
+# Needed to fix CVE-2023-52425 and CVE-2024-28757.
+=dev-libs/expat-2.6.2 ~amd64 ~arm64
+
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
 
@@ -58,6 +61,8 @@
 # Keep versions on both arches in sync.
 =dev-libs/libp11-0.4.12-r6 ~arm64
 =dev-libs/opensc-0.24.0 ~arm64
+=dev-python/cython-3.0.10 ~arm64
+=dev-python/lxml-5.2.1 ~arm64
 =dev-util/pahole-1.26 ~arm64
 
 # Needed for addressing CVE-2024-25629
@@ -66,14 +71,17 @@
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.6-r1 ~arm64
 
-# Required for addressing CVE-2023-0361, CVE-2023-5981, CVE-2024-0567
-# and CVE-2024-0553.
-=net-libs/gnutls-3.8.3 ~amd64 ~arm64
+# Required for addressing CVE-2023-0361, CVE-2023-5981, CVE-2024-0567,
+# CVE-2024-0553, CVE-2024-28834 and CVE-2024-28835.
+=net-libs/gnutls-3.8.5 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
+# Keep versions on both arches in sync.
+=net-misc/curl-8.7.1-r3 ~arm64
+
 # Required to allow us to override the sftp subsystem in sshd config.
 =net-misc/openssh-9.4_p1 ~amd64 ~arm64
 
@@ -83,7 +91,6 @@
 # Keep versions on both arches in sync.
 =sys-apps/kexec-tools-2.0.24 ~arm64
 =sys-apps/nvme-cli-2.8 ~arm64
-=sys-apps/util-linux-2.39.3-r7 ~arm64
 
 sys-apps/zram-generator ~amd64 ~arm64
 
@@ -93,6 +100,10 @@ sys-apps/zram-generator ~amd64 ~arm64
 # Keep versions on both arches in sync.
 =sys-firmware/edk2-aarch64-18.02 **
 
+# Needed to fix CVE-2023-22655, CVE-2023-28746, CVE-2023-38575,
+# CVE-2023-39368 and CVE-2023-43490.
+=sys-firmware/intel-microcode-20240312_p20240312 ~amd64
+
 # Needed to fix CVE-2023-29491.
 =sys-libs/ncurses-6.4_p20230527 ~amd64 ~arm64
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/metadata.xml b/sdk_container/src/third_party/portage-stable/app-arch/gzip/metadata.xml
index 0748488de1..d01e5bd7a1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/gzip/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/metadata.xml
@@ -7,6 +7,7 @@
 	</maintainer>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:gnu:gzip</remote-id>
+		<remote-id type="savannah">gzip</remote-id>
 	</upstream>
 	<use>
 		<flag name="pic">disable optimized assembly code that is not PIC friendly</flag>
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index be1266ce4a..441ef7e81d 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,4 @@
 DIST libarchive-3.7.2.tar.xz 5237056 BLAKE2B 7221db4811a965ee61d879a2603480363628a19995a351b572d099be9f35576d76f0b0822f9a5a47d9929bc094d4444fd8eafcb4a073e39bb3aa797d4b926ca5 SHA512 a21bebb27b808cb7d2ed13a70739904a1b7b55661d8dea83c9897a0129cf71e20c962f13666c571782ff0f4f753ca885619c2097d9e7691c2dee4e6e4b9a2971
 DIST libarchive-3.7.2.tar.xz.asc 659 BLAKE2B 7141baf007b89b7ee38ec817b648cef5efb4d694953fcd49f6ed2dc95cf4da2d9259262b9eb4f01ff5d4ecee1257b266a8c6687a8e8ef8790121048229f1ad22 SHA512 c2ce850088245d7723720737d74d1cc1819984d01b3f9e4ed96b0757f4c6d6d511b78792181a12400c563632d74edcd0c2c3a4b7527cba40ada7ef74488078fc
+DIST libarchive-3.7.3.tar.xz 5428992 BLAKE2B c53672c8cdbe8f406f00bf4fc6b36e4dffcd23a33909dbec6ef06b86dceefc6062840eff629ba3bd19c36121720e16a8ba10dfa1a35ebed186cc92eb144f55d0 SHA512 984e7c61010b9555bafe54d5f52ff2d089e28afe5cea3a14615e2aca8539075293789d18f17f8915882ec328bcbdca7b3d1536d6dc19620ca226e8b6d802ef63
+DIST libarchive-3.7.3.tar.xz.asc 659 BLAKE2B bfe18e36ef2e96ad46ab2cd1236701b4b80f41ebb840681c1baf7eac72f38444cc0619645fac17d3acdda6553b294483d87f0a92d9575138d117934e838d85d2 SHA512 9f340b41fc9db34f1c4e0823d559b666196d3031249e05981cfb43a401aa8a85710f14ba1cc784ab3ca367439e4c485668dffe7020f38f50b3ed35810df504a1
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r1.ebuild
index cc98e64978..3ca312b679 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r1.ebuild
@@ -19,7 +19,7 @@ SLOT="0/13"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="
 	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
-	static-libs test xattr zstd
+	static-libs test xattr +zstd
 "
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r3.ebuild
index 5387e642a6..476a896e4b 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2-r3.ebuild
@@ -16,10 +16,10 @@ SRC_URI="
 
 LICENSE="BSD BSD-2 BSD-4 public-domain"
 SLOT="0/13"
-KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="
 	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
-	static-libs test xattr zstd
+	static-libs test xattr +zstd
 "
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.3.ebuild
new file mode 100644
index 0000000000..4e1429fdc7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.3.ebuild
@@ -0,0 +1,176 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
+	kernel_linux? (
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index 1f42a49bc4..d2e98e50e1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -56,9 +56,6 @@ fi
 src_prepare() {
 	default
 
-	# Delete known-compromised test data (bug #928134)
-	rm tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma || die
-
 	if [[ ${PV} == 9999 ]] ; then
 		eautopoint
 		eautoreconf
@@ -109,6 +106,7 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
 	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
 	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
@@ -118,6 +116,43 @@ multilib_src_compile() {
 	if use pgo ; then
 		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
 
+		if multilib_is_native_abi ; then
+			(
+				shopt -s globstar
+
+				tar \
+					--sort=name --mtime=@2718281828 \
+					-cf xz-pgo-test-01.tar \
+					{"${S}","${BUILD_DIR}"}/**/*.[cho] \
+					{"${S}","${BUILD_DIR}"}/**/*.so* \
+					{"${S}","${BUILD_DIR}"}/**/**.txt \
+					{"${S}","${BUILD_DIR}"}/tests/files \
+
+				stat --printf="xz-pgo-test-01.tar.tar size: %s\n" xz-pgo-test-01.tar
+				md5sum xz-pgo-test-01.tar
+			)
+
+			local test_variants=(
+				# Borrowed from ALT Linux
+				# https://packages.altlinux.org/en/sisyphus/srpms/xz/specfiles/#line-80
+				'-0 -C none'
+				'-2 -C crc32'
+				'-6 --arm --lzma2 -C crc64'
+				'-6 --x86 --lzma2=lc=4 -C sha256'
+				'-7e --format=lzma'
+
+				# Our own variants
+				''
+				'-9e'
+				'--x86 --lzma2=preset=9e'
+			)
+			local test_variant
+			for test_variant in "${test_variants[@]}" ; do
+				"${BUILD_DIR}"/src/xz/xz -c ${test_variant} xz-pgo-test-01.tar | "${BUILD_DIR}"/src/xz/xz -c -d - > /dev/null
+				assert "Testing '${test_variant}' variant failed"
+			done
+		fi
+
 		if tc-is-clang; then
 			llvm-profdata merge "${T}"/${ABI}-pgo --output="${T}"/${ABI}-pgo/default.profdata || die
 		fi
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
index e801a4a101..e6910d3ce7 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/Manifest
@@ -1,2 +1,3 @@
 DIST ccid-1.5.1.tar.bz2 702586 BLAKE2B 7b9e3c6daf03c186f34ac9b13bd960293a6481f9237ee52937ece1040bd3a79b7dab318e1244205a7feae992261ab5e82292d80ae023a4f621e0e7af7cdb9df5 SHA512 492bde96f5752e2a5316693c44e35e2d041785a00d15e094905c0aafad392f5329009d12801899367276328a582936ee53a1c5239c1813c4536001cb8a608f2e
 DIST ccid-1.5.4.tar.bz2 706834 BLAKE2B 8b7f08145808ac94d085eef62c204f8146892cb11f2ce811e46e674272cab016d602afb945c6e808ce3957a80e847c0de2815fedaf15fc8c935cafaccf102762 SHA512 4b30f4768aebf49486a1b1e959615fa077bd393bfdd9e52c15bdc8d6ed63ce27fa7cf82a067d1f80d8b3534c66194036925d3fea5af64b6a775779d38267c757
+DIST ccid-1.5.5.tar.bz2 708374 BLAKE2B a82986ead2dbb3241ef419ad16eb0fac835c5ab4fa988e5ee53cd1608a30a9381210a6fd013b6a059ca2835d55b4a41afa4064575e91b8eb356bff6d01d19add SHA512 9d2aebe645a5880bfad7d420ddab96811d1fd989c79afa28f5471ae53f36b6d45ee5e13b32ac4afcf59fc762ae835db7e6312ad6642b263158c2d9a30c7651bd
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild
new file mode 100644
index 0000000000..d701d5ebd5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/ccid-1.5.5.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools udev
+
+DESCRIPTION="CCID free software driver"
+HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
+SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="twinserial +usb"
+
+RDEPEND="
+	>=sys-apps/pcsc-lite-1.8.3
+	twinserial? ( dev-lang/perl )
+	usb? ( virtual/libusb:1 )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-remove-flex-configure-dependency.patch
+)
+
+src_prepare() {
+	default
+
+	eautoconf
+}
+
+src_configure() {
+	econf \
+		LEX=: \
+		$(use_enable twinserial) \
+		$(use_enable usb libusb)
+}
+
+src_install() {
+	default
+	udev_newrules src/92_pcscd_ccid.rules 92-pcsc-ccid.rules
+}
+
+pkg_postinst() {
+	udev_reload
+	einfo "Check https://github.com/LudovicRousseau/CCID/blob/master/INSTALL"
+	einfo "for more info about how to configure and use ccid"
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.5-remove-flex-configure-dependency.patch b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.5-remove-flex-configure-dependency.patch
new file mode 100644
index 0000000000..a124c50d11
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/ccid/files/ccid-1.5.5-remove-flex-configure-dependency.patch
@@ -0,0 +1,13 @@
+Bug: https://bugs.gentoo.org/221361
+Reverts upstream commit eec7cdf0 & 41270c2
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -33,7 +33,5 @@
+ AC_PROG_MAKE_SET
+ AC_PROG_LN_S
+-AC_PROG_LEX([noyywrap])
+-AS_IF([test $LEX = ":"], [AC_MSG_ERROR([no lex or flex found])])
+ AM_PROG_AR
+ PKG_PROG_PKG_CONFIG
+
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.42-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.42-r3.ebuild
index 1034d8d094..d0937a7079 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.42-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.2.42-r3.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test tofu tools usb user-socket wks-server"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch
new file mode 100644
index 0000000000..7274ee4082
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/files/tpm2-tools-5.6-test-eventlog.sh-Fix-accidental-deletions.patch
@@ -0,0 +1,68 @@
+From 4dec5295361d753c3466bc9e8b0ae3a3cc58dff5 Mon Sep 17 00:00:00 2001
+From: Juergen Repp <juergen_repp@web.de>
+Date: Thu, 4 Apr 2024 09:42:51 +0200
+Subject: [PATCH] test eventlog.sh Fix accidental deletions.
+
+* Accidental deletions made in commit 196e3d439407e81040ced054a8ed302489348a9d
+  are undone.
+* python3 is used as default instead of python.
+
+Signed-off-by: Juergen Repp <juergen_repp@web.de>
+---
+ test/integration/tests/eventlog.sh | 33 ++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/test/integration/tests/eventlog.sh b/test/integration/tests/eventlog.sh
+index 9d5290f0..e7c13706 100755
+--- a/test/integration/tests/eventlog.sh
++++ b/test/integration/tests/eventlog.sh
+@@ -3,7 +3,7 @@
+ set -E
+ shopt -s expand_aliases
+ 
+-alias python=${PYTHON-python}
++alias python=${PYTHON-python3}
+ 
+ yaml_validate() {
+     cmd=$1
+@@ -88,7 +88,36 @@ expect_pass() {
+ expect_fail
+ expect_fail foo
+ expect_fail foo bar
+-expect_fail ${srcdir}/test/integration/fix
++expect_fail ${srcdir}/test/integration/fixtures/event-bad.bin
++
++expect_pass ${srcdir}/test/integration/fixtures/specid-vendordata.bin
++expect_pass ${srcdir}/test/integration/fixtures/event.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-uefivar.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-uefiaction.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-uefiservices.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-uefi-sha1-log.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-bootorder.bin
++expect_pass ${srcdir}/test/integration/fixtures/event-postcode.bin
++
++# Make sure that --eventlog-version=2 works on complete TPM2 logs
++expect_pass ${srcdir}/test/integration/fixtures/event-arch-linux.bin --eventlog-version=2
++expect_pass ${srcdir}/test/integration/fixtures/event-gce-ubuntu-2104-log.bin --eventlog-version=2
++expect_pass ${srcdir}/test/integration/fixtures/event-sd-boot-fedora37.bin --eventlog-version=2
++expect_pass ${srcdir}/test/integration/fixtures/event-moklisttrusted.bin --eventlog-version=2
++
++# Pick an event with leading whitespace and validate we have
++# preserved it correctly after parsing the YAML
++event=$(yaml_validate "print(y['events'][80]['Event']['String'])" < ${srcdir}/test/integration/fixtures/event-moklisttrusted.bin.yaml | tr -d '\0')
++expect=$(echo -e "grub_cmd: menuentry UEFI Firmware Settings --id uefi-firmware {\n\t\tfwsetup\n\t}")
++if test "$event" != "$expect"
++then
++    echo "Got $event"
++    echo "Want $expect"
++    exit 1
++fi
++
++# Compare strings generated by tpm2_eventlog with binary data of the corresponding
++# events.
+ hex_file="${srcdir}/test/integration/fixtures/event-moklisttrusted-hex.yaml"
+ tool_file="${srcdir}/test/integration/fixtures/event-moklisttrusted.bin.yaml"
+ 
+-- 
+2.43.2
+
diff --git a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild
index 04fb5536f1..ab59eed952 100644
--- a/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-crypt/tpm2-tools/tpm2-tools-5.6-r1.ebuild
@@ -42,6 +42,7 @@ PATCHES=(
 	"${WORKDIR}/${PN}-5.6-tpm2_eventlog-Create-raw-and-pretty-print-format-for.patch"
 	"${FILESDIR}/${PN}-5.6-Makefile-am-Dont-require-pandoc-for-tests.patch"
 	"${FILESDIR}/${PN}-5.6-bashism.patch"
+	"${FILESDIR}/${PN}-5.6-test-eventlog.sh-Fix-accidental-deletions.patch"
 )
 
 python_check_deps() {
@@ -73,7 +74,8 @@ src_install() {
 	local utils=( "${ED}"/usr/bin/tpm2_* )
 	utils=("${utils[@]##*/}")
 	# these utiltites don't have bash completions
-	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest tpm2_sessionconfig )
+	local nobashcomp=( tpm2_encodeobject tpm2_getpolicydigest\
+			   tpm2_sessionconfig tpm2_tr_encode)
 	mapfile -d $'\0' -t utils < <(printf '%s\0' "${utils[@]}" | grep -Ezvw "${nobashcomp[@]/#/-e}")
 	bashcomp_alias tpm2 "${utils[@]}"
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/jq/Manifest b/sdk_container/src/third_party/portage-stable/app-misc/jq/Manifest
index 8474923973..cb0502875c 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/jq/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-misc/jq/Manifest
@@ -1,2 +1 @@
 DIST jq-1.7.1.gh.tar.gz 1323338 BLAKE2B 17e3b68e23f9a7f1aa8749ede6c0b8fe435990899886f0c96da36d130c17d13609ba7f910321316f0c3b35985360f8cb5e6a3b12caea5e9bc7792e128798f137 SHA512 af9c444e5306423182f467a53acdf45bb8aefa058a47f490ce16395f0aebfb7627e3843f65e96f41cd9d4b72b8ad274ab0bdb061abc6990b1158f86d2256d4ec
-DIST jq-1.7.gh.tar.gz 1267139 BLAKE2B b6a54f9beaabd7915d7a8f14cda9621573f1796af53fe1645561a7a199787a7e9b2b2df038208f23e63f339dec567851b70696ffb8194986250527333d36d44e SHA512 01676319fe98d5ab1e278430b2c58ec594191cc9485a20312d658c0e199ac7ea5f5e934817ce98da0864ec7e0a018aae9b87525260e8ab6a7bde918db483bd84
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.1.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.1.ebuild
index e94109ed9a..81be3fadd8 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.1.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}/${PN}-${MY_P}"
 
 LICENSE="MIT CC-BY-3.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm arm64 ~ia64 ~loong ~ppc ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm arm64 ~ia64 ~loong ~ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="+oniguruma static-libs test"
 
 ONIGURUMA_MINPV='>=dev-libs/oniguruma-6.9.3' # Keep this in sync with bundled modules/oniguruma/
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.ebuild
deleted file mode 100644
index 81be3fadd8..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.7.ebuild
+++ /dev/null
@@ -1,84 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-MY_PV="${PV/_/}"
-MY_P="${PN}-${MY_PV}"
-DESCRIPTION="A lightweight and flexible command-line JSON processor"
-HOMEPAGE="https://stedolan.github.io/jq/"
-SRC_URI="https://github.com/jqlang/jq/archive/refs/tags/${MY_P}.tar.gz -> ${P}.gh.tar.gz"
-S="${WORKDIR}/${PN}-${MY_P}"
-
-LICENSE="MIT CC-BY-3.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 ~arm arm64 ~ia64 ~loong ~ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~arm64-macos ~x64-macos ~x64-solaris"
-IUSE="+oniguruma static-libs test"
-
-ONIGURUMA_MINPV='>=dev-libs/oniguruma-6.9.3' # Keep this in sync with bundled modules/oniguruma/
-DEPEND="
-	>=sys-devel/bison-3.0
-	app-alternatives/lex
-	oniguruma? ( ${ONIGURUMA_MINPV}:=[static-libs?] )
-"
-RDEPEND="
-	!static-libs? (
-		oniguruma? ( ${ONIGURUMA_MINPV}[static-libs?] )
-	)
-"
-PATCHES=(
-	"${FILESDIR}"/jq-1.6-r3-never-bundle-oniguruma.patch
-	"${FILESDIR}"/jq-1.7-runpath.patch
-)
-
-RESTRICT="!test? ( test )"
-REQUIRED_USE="test? ( oniguruma )"
-
-src_prepare() {
-	sed -e '/^dist_doc_DATA/d; s:-Wextra ::' -i Makefile.am || die
-	printf "#!/bin/sh\\nprintf '%s'\\n\n" "${MY_PV}" > scripts/version || die
-
-	# jq-1.6-r3-never-bundle-oniguruma makes sure we build with the system oniguruma,
-	# but the bundled copy of oniguruma still gets eautoreconf'd since it
-	# exists; save the cycles by nuking it.
-	sed -e '/modules\/oniguruma/d' -i Makefile.am || die
-	rm -rf "${S}"/modules/oniguruma || die
-
-	default
-
-	sed -i "s/\[jq_version\]/[${MY_PV}]/" configure.ac || die
-
-	eautoreconf
-}
-
-src_configure() {
-	local econfargs=(
-		# don't try to rebuild docs
-		--disable-docs
-		--disable-valgrind
-		--disable-maintainer-mode
-		--enable-rpathhack
-		$(use_enable static-libs static)
-		$(use_with oniguruma oniguruma yes)
-	)
-	econf "${econfargs[@]}"
-}
-
-src_test() {
-	if ! LD_LIBRARY_PATH="${S}/.libs" nonfatal emake check; then
-		if [[ -r "${S}/test-suite.log" ]]; then
-			eerror "Tests failed, outputting testsuite log"
-			cat "${S}/test-suite.log"
-		fi
-		die "Tests failed"
-	fi
-}
-
-src_install() {
-	local DOCS=( AUTHORS NEWS.md README.md SECURITY.md )
-	default
-
-	use static-libs || { find "${D}" -name '*.la' -delete || die; }
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
index 40dd6f42a7..4a045ee193 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/Manifest
@@ -1,2 +1 @@
-DIST pax-utils-1.3.5.tar.xz 119764 BLAKE2B 13bd4dbdadefb382133bf42a2b1e740e84ac11661595b082346c80ff05fc7423f5d75cc01ff8a651d921310ae66c2b39a862d0b9db5d7f18e11d393360627fcf SHA512 f2b1753e15907461cc395abffe033d7f7ab8eb15e296b874e2c9d00507458672347b32d7f2f05d3a8625fc3afbdbf0721543f84e062afce7181a726d967e4836
 DIST pax-utils-1.3.7.tar.xz 113740 BLAKE2B d801df9c426f318c871655f238fe27b53e656c2789ef8508019997c98bbc540987b611642d87e76ae9f76a95f6cce1acd0b10e3491a146d1e3b3f727a6f96bdc SHA512 f1b87a564573da838a02c4cc10e0d5f9754c3b004ecb172a6290b48a8179b30695ae556942457dfac3caf07b91dd56eb1d801475c35e9708e4d671aa507f9576
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/files/pax-utils-1.3.5-man-reorder-xmlto-arguments.patch b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/files/pax-utils-1.3.5-man-reorder-xmlto-arguments.patch
deleted file mode 100644
index 909c69e096..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/files/pax-utils-1.3.5-man-reorder-xmlto-arguments.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 2d981305b117b669c60bede076557c2d765cf198 Mon Sep 17 00:00:00 2001
-From: Mike Gilbert <floppym@gentoo.org>
-Date: Wed, 7 Sep 2022 20:13:00 -0400
-Subject: [PATCH] man: reorder xmlto arguments
-
-Bug: https://bugs.gentoo.org/869110
-Thanks-to: Fabian Groffen <grobian@gentoo.org>
-Signed-off-by: Mike Gilbert <floppym@gentoo.org>
----
- man/meson.build | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/man/meson.build b/man/meson.build
-index fc8d183..2e346ec 100644
---- a/man/meson.build
-+++ b/man/meson.build
-@@ -25,8 +25,8 @@ endforeach
- 
- custom_target('docbook_to_man',
-   command : [
--    xmlto, 'man', '-x', files('custom.xsl'), '--skip-validation', book,
--    '-o', meson.current_build_dir()
-+    xmlto, '-x', files('custom.xsl'), '--skip-validation',
-+    '-o', meson.current_build_dir(), 'man', book
-   ],
-   input : [
-     'pax-utils.docbook.in', 'custom.xsl', 'fragment/reftail',
--- 
-2.37.3
-
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.5.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.5.ebuild
deleted file mode 100644
index 61d80fca90..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.5.ebuild
+++ /dev/null
@@ -1,82 +0,0 @@
-# Copyright 2022-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Note: if bumping pax-utils because of syscall changes in glibc, please
-# revbump glibc and update the dependency in its ebuild for the affected
-# versions.
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit meson python-single-r1
-
-DESCRIPTION="ELF utils that can check files for security relevant properties"
-HOMEPAGE="https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pax-utils.git"
-	inherit git-r3
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
-		https://dev.gentoo.org/~vapier/dist/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="caps +man python seccomp test"
-
-_PYTHON_DEPS="
-	${PYTHON_DEPS}
-	$(python_gen_cond_dep '
-		dev-python/pyelftools[${PYTHON_USEDEP}]
-	')
-"
-
-RDEPEND="caps? ( >=sys-libs/libcap-2.24 )
-	python? ( ${_PYTHON_DEPS} )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	caps? ( virtual/pkgconfig )
-	man? ( app-text/xmlto )
-
-	python? ( ${_PYTHON_DEPS} )
-"
-REQUIRED_USE="
-	python? ( ${PYTHON_REQUIRED_USE} )
-	test? ( python )
-"
-RESTRICT="
-	!test? ( test )
-"
-
-PATCHES=(
-	"${FILESDIR}/pax-utils-1.3.5-man-reorder-xmlto-arguments.patch"
-)
-
-pkg_setup() {
-	if use test || use python; then
-		python-single-r1_pkg_setup
-	fi
-}
-
-src_configure() {
-	local emesonargs=(
-		"-Dlddtree_implementation=$(usex python python sh)"
-		$(meson_feature caps use_libcap)
-		$(meson_feature man build_manpages)
-		$(meson_use seccomp use_seccomp)
-		$(meson_use test tests)
-
-		# fuzzing is currently broken
-		-Duse_fuzzing=false
-	)
-	meson_src_configure
-}
-
-src_install() {
-	meson_src_install
-
-	use python && python_fix_shebang "${ED}"/usr/bin/lddtree
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.7.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.7.ebuild
index 533f1b106d..5b93dc47b7 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-1.3.7.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 # Note: if bumping pax-utils because of syscall changes in glibc, please
 # revbump glibc and update the dependency in its ebuild for the affected
 # versions.
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit meson python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
index 26cbf8dbb9..191841deb4 100644
--- a/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-misc/pax-utils/pax-utils-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2022-2023 Gentoo Authors
+# Copyright 2022-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,7 +6,7 @@ EAPI=8
 # Note: if bumping pax-utils because of syscall changes in glibc, please
 # revbump glibc and update the dependency in its ebuild for the affected
 # versions.
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit meson python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
index 54e0fe1217..56928f6c12 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/Manifest
@@ -2,3 +2,4 @@ DIST elt-patches-20240116.tar.xz 44400 BLAKE2B 0e664bf02180c2d0a5813f25a7661064f
 DIST elt-patches-20240213.tar.xz 44840 BLAKE2B 00c7c19dd0cd2aacc72e90d98f6b5bf09cfbcc79597b53d1c8095066354de10d3080404f7798463e87c1eef385b26dcbc590d3e6fe6f709ea04eaa82bbb17359 SHA512 d39ba86d4356491246b30b7c87d4fba341ba1539f696ef297c231fee5566a3fbf09891323d1f04fd97b9504c56dbb6f2ac99fa6051bf77a31aab55695c6da24b
 DIST elt-patches-20240315.tar.xz 45416 BLAKE2B 4a1e33bba89c43cb91d75641d35837aa482e2e119079321b4e1824ee5bd4b0f5c465c4709082daf987dedf423fef5adb9ba8d8d1b9d6dc814c663dda86ac0ee0 SHA512 7c2034713630f8ad40fed5be34f397749e8e1f63d5933656fe3618e97cf59240aaa64468fcb1a46bac111b96603e538b857513ca80d327c0be865868020457ea
 DIST elt-patches-20240324.tar.xz 45712 BLAKE2B 29a94ad3132ba10f4fc90cde685732b1cb679d693e1b1a1fbdb7fd99fbfc70aa7df9e6753ef6374cd606195829bd9d6a8b9b19126780ffa8f28542fb59d99fb0 SHA512 3878d5d303b372c873859510d6a0f3911657f4b66af8a91833657a13902474d011e30b4d245e5f82df791a9231f0253bb0ddef42bba66acb4241600265fb7925
+DIST elt-patches-20240415.tar.xz 46164 BLAKE2B 460a21bb20368c541406d8e0031d379a41d7a41f62a74a2a33c40647261f1dc542693ee9c3148c8f07ecb830c18d6d34500fbe2f05d03902b06967d6f762f131 SHA512 d876049860aad979bdf5e8b9842688cb31f3e1487d4966247ec4bcb6b696c25ef4b2a4abd4b330ecc39cff4f9ef18cf8b401660e59f35468b8dc1a26996a5c06
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240213.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240213.ebuild
index e4f296996a..1c8e8632cc 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240213.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240213.ebuild
@@ -19,7 +19,7 @@ else
 		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
 	"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240315.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240315.ebuild
index 29410c13f9..e4f296996a 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240315.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240315.ebuild
@@ -19,7 +19,7 @@ else
 		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
 	"
 
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240415.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240415.ebuild
new file mode 100644
index 0000000000..29410c13f9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-portage/elt-patches/elt-patches-20240415.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Collection of patches for libtool.eclass"
+HOMEPAGE="https://gitweb.gentoo.org/proj/elt-patches.git/"
+
+if [[ ${PV} == *9999* ]] ; then
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/elt-patches.git
+		https://github.com/gentoo/elt-patches
+	"
+	inherit git-r3
+else
+	SRC_URI="
+		https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz
+		https://dev.gentoo.org/~vapier/dist/${P}.tar.xz
+		https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~arm64-linux ~ppc64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+# The 'check' target currently wants network access to fetch libtool tarballs.
+RESTRICT="test"
+
+RDEPEND="sys-apps/gentoo-functions"
+BDEPEND="app-arch/xz-utils"
+
+src_compile() {
+	emake rootprefix="${EPREFIX}" libdirname="$(get_libdir)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" rootprefix="${EPREFIX}" install
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
index 8fe52687a1..bbb5571ae0 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/Manifest
@@ -1,3 +1,4 @@
 DIST portage-utils-0.95.tar.xz 1806140 BLAKE2B 5a468a7b4006073203ba634a5d70398e254ef5db7e9b71fbcf20bce68942f74acce1d42b5d315931f93e8698c8dd2f38f328fcc6fdaa86addba7dbcc21fce5fa SHA512 2d1f4b986a377249043259d8ada1a35a7dd55179f0ef5c2c18a4180c8f1f7064133ab2677426098e61b1355fa26cb0f8aa3c6ea06d46af4c4ba2df4eb53489a4
 DIST portage-utils-0.96.1.tar.xz 1807156 BLAKE2B 6bf334c0083e5e8b0d6206ff43d4df0e32a9576ddedbe055cb6ef903b5f11d0878512ace7f93ea37207181321ca160a8f721b3095b2bcbfcdbb353ba3f5d4873 SHA512 769e734e0738aa52408fd6c151706085148818a19b2ad1051684e2d54fe9f486f2e3a25e8fb408c83325cfb428644c6c0aa3b6d1bac0d2189680c70d9657bcbf
 DIST portage-utils-0.96.tar.xz 1806032 BLAKE2B 93ef9658a4b0bae7fb0527462bd9d0d19f396262818380d8ec2022c9fda596265c50adc262bdf296a4dd8c6b891b064316281d21444c8b903db20ca2463879e3 SHA512 cc32f53532c082544cabe505d8b90b947b6ab48742678aa98cbe9ba291625e8449ed0ecd90e01dc00b06c209b34001ad57a060918658e53d3babdc5c76ea7b02
+DIST portage-utils-0.97.tar.xz 1861616 BLAKE2B bdb4c6c1260a00304fb2c659629e0ddd4ca0378b1a060ea8b1f02ecb6060b4101c6e8984a6befd8b831a2b415fcdc5a51b6dac2fb203b36585f4a7d389ea0913 SHA512 f0f9ecf87df6e08b7f7dbdfe758c1a585a6836478d3adbcecdc2e33c9cfd78a5a10ae3090f0aa5ad0fa8a1eff88bf9e512d861b46bc77e5a536b46a3b36cd466
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild
new file mode 100644
index 0000000000..64f18b8070
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-0.97.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="Small and fast Portage helper tools written in C"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Portage-utils"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3 autotools
+	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/portage-utils.git"
+else
+	SRC_URI="https://dev.gentoo.org/~grobian/distfiles/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="openmp +qmanifest static"
+
+RDEPEND="
+	openmp? ( || (
+		sys-devel/gcc:*[openmp]
+		sys-libs/libomp
+	) )
+	qmanifest? (
+		!static? (
+			app-crypt/gpgme:=
+			app-crypt/libb2:=
+			sys-libs/zlib:=
+		)
+	)"
+DEPEND="${RDEPEND}
+	qmanifest? (
+		static? (
+			app-crypt/gpgme[static-libs]
+			app-crypt/libb2[static-libs]
+			sys-libs/zlib[static-libs]
+		)
+	)"
+BDEPEND="virtual/pkgconfig"
+
+# bug #898362, gnulib explicit checks
+QA_CONFIG_IMPL_DECL_SKIP=(
+	"MIN"
+	"unreachable"
+	"alignof"
+	"static_assert"
+)
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
+}
+
+src_prepare() {
+	default
+	[[ ${PV} == *9999 ]] && eautoreconf
+}
+
+src_configure() {
+	use static && append-ldflags -static
+
+	econf \
+		--disable-maintainer-mode \
+		--with-eprefix="${EPREFIX}" \
+		$(use_enable qmanifest) \
+		$(use_enable openmp)
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
index 31ad40ade1..64f18b8070 100644
--- a/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-portage/portage-utils/portage-utils-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -18,7 +18,7 @@ fi
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="openmp +qmanifest +qtegrity static"
+IUSE="openmp +qmanifest static"
 
 RDEPEND="
 	openmp? ( || (
@@ -29,33 +29,26 @@ RDEPEND="
 		!static? (
 			app-crypt/gpgme:=
 			app-crypt/libb2:=
-			dev-libs/openssl:=
 			sys-libs/zlib:=
 		)
-	)
-	qtegrity? (
-		!static? (
-			dev-libs/openssl:=
-		)
 	)"
 DEPEND="${RDEPEND}
 	qmanifest? (
 		static? (
 			app-crypt/gpgme[static-libs]
 			app-crypt/libb2[static-libs]
-			dev-libs/openssl[static-libs]
 			sys-libs/zlib[static-libs]
 		)
-	)
-	qtegrity? (
-		static? (
-			dev-libs/openssl[static-libs]
-		)
 	)"
 BDEPEND="virtual/pkgconfig"
 
-# bug #898362, gnulib check explicitly looks for MIN in some headers
-QA_CONFIG_IMPL_DECL_SKIP="MIN"
+# bug #898362, gnulib explicit checks
+QA_CONFIG_IMPL_DECL_SKIP=(
+	"MIN"
+	"unreachable"
+	"alignof"
+	"static_assert"
+)
 
 pkg_setup() {
 	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
@@ -73,6 +66,5 @@ src_configure() {
 		--disable-maintainer-mode \
 		--with-eprefix="${EPREFIX}" \
 		$(use_enable qmanifest) \
-		$(use_enable qtegrity) \
 		$(use_enable openmp)
 }
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r8.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r8.ebuild
new file mode 100644
index 0000000000..97f08a4101
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.1_p16-r8.ebuild
@@ -0,0 +1,353 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset
+GENTOO_PATCH_DEV="sam"
+GENTOO_PATCH_VER="${PV}"
+
+# Official patchlevel
+# See ftp://ftp.cwru.edu/pub/bash/bash-5.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+is_release() {
+	case ${PV} in
+		*_alpha*|*_beta*|*_rc*)
+			return 1
+			;;
+		*)
+			return 0
+			;;
+	esac
+}
+
+[[ ${PV} != *_p* ]] && PLEVEL=0
+
+# The version of readline this bash normally ships with.
+READLINE_VER="8.1"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html"
+
+if is_release ; then
+	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/bash/${MY_P}.tar.gz.sig )"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/bash"
+		mirror_url_base="ftp://ftp.cwru.edu/pub/bash"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			# Add in the mirror URL too.
+			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
+			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}} )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
+	fi
+else
+	SRC_URI="ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz.sig )"
+fi
+
+if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3"
+SLOT="0"
+[[ "${PV}" == *_rc* ]] || \
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="afs bashlogger examples mem-scramble +net nls plugins +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:0=
+	nls? ( virtual/libintl )
+	readline? ( >=sys-libs/readline-${READLINE_VER}:0= )
+"
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011)
+BDEPEND="sys-devel/bison
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )"
+
+S="${WORKDIR}/${MY_P}"
+
+PATCHES=(
+	# Patches from Chet sent to bashbug ml
+	"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}-patches/${PN}-5.0-syslog-history-extern.patch
+
+	"${FILESDIR}"/${PN}-5.1_p16-configure-clang16.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double ; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger ; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.sig}
+
+			local patch
+			for patch in "${MY_PATCHES[@]}" ; do
+				verify-sig_verify_detached ${patch}{,.sig}
+			done
+		fi
+
+		unpack ${MY_P}.tar.gz
+
+		if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+			unpack ${PN}-${GENTOO_PATCH_VER}-patches.tar.xz
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches
+	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases.
+	if is_release ; then
+		rm -rf lib/{readline,termcap}/* || die
+		touch lib/{readline,termcap}/Makefile.in || die # for config.status
+		sed -ri -e 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in || die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985
+	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
+	touch -r . doc/* || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset YACC
+
+	local myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	# Don't even think about building this statically without
+	# reading bug #7714 first.  If you still build it statically,
+	# don't come crying to us with bugs ;).
+	#use static && export LDFLAGS="${LDFLAGS} -static"
+	use nls || myconf+=( --disable-nls )
+
+	# Historically, we always used the builtin readline, but since
+	# our handling of SONAME upgrades has gotten much more stable
+	# in the PM (and the readline ebuild itself preserves the old
+	# libs during upgrades), linking against the system copy should
+	# be safe.
+	# Exact cached version here doesn't really matter as long as it
+	# is at least what's in the DEPEND up above.
+	export ac_cv_rl_version=${READLINE_VER%%_*}
+
+	if is_release ; then
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins ; then
+		append-ldflags -Wl,-rpath,"${EPREFIX}"/usr/$(get_libdir)/bash
+	else
+		# Disable the plugins logic by hand since bash doesn't
+		# provide a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i \
+			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
+			configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake
+
+	if use plugins ; then
+		emake -C examples/loadables all others
+	fi
+}
+
+src_install() {
+	local d f
+
+	default
+
+	dodir /bin
+	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	newins "$(prefixify_ro "${FILESDIR}"/bashrc-r1)" bashrc
+
+	insinto /etc/bash/bashrc.d
+	doins "${FILESDIR}"/bashrc.d/*.bash
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc} ; do
+		newins "${FILESDIR}"/dot-${f} .${f}
+	done
+
+	local sed_args=(
+		-e 's:#GNU#@::'
+		-e '/#@/d'
+	)
+
+	if ! use readline ; then
+		# bug #432338
+		sed_args+=(
+			-e '/^shopt -s histappend/s:^:#:'
+			-e 's:use_color=true:use_color=false:'
+		)
+	fi
+
+	sed -i \
+		"${sed_args[@]}" \
+		"${ED}"/etc/skel/.bashrc \
+		"${ED}"/etc/bash/bashrc || die
+
+	if use plugins ; then
+		exeinto /usr/$(get_libdir)/bash
+		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples ; then
+		for d in examples/{functions,misc,scripts,startup-files} ; do
+			exeinto /usr/share/doc/${PF}/${d}
+			docinto ${d}
+			for f in ${d}/* ; do
+				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
+					doexe ${f}
+				else
+					dodoc ${f}
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
+		mkdir -p "${EROOT}"/etc/bash
+		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it
+	if [[ ! -e ${EROOT}/bin/sh ]] ; then
+		ln -sf bash "${EROOT}"/bin/sh
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]] ; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r1" ; then
+		return
+	elif ver_test "$old_ver" -lt "5.2" && ver_test "$old_ver" -ge "5.1_p16-r8" ; then
+		return
+	fi
+
+	einfo "Files situated under /etc/bash/bashrc.d must now have a suffix of .sh or .bash."
+	einfo ""
+	einfo "Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the"
+	einfo "characteristics of the operating environment, this array may contain commands"
+	einfo "to set the window and pane title. Users that choose to customise this variable"
+	einfo "in ~/.bashrc are advised to append their commands, using the following syntax."
+	einfo ""
+	einfo "PROMPT_COMMAND+=('custom command goes here')"
+	einfo ""
+	einfo "Alternatively, users that wish to opt out of Gentoo's window title setting"
+	einfo "behaviour may now do so by either unsetting PROMPT_COMMAND or by re-defining it"
+	einfo "as desired. Previously, there was no formally supported method of opting out."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p26-r1.ebuild b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p26-r1.ebuild
new file mode 100644
index 0000000000..0db88e2a73
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p26-r1.ebuild
@@ -0,0 +1,400 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+# Official patchlevel
+# See ftp://ftp.cwru.edu/pub/bash/bash-5.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+is_release() {
+	case ${PV} in
+		9999|*_alpha*|*_beta*|*_rc*)
+			return 1
+			;;
+		*)
+			return 0
+			;;
+	esac
+}
+
+[[ ${PV} != *_p* ]] && PLEVEL=0
+
+# The version of readline this bash normally ships with.
+# Note: right now, we don't use the system copy of readline for bash for non-releases.
+READLINE_VER="8.2_p1"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif is_release ; then
+	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/bash/${MY_P}.tar.gz.sig )"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/bash"
+		mirror_url_base="ftp://ftp.cwru.edu/pub/bash"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			# Add in the mirror URL too.
+			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
+			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}} )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
+	fi
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz.sig )"
+fi
+
+if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if is_release ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if is_release ; then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011)
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+S="${WORKDIR}/${MY_P}"
+
+# EAPI 8 tries to append it but it doesn't exist here
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches from Chet sent to bash-bug ml
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.2_p15-random-ub.patch
+	"${FILESDIR}"/${PN}-5.2_p15-configure-clang16.patch
+	"${FILESDIR}"/${PN}-5.2_p21-wpointer-to-int.patch
+	"${FILESDIR}"/${PN}-5.2_p21-configure-strtold.patch
+	"${FILESDIR}"/${PN}-5.2_p26-memory-leaks.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double ; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger ; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.sig}
+
+			local patch
+			for patch in "${MY_PATCHES[@]}" ; do
+				verify-sig_verify_detached ${patch}{,.sig}
+			done
+		fi
+
+		unpack ${MY_P}.tar.gz
+
+		if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+			unpack ${PN}-${GENTOO_PATCH_VER}-patches.tar.xz
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches
+	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases.
+	if is_release ; then
+		rm -rf lib/{readline,termcap}/* || die
+		touch lib/{readline,termcap}/Makefile.in || die # for config.status
+		sed -ri -e 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in || die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985
+	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
+	touch -r . doc/* || die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset YACC
+
+	local myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	# Don't even think about building this statically without
+	# reading bug #7714 first.  If you still build it statically,
+	# don't come crying to us with bugs ;).
+	#use static && export LDFLAGS="${LDFLAGS} -static"
+	use nls || myconf+=( --disable-nls )
+
+	if is_release ; then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins ; then
+		append-ldflags -Wl,-rpath,"${EPREFIX}"/usr/$(get_libdir)/bash
+	else
+		# Disable the plugins logic by hand since bash doesn't
+		# provide a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i \
+			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
+			configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/pgo -fprofile-generate=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/pgo -fprofile-dir=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if use pgo ; then
+		# Used in test suite.
+		unset A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	dodir /bin
+	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	newins "$(prefixify_ro "${FILESDIR}"/bashrc-r1)" bashrc
+
+	insinto /etc/bash/bashrc.d
+	doins "${FILESDIR}"/bashrc.d/*.bash
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc} ; do
+		newins "${FILESDIR}"/dot-${f} .${f}
+	done
+
+	local sed_args=(
+		-e 's:#GNU#@::'
+		-e '/#@/d'
+	)
+
+	if ! use readline ; then
+		# bug #432338
+		sed_args+=(
+			-e '/^shopt -s histappend/s:^:#:'
+			-e 's:use_color=true:use_color=false:'
+		)
+	fi
+
+	sed -i \
+		"${sed_args[@]}" \
+		"${ED}"/etc/skel/.bashrc \
+		"${ED}"/etc/bash/bashrc || die
+
+	if use plugins ; then
+		exeinto /usr/$(get_libdir)/bash
+		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples ; then
+		for d in examples/{functions,misc,scripts,startup-files} ; do
+			exeinto /usr/share/doc/${PF}/${d}
+			docinto ${d}
+			for f in ${d}/* ; do
+				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
+					doexe ${f}
+				else
+					dodoc ${f}
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
+		mkdir -p "${EROOT}"/etc/bash
+		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+	fi
+}
+
+pkg_postinst() {
+	local old_ver
+
+	# If /bin/sh does not exist, provide it
+	if [[ ! -e ${EROOT}/bin/sh ]] ; then
+		ln -sf bash "${EROOT}"/bin/sh
+	fi
+
+	read -r old_ver <<<"${REPLACING_VERSIONS}"
+	if [[ ! $old_ver ]] ; then
+		:
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r1" ; then
+		return
+	elif ver_test "$old_ver" -lt "5.2" && ver_test "$old_ver" -ge "5.1_p16-r8" ; then
+		return
+	fi
+
+	einfo "Files situated under /etc/bash/bashrc.d must now have a suffix of .sh or .bash."
+	einfo ""
+	einfo "Gentoo now defaults to defining PROMPT_COMMAND as an array. Depending on the"
+	einfo "characteristics of the operating environment, this array may contain commands"
+	einfo "to set the window and pane title. Users that choose to customise this variable"
+	einfo "in ~/.bashrc are advised to append their commands, using the following syntax."
+	einfo ""
+	einfo "PROMPT_COMMAND+=('custom command goes here')"
+	einfo ""
+	einfo "Alternatively, users that wish to opt out of Gentoo's window title setting"
+	einfo "behaviour may now do so by either unsetting PROMPT_COMMAND or by re-defining it"
+	einfo "as desired. Previously, there was no formally supported method of opting out."
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc-r1 b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc-r1
new file mode 100644
index 0000000000..61202b61f1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc-r1
@@ -0,0 +1,21 @@
+# /etc/bash/bashrc
+
+# Proceed no further in the case of a non-interactive shell.
+if [[ $- != *i* ]]; then
+	return
+fi
+
+# Disable completion when the input buffer is empty. Requires readline support.
+shopt -s no_empty_cmd_completion 2>/dev/null
+
+# Append to HISTFILE rather than overwrite upon exiting, per bug #139609.
+shopt -s histappend
+
+# Initialise PROMPT_COMMAND as an array, which is permitted as of bash 5.1.
+PROMPT_COMMAND=()
+
+for _ in /etc/bash/bashrc.d/*; do
+	if [[ $_ == *.@(bash|sh) && -r $_ ]]; then
+		source "$_"
+	fi
+done
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color.bash b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color.bash
new file mode 100644
index 0000000000..5a6df5690c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-color.bash
@@ -0,0 +1,67 @@
+# /etc/bash/bashrc.d/10-gentoo-color.bash
+
+if [[ ${NO_COLOR} ]]; then
+	# Respect the user's wish not to use color. See https://no-color.org/.
+	gentoo_color=0
+elif [[ ${COLORTERM@a} == *x* && ${COLORTERM} == @(24bit|truecolor) ]]; then
+	# The COLORTERM environment variable can reasonably be trusted here.
+	# See https://github.com/termstandard/colors for further information.
+	gentoo_color=1
+elif unset -v COLORTERM; ! gentoo_color=$(tput colors 2>/dev/null); then
+	# Either ncurses is not installed or no terminfo database could be
+	# found. Fall back to a whitelist which covers the majority of terminal
+	# emulators and virtual console implementations known to support color
+	# and which remain (somewhat) popular. This will rarely happen, so the
+	# list need not be exhaustive.
+	case ${TERM} in
+		*color*    |\
+		*direct*   |\
+		[Ekx]term* |\
+		alacritty  |\
+		aterm      |\
+		dtterm     |\
+		foot*      |\
+		jfbterm    |\
+		linux      |\
+		mlterm     |\
+		rxvt*      |\
+		screen*    |\
+		tmux*      |\
+		wsvt25*    ) gentoo_color=1
+	esac
+elif (( gentoo_color == 16777216 )); then
+	# Truecolor support is available. Advertise it.
+	export COLORTERM=truecolor
+fi
+
+if (( gentoo_color <= 0 )); then
+	# Define a prompt without color.
+	PS1='\u@\h \w \$ '
+elif (( EUID == 0 )); then
+	# If root, omit the username and print the hostname in red.
+	PS1='\[\e[01;31m\]\h\[\e[01;34m\] \w \$\[\e[00m\] '
+else
+	# Otherwise, print the username and hostname in green.
+	PS1='\[\e[01;32m\]\u@\h\[\e[01;34m\] \w \$\[\e[00m\] '
+fi
+
+if (( gentoo_color > 0 )); then
+	# Colorize the output of grep and several coreutils utilities.
+	for _ in diff dir egrep fgrep grep ls vdir; do
+		alias "$_=$_ --color=auto"
+	done
+
+	# Enable colors for ls(1) and some other utilities that respect the
+	# LS_COLORS variable. Prefer ~/.dir_colors, per bug #64489.
+	if hash dircolors 2>/dev/null; then
+		if [[ -f ~/.dir_colors ]]; then
+			eval "$(dircolors -b -- ~/.dir_colors)"
+		elif [[ -f /etc/DIR_COLORS ]]; then
+			eval "$(dircolors -b /etc/DIR_COLORS)"
+		else
+			eval "$(dircolors -b)"
+		fi
+	fi
+fi
+
+unset -v gentoo_color
diff --git a/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title.bash b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title.bash
new file mode 100644
index 0000000000..56afcf2130
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-shells/bash/files/bashrc.d/10-gentoo-title.bash
@@ -0,0 +1,55 @@
+# /etc/bash/bashrc.d/10-gentoo-title.bash
+
+# Set window title with the Title Definition String sequence. For screen, the
+# sequence defines the window title (%t) and for tmux, the pane_title (#T).
+# For tmux to be affected requires that its allow-rename option be enabled.
+# https://www.gnu.org/software/screen/manual/html_node/Control-Sequences.html
+case ${TERM} in
+	screen*|tmux*)
+		genfun_set_pane_title() {
+			printf '\033k%s\033\\' "${HOSTNAME%%.*}"
+		}
+		PROMPT_COMMAND+=('genfun_set_pane_title')
+		;;
+	*)
+		# If the TTY is that of sshd(8) then proceed no further. Alas,
+		# there exist many operating environments in which the window
+		# title would otherwise not be restored upon ssh(1) exiting.
+		if [[ ${SSH_TTY} && ${SSH_TTY} == "$(tty)" ]]; then
+			return
+		fi
+esac
+
+# Assigns the basename of the current working directory, having sanitised it
+# with @Q parameter expansion. Useful for paths containing newlines and such.
+# As a special case, names consisting entirely of graphemes shall not undergo
+# the parameter expansion, for reasons of cleanliness.
+genfun_sanitise_cwd() {
+	_cwd=${PWD##*/}
+	if [[ ! ${_cwd} ]]; then
+		_cwd=${PWD}
+	elif [[ ${_cwd} == *[![:graph:]]* ]]; then
+		_cwd=${_cwd@Q}
+	fi
+}
+
+# Set window title with the Set Text Parameters sequence. For screen, the
+# sequence defines the hardstatus (%h) and for tmux, the window_name (#W).
+# For graphical terminal emulators, it is normal for the title bar be affected.
+# The only terminals permitted here are those for which there is empirical
+# evidence that the sequence is supported and that the UTF-8 character encoding
+# is handled correctly. Quite rightly, this precludes many vintage terminals.
+# https://invisible-island.net/xterm/ctlseqs/ctlseqs.html#h3-Operating-System-Commands
+case ${TERM} in
+	alacritty     |\
+	foot*         |\
+	rxvt-unicode* |\
+	screen*       |\
+	tmux*         |\
+	xterm*        )
+		genfun_set_win_title() {
+			genfun_sanitise_cwd
+			printf '\033]2;%s@%s - %s\007' "${USER}" "${HOSTNAME%%.*}" "${_cwd}"
+		}
+		PROMPT_COMMAND+=('genfun_set_win_title')
+esac
diff --git a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/Manifest b/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/Manifest
index 2cd9ebd5ee..e9c74d9405 100644
--- a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/Manifest
@@ -1,2 +1 @@
-DIST gentoo-syntax-13.tar.bz2 20995 BLAKE2B 90196be7b1f0bbbe8398f327cebe2bbbcffbf8db2e27debc321478911d2413de51ef29d3a94e936e1d92eb4d246237d66d4fa8742fd165e4043ceb2dd80beb9a SHA512 c695dd8c80b551307381a4fb0656adc07321cf60f88e1888ce3a2080343d458a35bb4bda785e233fa4907534b35114c83b5d4b5e3f3bd02d0d6c2dd7ab7deda1
 DIST gentoo-syntax-14.tar.bz2 20988 BLAKE2B 2f11628bec985ef486ad6f04b694df7a2b1e5ef34f5ddb364c7d9dea4a507d9bae4d8de6b00b33358cf651b4fc6816164f22f7760275a1fd0668b89927859cfb SHA512 63914ffb1911d83fa8991a901f9a23ccfc30f0170a6a730cb02919f4adf0ad34c70f4457e006b1c08a004448c6b9e85d97634a8ed8fdf0b4f98ef9fd804eef00
diff --git a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-13.ebuild b/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-13.ebuild
deleted file mode 100644
index f6ee8664a8..0000000000
--- a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-13.ebuild
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit vim-plugin
-
-DESCRIPTION="vim plugin: Gentoo and Portage syntax highlighting"
-HOMEPAGE="https://github.com/gentoo/gentoo-syntax"
-SRC_URI="https://gitweb.gentoo.org/proj/gentoo-syntax.git/snapshot/${P}.tar.bz2"
-
-LICENSE="vim"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="ignore-glep31"
-
-VIM_PLUGIN_HELPFILES="gentoo-syntax"
-VIM_PLUGIN_MESSAGES="filetype"
-
-src_prepare() {
-	default
-	if use ignore-glep31 ; then
-		for f in ftplugin/*.vim ; do
-			ebegin "Removing UTF-8 rules from ${f} ..."
-			sed -i -e 's~\(setlocal fileencoding=utf-8\)~" \1~' ${f} \
-				|| die "waah! bad sed voodoo. need more goats."
-			eend $?
-		done
-	fi
-}
-
-pkg_postinst() {
-	vim-plugin_pkg_postinst
-
-	if [[ -z ${REPLACING_VERSIONS} ]] ; then
-		if use ignore-glep31 1>/dev/null ; then
-			ewarn "You have chosen to disable the rules which ensure GLEP 31"
-			ewarn "compliance. When editing ebuilds, please make sure you get"
-			ewarn "the character set correct."
-		fi
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-14.ebuild b/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-14.ebuild
index fae057eb2f..f6ee8664a8 100644
--- a/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-vim/gentoo-syntax/gentoo-syntax-14.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://gitweb.gentoo.org/proj/gentoo-syntax.git/snapshot/${P}.tar.bz2"
 
 LICENSE="vim"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="ignore-glep31"
 
 VIM_PLUGIN_HELPFILES="gentoo-syntax"
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
index 973f9df8f0..4998a28ef7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/Manifest
@@ -11,3 +11,9 @@ DIST cmake-3.28.4.tar.gz 11072355 BLAKE2B 26b9937ddd6015f1ab86e9c00bcc5f4f23b643
 DIST cmake-3.29.0-SHA-256.txt 1646 BLAKE2B c8bca18c955580adca88de1c0a72ecea84ec0f1c8023e9e84010b1f3aceae578e866c64ff5896b325ee625fe754bfe88a86ce6d6beaa9735bc45ddef02934ca2 SHA512 9a33a74a799e0ae4464a3b084b94617734b36bed2ed70260a0700bd2e8f846b6cddb279d8fa91488b08d29b14ad34d45dcea01afabc720f57a9c90e7700aa205
 DIST cmake-3.29.0-SHA-256.txt.asc 833 BLAKE2B eb78a1ebb3bd45a0308bffe8496feff89fa6aadab281488a91b9d9f6065261a4744d361ade701c616527e62e220aecbf164b5aa309c1288deca59fe1bbcffe33 SHA512 50c77aed7e4f834733a1abaf2367f87a8a1809a16d01d9dabb035c5afba282240ba6d0bd77fd93013266f5dc3e860f9025cfa54db6c7b6835f8471caef058519
 DIST cmake-3.29.0.tar.gz 11244341 BLAKE2B 76244cfc6222ce23dbddc9bb3aa51d98d00826d6fa19d86b836f63977c56f0cae11cd592efa1c727e8872fea1e6365a3b67a37e80e588fbf4189f7ec07c2f6e1 SHA512 abcca7a4db221d98864b77220445f0b70f87149626d3162ed49636862b87514b2640318438c0c711bfaafa1aba4d049b55f98e6ac28c44545543986c35fbd062
+DIST cmake-3.29.1-SHA-256.txt 1646 BLAKE2B 09a540f98e5575d8a85d120a83fc9d7f1c1cd6792539bad3d1d464bf3da7539afcf0e19a7173566e59b176cc691dedf7589f6a95844c857786ad4a520ebf983f SHA512 78ac190968e5253a5cdef8acbddebf0f5750bf47aef92932b65fee4c75fd3c66a1fe3a366cd8105a9908b2d3324da4275b2b4f4c9e2c269818a6613b9dd21214
+DIST cmake-3.29.1-SHA-256.txt.asc 833 BLAKE2B 840db11dd025e9e980e8a16ac635a4e6a047c9680381c9496e12348c77e10c97eb5f8da1680a67d9920bab0b6161facdad0024f3e696f05fa2e03035cf0152b2 SHA512 ac3d031989a0d1cc97e56d4b9efa5dddba4f5b46489ca93df7be7e618b8a0aca08c1f4140b0194afe94291a0377615cb51b16fb3bbc1cc5954250bda3216fde1
+DIST cmake-3.29.1.tar.gz 11246071 BLAKE2B ec20bccb354a7097d8f2b1bd3486c162a93085671e10e4839c043b2452f597e4b8789dae887c88677d945ea7dcc71b8b0f30116103aac875270f52468bfc9bc0 SHA512 3665ddb356bf973f75c9f2601f7210f7ff58c77c39926a43af8640979777a796d441df43fda5d2632548f7d15e4553829680c76f3d9376f9e763fe7bba16f3d7
+DIST cmake-3.29.2-SHA-256.txt 1646 BLAKE2B 49d125738318ac2f5f5a8f885bfe5ce27341f84102464456e857aebb4d95dca572ac4a7502972624d503b208063e734a6ba14618110fa5e2f25d5a518a418d81 SHA512 e6483779cb5f6966bbfa36bc483a78ea89a0a149d6bbf1987b5ba25e4f745b1dea17fde7217ce03636a525888283eb35b6f211a1c6f74512ee096599e7180051
+DIST cmake-3.29.2-SHA-256.txt.asc 833 BLAKE2B 946b697e3eec984d1eaab834a275a70efb3810a81038a31903f453d559f1cb4da0d37d92cae90f84ef60edd3d7e522d2d0bf94773999cb8c8aa898a3497f5a51 SHA512 dccc1b4342f5db250f2ffe351a69924d29fee85ee123e53e09b3333729715fc9735382e21765193859dd3784836983dcfdefabd9442235e509ccc20270476b9b
+DIST cmake-3.29.2.tar.gz 11245621 BLAKE2B 510ddc32d66bc47ac7b3079b8e7bfbd4a27a6e4a112ec564bcbd0b54dac2935b200ff49ec1b60ab1355b9a0450944ac154a9b289e19650e2aed6cc0b059e657e SHA512 0dad9e0e3ad9c1178d337cd3a14e9ce145e011175e9d9fce4961d12b8fe37091f9fdf05f4303cdd846408955b11bac3cfe5064f852833b99e31f5a7b82a9d1eb
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.1.ebuild
new file mode 100644
index 0000000000..45477a10bf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.1.ebuild
@@ -0,0 +1,278 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
+CMAKE_DOCS_VERSION=3.27.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs virtualx xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
+	)
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	virtx cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.2.ebuild
new file mode 100644
index 0000000000..45477a10bf
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/cmake/cmake-3.29.2.ebuild
@@ -0,0 +1,278 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+: ${CMAKE_DOCS_PREBUILT:=1}
+
+CMAKE_DOCS_PREBUILT_DEV=sam
+#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
+CMAKE_DOCS_VERSION=3.27.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# See bug #784815
+CMAKE_DOCS_USEFLAG="+doc"
+
+# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
+# ... but seems fine as of 3.22.3?
+# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
+CMAKE_MAKEFILE_GENERATOR="emake"
+CMAKE_REMOVE_MODULES_LIST=( none )
+inherit bash-completion-r1 cmake flag-o-matic multiprocessing \
+	toolchain-funcs virtualx xdg-utils
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="Cross platform Make"
+HOMEPAGE="https://cmake.org/"
+if [[ ${PV} == 9999 ]] ; then
+	CMAKE_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
+	inherit git-r3
+else
+	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
+
+	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	if [[ ${PV} != *_rc* ]] ; then
+		VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/bradking.asc
+		inherit verify-sig
+
+		SRC_URI+=" verify-sig? (
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
+			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
+		)"
+
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+		BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-bradking-20230817 )"
+	fi
+fi
+
+[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
+
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="${CMAKE_DOCS_USEFLAG} dap gui ncurses qt6 test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-arch/libarchive-3.3.3:=
+	app-crypt/rhash:0=
+	>=dev-libs/expat-2.0.1
+	>=dev-libs/jsoncpp-1.9.2-r2:0=
+	>=dev-libs/libuv-1.10.0:=
+	>=net-misc/curl-7.21.5[ssl]
+	sys-libs/zlib
+	virtual/pkgconfig
+	dap? ( dev-cpp/cppdap )
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
+	)
+	ncurses? ( sys-libs/ncurses:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND+="
+	doc? (
+		dev-python/requests
+		dev-python/sphinx
+	)
+	test? ( app-arch/libarchive[zstd] )
+"
+
+SITEFILE="50${PN}-gentoo.el"
+
+PATCHES=(
+	# Prefix
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
+	# Misc
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
+	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
+
+	# Upstream fixes (can usually be removed with a version bump)
+)
+
+cmake_src_bootstrap() {
+	# disable running of cmake in bootstrap command
+	sed -i \
+		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
+		bootstrap || die "sed failed"
+
+	# execinfo.h on Solaris isn't quite what it is on Darwin
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/execinfo\.h/blablabla.h/' \
+			Source/kwsys/CMakeLists.txt || die
+	fi
+
+	# bootstrap script isn't exactly /bin/sh compatible
+	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
+		--prefix="${T}/cmakestrap/" \
+		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
+		|| die "Bootstrap failed"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
+		default
+	else
+		cd "${DISTDIR}" || die
+
+		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
+		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
+		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
+
+		cd "${WORKDIR}" || die
+
+		default
+	fi
+}
+
+src_prepare() {
+	cmake_src_prepare
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# Disable Xcode hooks, bug #652134
+		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
+			Source/CMakeLists.txt || die
+		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
+			-e '/cmGlobalXCodeGenerator.h/d' \
+			Source/cmake.cxx || die
+
+		# Disable isysroot usage with GCC, we've properly instructed
+		# where things are via GCC configuration and ldwrapper
+		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
+			Modules/Platform/Apple-GNU-*.cmake || die
+		# Disable isysroot usage with clang as well
+		sed -i -e '/_SYSROOT_FLAG/d' \
+			Modules/Platform/Apple-Clang.cmake || die
+		# Don't set a POSIX standard, system headers don't like that, #757426
+		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmLoadCommandCommand.cxx \
+			Source/cmStandardLexer.h \
+			Source/cmSystemTools.cxx \
+			Source/cmTimestamp.cxx
+		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
+			Source/cmStandardLexer.h
+	fi
+
+	# Add gcc libs to the default link paths
+	sed -i \
+		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
+		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
+		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
+		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
+
+	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
+		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
+		cmake_src_bootstrap
+	fi
+}
+
+src_configure() {
+	# Fix linking on Solaris
+	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
+
+	# ODR warnings, bug #858335
+	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
+	filter-lto
+
+	local mycmakeargs=(
+		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
+		-DCMake_ENABLE_DEBUGGER=$(usex dap)
+		-DCMAKE_DOC_DIR=/share/doc/${PF}
+		-DCMAKE_MAN_DIR=/share/man
+		-DCMAKE_DATA_DIR=/share/${PN}
+		-DSPHINX_MAN=$(usex doc)
+		-DSPHINX_HTML=$(usex doc)
+		-DBUILD_CursesDialog="$(usex ncurses)"
+		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
+	)
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
+
+	cmake_src_configure
+}
+
+src_test() {
+	# Fix OutDir and SelectLibraryConfigurations tests
+	# these are altered thanks to our eclass
+	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
+		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
+		|| die
+
+	pushd "${BUILD_DIR}" > /dev/null || die
+
+	# Excluded tests:
+	#    BootstrapTest: we actualy bootstrap it every time so why test it.
+	#    BundleUtilities: bundle creation broken
+	#    CMakeOnly.AllFindModules: pthread issues
+	#    CTest.updatecvs: which fails to commit as root
+	#    Fortran: requires fortran
+	#    RunCMake.CompilerLauncher: also requires fortran
+	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
+	#        debugedit binary is not in the expected location
+	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
+	#        it can't find a deb package that owns libc
+	#    TestUpload, which requires network access
+	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
+	local myctestargs=(
+		--output-on-failure
+		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
+	)
+
+	virtx cmake_src_test
+}
+
+src_install() {
+	cmake_src_install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
+	fi
+
+	insinto /usr/share/vim/vimfiles/syntax
+	doins Auxiliary/vim/syntax/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/indent
+	doins Auxiliary/vim/indent/cmake.vim
+
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${FILESDIR}/${PN}.vim"
+
+	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
+}
+
+pkg_postinst() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
+
+pkg_postrm() {
+	if use gui; then
+		xdg_icon_cache_update
+		xdg_desktop_database_update
+		xdg_mimeinfo_database_update
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r1.ebuild
index 3a67d090b6..4f363169f0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-4.4.1-r1.ebuild
@@ -50,7 +50,7 @@ src_unpack() {
 		cd "${S}" || die
 		./bootstrap || die
 	else
-		default
+		verify-sig_src_unpack
 	fi
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
index 568476904f..4df10fe003 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/make/make-9999.ebuild
@@ -50,7 +50,7 @@ src_unpack() {
 		cd "${S}" || die
 		./bootstrap || die
 	else
-		default
+		verify-sig_src_unpack
 	fi
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.3.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.3.2.ebuild
index 678bb44fc0..9c8c4cef6b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.3.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/meson/meson-1.3.2.ebuild
@@ -24,7 +24,7 @@ else
 	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/jpakkane.gpg
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/Manifest b/sdk_container/src/third_party/portage-stable/dev-build/ninja/Manifest
index 4ccdb98ca1..5a84814e81 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/Manifest
@@ -1 +1,2 @@
 DIST ninja-1.11.1.tar.gz 229479 BLAKE2B c96cf7c319b7abd65f644465688d256f8b3a576c4616d0c63852e25dd0dc5f63c66708d429d8dddb6228502eb147211a86a5dd369b80ec2228902b370d2343e5 SHA512 1bca38877c70ee6613f347ffccef5adc02ba0a3947c62ae004ea97f918442b5a3de92378e4f820ae2a7676bc7609d25fbc7d41f6cfb3a61e5e4b26ec3639e403
+DIST ninja-1.12.0.tar.gz 240291 BLAKE2B e7d721ab62164574b076f7cbf6d40fd2ee950534d124a58f5fe9e09bdae5895c8dc9dd7636a9f2f2b79774d6d9ba5f831e2c8b370826029af060fdc80fdc207f SHA512 167cd838ad47815183b79302a6e19227d956e634ae9d4211f0895ea9f4d893932e1154a765a9d5a1a3167b1a48b398f255fb4f46eb1395a6da11070bda628875
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.0.ebuild
new file mode 100644
index 0000000000..3af9c43f1b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-1.12.0.ebuild
@@ -0,0 +1,106 @@
+# Copyright 2012-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+
+inherit bash-completion-r1 edo python-any-r1 toolchain-funcs
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/ninja-build/ninja.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/ninja-build/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="A small build system similar to make"
+HOMEPAGE="https://ninja-build.org/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="doc"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	dev-util/re2c
+	doc? (
+		app-text/asciidoc
+		app-text/doxygen
+		dev-libs/libxslt
+		media-gfx/graphviz
+	)
+"
+PDEPEND="
+	app-alternatives/ninja
+"
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	local PATCHES=(
+		"${FILESDIR}"/ninja-cflags.patch
+	)
+	default
+}
+
+bootstrap() {
+	if tc-is-cross-compiler; then
+		local -x AR=$(tc-getBUILD_AR)
+		local -x CXX=$(tc-getBUILD_CXX)
+		local -x CFLAGS=
+		local -x CXXFLAGS="${BUILD_CXXFLAGS} -D_FILE_OFFSET_BITS=64"
+		local -x LDFLAGS=${BUILD_LDFLAGS}
+	fi
+	edo ${EPYTHON} configure.py --with-python=python --bootstrap --verbose
+}
+
+src_compile() {
+	python_setup
+
+	tc-export AR CXX
+	unset CFLAGS
+	export CXXFLAGS="${CXXFLAGS} -D_FILE_OFFSET_BITS=64"
+
+	bootstrap
+
+	if use doc; then
+		edo ./ninja -v doxygen manual
+	fi
+
+	if tc-is-cross-compiler; then
+		edo ${EPYTHON} configure.py --with-python=python
+		edo ./ninja -v ninja
+	fi
+}
+
+src_install() {
+	newbin ninja{,-reference}
+
+	if use doc; then
+		docinto html
+		dodoc -r doc/doxygen/html/.
+		dodoc doc/manual.html
+	fi
+
+	newbashcomp misc/bash-completion ${PN}
+
+	insinto /usr/share/vim/vimfiles/syntax/
+	doins misc/ninja.vim
+
+	echo 'au BufNewFile,BufRead *.ninja set ft=ninja' > "${T}"/ninja.vim || die
+	insinto /usr/share/vim/vimfiles/ftdetect
+	doins "${T}"/ninja.vim
+
+	insinto /usr/share/zsh/site-functions
+	newins misc/zsh-completion _ninja
+}
+
+pkg_postinst() {
+	if ! [[ -e "${EROOT}/usr/bin/ninja" ]]; then
+		ln -s ninja-reference "${EROOT}/usr/bin/ninja" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
index 9442eeaecf..3af9c43f1b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-build/ninja/ninja-9999.ebuild
@@ -5,7 +5,7 @@ EAPI=8
 
 PYTHON_COMPAT=( python3_{10..12} )
 
-inherit edo bash-completion-r1 python-any-r1 toolchain-funcs
+inherit bash-completion-r1 edo python-any-r1 toolchain-funcs
 
 if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/ninja-build/ninja.git"
@@ -20,8 +20,7 @@ HOMEPAGE="https://ninja-build.org/"
 
 LICENSE="Apache-2.0"
 SLOT="0"
-IUSE="doc test"
-RESTRICT="!test? ( test )"
+IUSE="doc"
 
 BDEPEND="
 	${PYTHON_DEPS}
@@ -32,17 +31,23 @@ BDEPEND="
 		dev-libs/libxslt
 		media-gfx/graphviz
 	)
-	test? ( dev-cpp/gtest )
 "
 PDEPEND="
 	app-alternatives/ninja
 "
 
-PATCHES=(
-	"${FILESDIR}"/ninja-cflags.patch
-)
+pkg_setup() {
+	:
+}
 
-run_for_build() {
+src_prepare() {
+	local PATCHES=(
+		"${FILESDIR}"/ninja-cflags.patch
+	)
+	default
+}
+
+bootstrap() {
 	if tc-is-cross-compiler; then
 		local -x AR=$(tc-getBUILD_AR)
 		local -x CXX=$(tc-getBUILD_CXX)
@@ -50,44 +55,30 @@ run_for_build() {
 		local -x CXXFLAGS="${BUILD_CXXFLAGS} -D_FILE_OFFSET_BITS=64"
 		local -x LDFLAGS=${BUILD_LDFLAGS}
 	fi
-	echo "$@" >&2
-	"$@"
+	edo ${EPYTHON} configure.py --with-python=python --bootstrap --verbose
 }
 
 src_compile() {
+	python_setup
+
 	tc-export AR CXX
-
-	# configure.py appends CFLAGS to CXXFLAGS
 	unset CFLAGS
+	export CXXFLAGS="${CXXFLAGS} -D_FILE_OFFSET_BITS=64"
 
-	local -x CXXFLAGS="${CXXFLAGS} -D_FILE_OFFSET_BITS=64"
-
-	run_for_build ${EPYTHON} configure.py --bootstrap --verbose || die
-
-	if tc-is-cross-compiler; then
-		mv ninja ninja-build || die
-		${EPYTHON} configure.py || die
-		./ninja-build -v ninja || die
-	else
-		ln ninja ninja-build || die
-	fi
+	bootstrap
 
 	if use doc; then
-		./ninja-build -v doxygen manual || die
+		edo ./ninja -v doxygen manual
 	fi
-}
 
-src_test() {
-	if ! tc-is-cross-compiler; then
-		# Bug 485772
-		ulimit -n 2048
-		edo ./ninja -v ninja_test
-		edo ./ninja_test
+	if tc-is-cross-compiler; then
+		edo ${EPYTHON} configure.py --with-python=python
+		edo ./ninja -v ninja
 	fi
 }
 
 src_install() {
-	dodoc README.md CONTRIBUTING.md
+	newbin ninja{,-reference}
 
 	if use doc; then
 		docinto html
@@ -95,8 +86,6 @@ src_install() {
 		dodoc doc/manual.html
 	fi
 
-	newbin ninja ninja-reference
-
 	newbashcomp misc/bash-completion ${PN}
 
 	insinto /usr/share/vim/vimfiles/syntax/
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index f852d8fd38..35aa98d400 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,6 +1,8 @@
 DIST sqlite-doc-3440200.zip 10704552 BLAKE2B 3d50ac157bd2793c9167328994334a417835e5381e432fd8028e064869b8eab2ab1d213815d2232850d695bc71626e9d89518b201888a43673274cba2a1b345d SHA512 a7c92af0d3a61a2450511cfb507785c7ab64c21c6dbcf5a8bdef509d25a6b3ca35ce93a25ca827497c27abca77d11b794fbbc783e4d8e131981bf1d4b29f83e8
 DIST sqlite-doc-3450100.zip 10746925 BLAKE2B 6e45a33b41b8fd1e0b5ef3a44febf5ed53a19883441f0eaef6d811190a26cd072a49d254a35d5b90f92255082f91d3f7956a6e574b638b34f156f7297588b57e SHA512 dc036737973a29ea2b6cb4fe7ab4468f449e21eed34a773600570ed2e57ed4d195286c75afec91ab76ac55e25a0cc82e73c3b3119a9c8e7b5918bae8a1a3c8c0
 DIST sqlite-doc-3450200.zip 10755940 BLAKE2B 5d70100ae972024a44a0dbe3214e0465b819710dc23e7b68e6995d2a8f66286ef4378b7bbb96bfaab2551954aa09f0aa85ebde60b5a672d5a3e2d6c739393a81 SHA512 5e80255b0030dd6dfc0f93a1d6863a35dc319c6567300ac5f4e16d15c322f0b3fc2681cae7d27de0d23bf6731069d0060b9edddf3d7e0b105c538beab53979dc
+DIST sqlite-doc-3450300.zip 10759906 BLAKE2B 3ad2307d4c5de10f20d0cb58bb673b291a63bf0328c3f1e40e37a4823fadda82e0f1fbfe7c9c76925ab1d1448e76cc4cbce4d4ad15c732f134f1b4b4caee9543 SHA512 8f865302137684c31c4f54d6cbe4ee82126394887930ec50501fb811023bc612878d2dc1c2317e960fe818a277b008a9835475e7a47822fc5ece5fe37aa61e31
 DIST sqlite-src-3440200.zip 14070781 BLAKE2B 9d29964ee15da6a104f4857cb5f2621df5b51d043012789793526f34c56097d7b1b1dcaa7672637f2d16bcab4ff775ba2c8415213b79f80636c0ff2aeff883ba SHA512 5c1fed9c399dad75735a1b4451f8f6be474b07652d74500649e60474691923f56156ef6d5bce51b58367c1676371f1184e32584fe9ac4d5dd0c4776fa6f1d9a3
 DIST sqlite-src-3450100.zip 14152147 BLAKE2B 815fb3e92b080a7c0014b68451f571c174c656ba26c75f76bfca8b2d4c5373e82f4314ad3d9657ee711194019b4534c51bcd3fe71abfec588df2c5e4cdf2f153 SHA512 475de1c473d2d828038a2afb98d74d52b5e0fd06a5bfc8516e44084ed38b1438310172905fd4fe0a64a736d699095ed286dfdee059ceeb50dfb9bb49131e2005
 DIST sqlite-src-3450200.zip 14156848 BLAKE2B a830dce41fd6c9ef936115460ed4aa9be277688389c50545fcb5e8ee65317d3adaf51873ec789556cf293418f7059868c7ffac229dc30756ba5137431839ec69 SHA512 b6e875ab4ed24cd564330e50a87f35aae43c382f88ca86c2eedf5308c7fab683c1880c0053408e864b0cec1feb7ae81aca8a91979a3ee3975f26037a7983011a
+DIST sqlite-src-3450300.zip 14160555 BLAKE2B 1c16a9b26587ed6b50dcd8373d4328266da0a47da7ffff15d505eddc8df74850a5bca3330bd9ee2b52036ccff9fb8aeebea02ef5713cc933753b4d8a4c15b2e8 SHA512 8f44ffdefd2cf09e7edb7cd78d5416fe7b42e01fe4b4e4803ce9d34c7b1b2971ec170a908a94b4bb11737dd3888675c8ff101ff2b41c53b8db05b5954e947cc9
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.45.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.45.3.ebuild
new file mode 100644
index 0000000000..46c442c733
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.45.3.ebuild
@@ -0,0 +1,427 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2024/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2024/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+BDEPEND=">=dev-lang/tcl-8.6:0"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.45.1-ppc64-ptr.patch
+	"${FILESDIR}"/${PN}-3.45.2-tests-x86.patch
+)
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS4
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	append-cppflags -DSQLITE_ENABLE_MEMSYS5
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	append-cppflags -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	append-cppflags -DSQLITE_ENABLE_SESSION
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		append-cppflags -DSQLITE_ENABLE_ICU
+		sed -e "s/^TLIBS = @LIBS@/& -licui18n -licuuc/" -i Makefile.in || die "sed failed"
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+	fi
+
+	econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db"
+	addpredict "/ÿ.db"
+
+	emake -Onone HAVE_TCL="$(usex tcl 1 "")" $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
index 2ba8f3e59a..482af8b00c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-debug/strace/strace-6.7.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/${PN}/${PN}/releases/download/v${PV}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="LGPL-2.1+ test? ( GPL-2+ )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec-conf/metadata.xml b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec-conf/metadata.xml
index efd7c8c218..03a31e4671 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec-conf/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec-conf/metadata.xml
@@ -5,4 +5,7 @@
 		<email>python@gentoo.org</email>
 		<name>Python</name>
 	</maintainer>
+	<upstream>
+		<remote-id type="github">projg2/python-exec</remote-id>
+	</upstream>
 </pkgmetadata>
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
index 05556b1b0d..85085af143 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python-exec/python-exec-2.4.10.ebuild
@@ -1,9 +1,10 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
 
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
 inherit python-any-r1
 
 DESCRIPTION="Python script wrapper"
@@ -19,11 +20,13 @@ RESTRICT="!test? ( test )"
 
 RDEPEND="
 	dev-lang/python-exec-conf
-	!<=dev-lang/python-2.7.18-r3:2.7"
+	!<=dev-lang/python-2.7.18-r3:2.7
+"
 BDEPEND="
 	test? (
 		$(python_gen_any_dep 'dev-python/pytest[${PYTHON_USEDEP}]')
-	)"
+	)
+"
 
 python_check_deps() {
 	python_has_version -b "dev-python/pytest[${PYTHON_USEDEP}]"
@@ -50,6 +53,11 @@ src_configure() {
 	econf "${myconf[@]}"
 }
 
+src_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	default
+}
+
 src_install() {
 	default
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index 2131d00c5d..7037e2147c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -10,10 +10,14 @@ DIST Python-3.11.9.tar.xz 20175816 BLAKE2B 4e7cd2c42ee39b5ef9624ebd1798320957e94
 DIST Python-3.11.9.tar.xz.asc 833 BLAKE2B fa29f632bae0bee7db946038ee3529bc3bfbe1b2e755b21394f67a3c80911ce8079aaab43a16d88e614a8bfc01fb5105ce3f61c59a5ca44470b0f59787c707b3 SHA512 b18b50e7168b2ca5376a1fa75e50e8baae2026d4f11d4cf613d758f3f17df4610fe4653fb2ac0c5c4ec0f6e630dc6490ad1ff32a2fd0ebd60f9f3bd136207ffc
 DIST Python-3.12.2.tar.xz 20591308 BLAKE2B 419186d220d4ae5ca31466771158c8b56f5298b93e81a29993f36711e08b0384e002d891280ca29099ae826919ba99c2d056d468d9d3049a984d58e01d4972c0 SHA512 2ccfae7b9f95d8e15ea85d3f66eea5f6a8fdcaffc0b405095fecb33efc0df50b831c1215542910ced948b54e6de1f7242b0b8b9afc5f89079451c552430d7d9f
 DIST Python-3.12.2.tar.xz.asc 963 BLAKE2B 45bfa01009f4df19d348a1fda722901cb4f0b76eb63fcf1061c2796949b5b2ef301fd0fdf818cd145e41d45e5785e0cfbfab8d98751765741715ee7d1b27f2f8 SHA512 fb477acb49864a662b1586db79e80fd8ebab85d4e5e14acd3bfb5afc3dbe8d6b9bf97eb518dfb77662e27040d400f451ed7575fe1264a6cc0d9feb06e4f2dc84
+DIST Python-3.12.3.tar.xz 20625068 BLAKE2B fc4f57ae50183db4c8cb37d94c37a7e58da5d031e03866841a678b986f01bbb8afdefb38124ba82b0a4988445b647214be43338dea13b0f063d3c2bf81c48c0b SHA512 4a2213b108e7f1f1525baa8348e68b2a2336d925e60d0a59f0225fc470768a2c8031edafc0b8243f94dbae18afda335ee5adf2785328c2218fd64cbb439f13a4
+DIST Python-3.12.3.tar.xz.asc 963 BLAKE2B f9668dde210793f8da0e0bb026b8ec3e0b4bc3abc58e72732f8faf356b19ca88a59b9d89b4b10f77b3602d9a967f0f2f44a0f091d698bc28ba9bad8049e5e006 SHA512 c291ec5b5e4f8deba867cc517624dd9a174745f04061ef737e58f3d52b9b30318264aec350e339fe88ccb493809ca1a90a378e86d86b8ec4a4f578b1a5843624
 DIST Python-3.13.0a4.tar.xz 20648544 BLAKE2B 4d45bdc1d88792c0bff93b4f9023d494b5ae86cd74eef49089fb11fab951b7fd2a5b8ac5b827b50fe1d61b516ed9a50f3f0e0b112299a70128f5e29e7b1d3f0f SHA512 f0dccc822ba000e8a50853d62698975d35382b981b62091e25ad6a6e0669e4e517c880e884644b508172de38226006ec11ddc649d9271320e728c0cd6c0b4dcc
 DIST Python-3.13.0a4.tar.xz.asc 963 BLAKE2B 2b27d93d4a1240b85657e455b1f148424460a10f8dc71a052a16f62c2e115a1767f1af1e6b4b7ccee5a4b59b4a92351875270567fd120aa53ee7fd50c51fd607 SHA512 261c0b23f84301f8b2aa4e8ea32995ea64a74a48dabc595028af71466915df93c118e699c939d7e4372d4575c59221743cb5ae21a936cc41241bdbafb9fab6c3
 DIST Python-3.13.0a5.tar.xz 20734172 BLAKE2B de5c0887fe67571f1f93fad3252433234683de266759d047f748f236328d091a73b24432e345382deaf4521fd462cd0d6916dddd8c4d66c5e3d56b12b780fb3b SHA512 7238d6792ac35f4cf9c701f7a69ed37de13efe0ba676f26a9b01a15ded1f8f070be295be6fc70b29153e9f2216224438d46500570b5d64641347cf2ccc66b556
 DIST Python-3.13.0a5.tar.xz.asc 963 BLAKE2B bbb0f90d2b5c1e39e224e97e627b89a4f9d8384bfc30a2da45f112a088290bbb4f36c39e4f12158d10fe737ec4b2af2db675917077aae36ba0166fdd8ef2c34e SHA512 9cb4235afcde912904a2c3a728d83db45947cbda5ae1efae742f6045d1744008fefe67ed4b667f58194d81b2f341f3718841eb06ffad9a2f2fb5357cb1a373f4
+DIST Python-3.13.0a6.tar.xz 20890000 BLAKE2B 3a08003be366d78c8e3f7d45440bb23a6c9fb1228a31212b1585d1ab1129a6e252e852f8bd300c13d45ccaa0988f6f5de2a067b4a0c9583be10da4c20ceffa74 SHA512 6e999c718cdfede4abc52297aae7160a2864424e8f49a47321fa822d40c331a3d061a0982e355351a0c4bea40e9b1ec3832d76a7f4b6b3986b62fca2757f0ca1
+DIST Python-3.13.0a6.tar.xz.asc 963 BLAKE2B 8f221fbba5f92a0468d2c28418b4d02037a59d4177e3e96f339a67376d0335df9ca23294e63d5ef4ef926bf7deafb2f8a458e740281429b0a648bd087b4e99a4 SHA512 1ec2abe8198a5fbd98490274bed7e84b48fcfc6ff25fcb474455d9f33b62673cfb7cf4939b304684aed005975d166143cb644b9a3e484d25de3dacb869de0131
 DIST Python-3.8.18.tar.xz 20696952 BLAKE2B 45be712aeef8bb3ba04aa2bd7d0282aa5f817327749c620ede18ee307fcb432540db9062a8186b08b49467515c74f01eb6fa739f366cca76dfadedcb22858429 SHA512 0be1d85cafade25e99b8277ba51d7b9b3a3d2dbbcc52fd0d1c633c47982e5dd87fd7a0ca180a78d7801d79a8ecafa79bd9d501d544cd7b6da53ea409daa70adf
 DIST Python-3.8.18.tar.xz.asc 833 BLAKE2B bc4e989748d53c6be7040e78d9f1852227c6a76f4c63a68824f5139defd51d1ea7988df01f961ff5c77382e156ef45fead2bb97bddbb38b208ddfa9c709e4f34 SHA512 99a0fd74fe19144819fd9522836474e10c1593787eb464694bdc6224b2d4a9331e31d2ecafc35c2bbb9bf67f20186295b28f9374c1fdcd05ac13f5f400219489
 DIST Python-3.8.19.tar.xz 18975156 BLAKE2B 57b241aeb8f99a8c30590dcb9402abbcf573f00d06e807846bc9135c0a8a4af896c4d772d34abc3c292339953f4974a203bff61a78641d91b1826770226cd7e9 SHA512 1d2a57fa15ccdaec8cdca508ba2ffb01e1ae053a3446ac709bc334480f8e913070899f01ed680cce6dc7ddfddcb27ef402fe206562249fa4c4e87be21ece0625
@@ -25,12 +29,17 @@ DIST Python-3.9.19.tar.xz.asc 833 BLAKE2B b48b58b8ccf4d6ba8d0d7120f04bebf59f843f
 DIST python-gentoo-patches-2.7.18_p16.tar.xz 35448 BLAKE2B 0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c SHA512 810be590d0e06fab4b2165e6852ca49662f09dcd7e20b47a29f613ad7653252c8dfac3f0eb228d77c8a914efa7c08788b2fbd552a4b47504f5fd0ec17450c48f
 DIST python-gentoo-patches-3.10.13_p3.tar.xz 16192 BLAKE2B f13efbaf3b41572cc9d1f3878cf2339448f513c96fd85b35d0f4a9a472cd4867d898ec46230391fc916debf5dc23ac0030b228f8ab78b2ac9e38159c75aecabb SHA512 a5eab5f3ea59b12fa6613a18b4f318981b750899d69cf382abea7705efb873be5b94024ed64fb47f19aa6f6e4f2a9ebe05c05361e7a45bd41dea5161f955448c
 DIST python-gentoo-patches-3.10.14.tar.xz 15240 BLAKE2B 0bfae6d93ceb1292891450d6af3bd7f286546141f1eb4a6a39ec1a43450f62fab6f31aa7e7be25982e6354ccfa1f233a4c949f6c9dffcf2d71ef136a64d91597 SHA512 c7084bf49642192d69979fff205d7e29d9491f483219240e3a1cd5fc00985e471a1f884af789058fa490f0994829b50accf2e445d21906a96aefdec8a394da24
+DIST python-gentoo-patches-3.10.14_p1.tar.xz 15836 BLAKE2B a850e4ad4f025fa9d38ccba937f1b3ee8443ed186c22ede58b4c7324a8541cf724590686671a9aa9194662303ce75bc80aac8ee6f9da34b793876817b6f593ff SHA512 5d969f5e5126ee675a062924a5f403de142fc5bfe4a931fd3576bcc6298a855419d305d4b1ffedacb429783a05324b36eef4c45c861c47bada0bdd840de2bca3
 DIST python-gentoo-patches-3.11.8_p1.tar.xz 9604 BLAKE2B 9017104f160f24e0a1818a8b12225c596faee79d646cc73b6edc4ed1e3faca86cfa2fcea09a128224b85330a67dea65f658507e60dcd09b10af0d590a2b05082 SHA512 0f0afa57abfb4282953a1a78e5ad1cc5e17c0a205e96d9c152f9de6537da95671c1d429ac03fd6aa70a457b27a19b0892a1f9b81164468c4085172a58f5e8d9e
 DIST python-gentoo-patches-3.11.9.tar.xz 8456 BLAKE2B 4e62837f17c1d056460df417b056a79ad78dbcdd3454761c7cda68ffe6faf8f4d4f04d5539e0ba94332fe19a751f7d5ff2c35ff969a6aa09a2c72d2ce5efbff1 SHA512 a288aa8d1d15e906e0f1762602a2122f9dc91bbd6b72123ac5d00ce55b3af324a4e8280b600fc0fb630e489e57ee1547d7595a4ede7a70e4b26d6686a8414997
 DIST python-gentoo-patches-3.12.2_p1.tar.xz 7208 BLAKE2B 8266f2b6c64ffd509278c0d8756680e6700dcd3ed3ab6d3f0e1be2cc87cb20bc694f9e386b474fa5d115ffecdd5d4807a956a48450e109ef7f449ed6f4a8afce SHA512 5fdb93ffae471b5a9e617c12ca1646b9521867cd260efe6da6350fcf5ba24114cad1dc715f033079ab69ecab7cc62c870e14fe2d2035c2d7f29c05cc0f1297db
+DIST python-gentoo-patches-3.12.3.tar.xz 6028 BLAKE2B 7953a48a1d95a6a33bd88060fbcac463a5469371aa0c882c3945f1fea64a63c4d45fca8451f51f4eaeea00a04267ad2e54e4cc720c95e8bb5a3477e00263b80a SHA512 4779bab2b24e59e4a77987ce3e9611d99e87c9c4d016309758c26a65fe2e11ef04d48d5af628c02b1552dc1f31b768f87448f8e19e716b4fe372941e6dacac3f
 DIST python-gentoo-patches-3.13.0a4.tar.xz 5256 BLAKE2B e3ad093b0c4bb044fb5883b5af14d130a6d5c94d8e9094263544f458ba2a38056ae64bd94d78ec44372caf40fafdb542d06be197cd5d1742f43a4f842d2fd2e3 SHA512 d845febc89d089791bac09beb758a615c20968b97077a3483c037562b4811edfe7c2d17e815032a77676bafda6ed838dba370fdcbba37f93ea83ee9d4b092fe8
 DIST python-gentoo-patches-3.13.0a5.tar.xz 5272 BLAKE2B d3251c26bf170c30cd3c935f697617e431c4d8dd9192e0ffd7a314b6780bf193b1fa1d6f4108455c993a0057b4712d336132ccc49fcd3d510003868afb3c2b5b SHA512 13dcdf5b037a7c09a9964cbe74c7caa26894bb842b53d7ff027a1675a005bd72452526b18e69b7c1579a3b786f67d4b3236c1c744b224bc7a09fa61aead01ef4
+DIST python-gentoo-patches-3.13.0a6.tar.xz 5240 BLAKE2B 827a365f60a1acfcbb5ddd568e4938cbd7f98678a12c756774b4307141834d90b890006e68965369663af1c6d594cf44466b9624f5ce3741ade28d80f3289437 SHA512 e45e0aaab022d2cc633576990a6232235067d89fc1270004caf18da898b98767ba7fa811bc8beb3cd8f0f842125cbd3cc3382e3aee13f15b8971d818f4813a30
 DIST python-gentoo-patches-3.8.18_p2.tar.xz 34160 BLAKE2B 2e97f70615b950798cb7e2ae076f6617da3c28ef2d3f56f4e9be5c9144a64512fab1c098ed778d740ef79fc95af3ede231efc712304937c65b867e6e18dc0405 SHA512 fd05a1f6f7ae8173f4976464116fed66486a36b937f638d97d60c2eb0f3b277525b25b60c800c3b2b3403b63c0cb813b138094c59ccf43aeecc4a23c69f2f3ca
 DIST python-gentoo-patches-3.8.19.tar.xz 33176 BLAKE2B 8e177fdede42ca5121c12414987fa4597648ef5f76d795856aef21fce528e15ef71ab5fad2399ae11a36b8adb443650b77e9e8d2ac9a768b7d12d3083334bd58 SHA512 362189294f36f86302b1bf988d1938ecbefc34b4300701c0a9171008184f1ae5657e3452274240592707ee1b651731e4758801d1f94a1bd10b7f1054bd9a7ceb
+DIST python-gentoo-patches-3.8.19_p1.tar.xz 35008 BLAKE2B 8771e3a2329577659a4ff64987f2500b7dc4f07f78677b823c8f11e7a9e7fc0369cc127e6ad1f1000986937b7811467bd22ba02129a754246658f99b7219a4a7 SHA512 470c125e8df23c1db358c2f7bbf5ac3b28e76fb843364f7fd5aa2fd399ac9b01a2ddfc2c1765f91236c71712941d19f273fb21f960239f79a0263b5b47081d46
 DIST python-gentoo-patches-3.9.18_p2.tar.xz 26756 BLAKE2B d9625e8972e2b7536ca1f54a284f0b414361e234b869f98593d132d7bc63b7a1a311c3e6769deba1f07358053982845a96b62b14871388e3b6d211f51f7358b5 SHA512 83584170cb29fb71937dd224af381cd5602b736d893c8ae89891805d6882d74208244040e3278baef82c31a6769c827c21746265260e9be7bc55ffdb8b625b2d
 DIST python-gentoo-patches-3.9.19.tar.xz 25828 BLAKE2B 1213880c55a34d4c39546fd5b5bfed17f969d8ebf0230861c04730c193b568adc9236e72cf3d65b0169769f47c488954abbcbbefaa28058409010704f3a5ccd0 SHA512 634809c9c80df37336d435e3d946c156f3623454b2cf5aa9a3a6d5b6754a5cfe2fa370310d9ba846abb3b2cdfe81dfec2071efe45b5e23396b38e392cd3314b8
+DIST python-gentoo-patches-3.9.19_p2.tar.xz 27684 BLAKE2B a69f00548c153da7b13dfeccb332d3d67ecf649fb5ae054590492f3e2fc2c84b78ebaf90bcf9738157c9022778e5bf2a6b4fb6a99e996dcb63859dcf6f84af23 SHA512 552a5f2d89307d4193d76df5a2cf1deb4bd5c8ad9ec81e6768987f1649f6571a318e68b92d8f8ecdba12bfe9c5f1a427a4cc577e6aaebf7748027cc50e412804
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1.ebuild
new file mode 100644
index 0000000000..1c8c99fe93
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.14_p1.ebuild
@@ -0,0 +1,508 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	valgrind? ( dev-debug/valgrind )
+	test? ( app-arch/xz-utils )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9.ebuild
index b114eda721..99f9650f71 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.9.ebuild
@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3.ebuild
new file mode 100644
index 0000000000..6133d8e6f0
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.3.ebuild
@@ -0,0 +1,537 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_alpha6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_alpha6.ebuild
new file mode 100644
index 0000000000..ffa0f839d6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_alpha6.ebuild
@@ -0,0 +1,550 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+LLVM_COMPAT=( 16 )
+LLVM_OPTIONAL=1
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic llvm-r1 multiprocessing
+inherit pax-utils python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_alpha/a}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm jit libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+REQUIRED_USE="jit? ( ${LLVM_REQUIRED_USE} )"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	jit? (
+		$(llvm_gen_dep '
+			sys-devel/clang:${LLVM_SLOT}
+			sys-devel/llvm:${LLVM_SLOT}
+		')
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use jit && llvm-r1_pkg_setup
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+
+			# Fails in profiling run, passes in src_test().
+			-x test_capi
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable jit experimental-jit)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addwrite "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p1.ebuild
new file mode 100644
index 0000000000..40996eefef
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.8.19_p1.ebuild
@@ -0,0 +1,430 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	rm Lib/distutils/command/wininst*.exe || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p2.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p2.ebuild
new file mode 100644
index 0000000000..fcb40b0b15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.9.19_p2.ebuild
@@ -0,0 +1,490 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm +ncurses pgo
+	+readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-wheels )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? ( >=sys-libs/readline-4.1:= )
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? ( app-arch/xz-utils )
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-python )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	rm -r Modules/expat || die
+	rm -r Modules/_ctypes/libffi* || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# https://bugs.gentoo.org/850151
+	sed -i -e "s:@@GENTOO_LIBDIR@@:$(get_libdir):g" setup.py || die
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	local jobs=$(makeopts_jobs)
+	sed -i -e "s:-j0:-j${jobs}:" Makefile.pre.in || die
+	sed -i -e "/self\.parallel/s:True:${jobs}:" setup.py || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+	local disable
+	use gdbm      || disable+=" gdbm"
+	use ncurses   || disable+=" _curses _curses_panel"
+	use readline  || disable+=" readline"
+	use sqlite    || disable+=" _sqlite3"
+	use ssl       || export PYTHON_DISABLE_SSL="1"
+	use tk        || disable+=" _tkinter"
+	export PYTHON_DISABLE_MODULES="${disable}"
+
+	if [[ -n "${PYTHON_DISABLE_MODULES}" ]]; then
+		einfo "Disabled modules: ${PYTHON_DISABLE_MODULES}"
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-x test_gdb
+			-x test_dtrace
+			-u-network
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-system-ffi
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with valgrind)
+	)
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	if tc-is-cross-compiler ; then
+		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+		# propagated to sysconfig for built extensions
+		#
+		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+		local -x CFLAGS= LDFLAGS=
+		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+		# We need to build our own Python on CBUILD first, and feed it in.
+		# bug #847910 and bug #864911.
+		local myeconfargs_cbuild=(
+			"${myeconfargs[@]}"
+
+			--libdir="${cbuild_libdir:2}"
+
+			# Avoid needing to load the right libpython.so.
+			--disable-shared
+
+			# As minimal as possible for the mini CBUILD Python
+			# we build just for cross.
+			--without-lto
+			--disable-optimizations
+		)
+
+		# Point the imminent CHOST build to the Python we just
+		# built for CBUILD.
+		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
+
+		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
+			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+		# Avoid as many dependencies as possible for the cross build.
+		cat >> Makefile <<-EOF || die
+			MODULE_NIS=disabled
+			MODULE__DBM=disabled
+			MODULE__GDBM=disabled
+			MODULE__DBM=disabled
+			MODULE__SQLITE3=disabled
+			MODULE__HASHLIB=disabled
+			MODULE__SSL=disabled
+			MODULE__CURSES=disabled
+			MODULE__CURSES_PANEL=disabled
+			MODULE_READLINE=disabled
+			MODULE__TKINTER=disabled
+			MODULE_PYEXPAT=disabled
+			MODULE_ZLIB=disabled
+		EOF
+
+		# Unfortunately, we do have to build this immediately, and
+		# not in src_compile, because CHOST configure for Python
+		# will check the existence of the Python it was pointed to
+		# immediately.
+		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
+		popd &> /dev/null || die
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	hprefixify setup.py
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	# Prevent using distutils bundled by setuptools.
+	# https://bugs.gentoo.org/823728
+	export SETUPTOOLS_USE_DISTUTILS=stdlib
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	emake DESTDIR="${D}" altinstall
+
+	# Remove static library
+	rm "${ED}"/usr/$(get_libdir)/libpython*.a || die
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"{sqlite3,test/test_sqlite*} || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.4-r1.ebuild
index 87da23b245..f1a94faa00 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.78.4-r1.ebuild
@@ -16,7 +16,7 @@ IUSE="dbus debug +elf gtk-doc +mime selinux static-libs sysprof systemtap test u
 RESTRICT="!test? ( test )"
 REQUIRED_USE="gtk-doc? ( test )" # Bug #777636
 
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # * elfutils (via libelf) does not build on Windows. gresources are not embedded
 # within ELF binaries on that platform anyway and inspecting ELF binaries from
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
index 8a5efd23fb..24fa3b4d26 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/Manifest
@@ -1 +1 @@
-DIST jansson-2.14.tar.gz 535618 BLAKE2B eb514ff222444d4c0d1ef6b99150e3e43bd4d7a1bec3d66e5ece8bc59ac19a0898d9eb061cacad52afda7fe172ec6df46b5a90952707422f56daae53f82c9427 SHA512 5a592776c7ba8c0b1f5efaf813f77948bbc4bda168a72d221d176af0cf61038e26c1f30795433be10e2fc5069d5763d11852a8574774906a9f8ad261ac30109c
+DIST jansson-2.14.tar.bz2 434481 BLAKE2B b7b7e98360fd73f7925b88e3729a7a18307b4f05fed4b37659d24ddc03208469471d508dcd245534f73af3b5e93f595e49e3cb2c99733955b03d471bd5a32f15 SHA512 1a659c0f41b0672757c13ebd16bd10ad7d6484366aefda078aa816266ce4f5638bc121f1ce8c4234b0b9f201ea73c227b9084125857452cbcba058a111e4a6fd
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r1.ebuild
index 1d11fe6ed7..f19ea8be4b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -7,7 +7,7 @@ inherit toolchain-funcs
 
 DESCRIPTION="C library for encoding, decoding and manipulating JSON data"
 HOMEPAGE="https://www.digip.org/jansson/"
-SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.gz"
+SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.bz2"
 
 LICENSE="MIT"
 SLOT="0/4"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
index 094aa5550e..b2f6ab3007 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/jansson/jansson-2.14-r2.ebuild
@@ -7,7 +7,7 @@ inherit autotools
 
 DESCRIPTION="C library for encoding, decoding and manipulating JSON data"
 HOMEPAGE="https://www.digip.org/jansson/"
-SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.gz"
+SRC_URI="https://github.com/akheron/jansson/releases/download/v${PV}/${P}.tar.bz2"
 
 LICENSE="MIT"
 SLOT="0/4"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
index b931b5e9c6..0206e9375e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libaio/libaio-0.3.113-r1.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://pagure.io/libaio.git"
 else
 	SRC_URI="https://releases.pagure.org/${PN}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="LGPL-2"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r1.ebuild
deleted file mode 100644
index 6590012a74..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r1.ebuild
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DESCRIPTION="Abstraction layer to simplify PKCS#11 API"
-HOMEPAGE="https://github.com/opensc/libp11/wiki"
-SRC_URI="https://github.com/OpenSC/${PN}/releases/download/${P}/${P}.tar.gz"
-
-LICENSE="LGPL-2.1"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ppc ppc64 ~riscv ~s390 sparc x86"
-IUSE="doc static-libs"
-
-RDEPEND="dev-libs/openssl:=[bindist(+)]"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig
-	doc? ( app-text/doxygen )"
-
-src_configure() {
-	econf \
-		--enable-shared \
-		$(use_enable static-libs static) \
-		$(use_enable doc api-doc)
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r6.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
similarity index 80%
rename from sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r6.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
index 857488c8b4..fb5a4c7faf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libp11/libp11-0.4.12-r7.ebuild
@@ -11,18 +11,17 @@ SRC_URI="https://github.com/OpenSC/${PN}/releases/download/${P}/${P}.tar.gz"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="doc static-libs test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	dev-libs/openssl:=[bindist(+)]
+	>=dev-libs/openssl-3.0.0:=[bindist(+)]
 	!~dev-libs/openssl-3.2.0
 	!=dev-libs/openssl-3.2.1-r0
-	|| (
-		>=dev-libs/openssl-3.1.5-r1
-		<dev-libs/openssl-3.0.12
-	)
+	!=dev-libs/openssl-3.0.13-r1
+	!=dev-libs/openssl-3.0.13-r0
+	!~dev-libs/openssl-3.0.12
 "
 DEPEND="${RDEPEND}
 	test? ( dev-libs/softhsm )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r2.ebuild
index 961f1925e5..b3cf5cb10c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre2/libpcre2-10.42-r2.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0/3" # libpcre2-posix.so version
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 +jit libedit +pcre16 +pcre32 +readline static-libs unicode valgrind zlib"
 REQUIRED_USE="?? ( libedit readline )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpwquality/libpwquality-1.4.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpwquality/libpwquality-1.4.5-r1.ebuild
index dfee579091..f4eb2d4151 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpwquality/libpwquality-1.4.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpwquality/libpwquality-1.4.5-r1.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/${PN}/${PN}/releases/download/${P}/${P}.tar.bz2"
 
 LICENSE="|| ( BSD GPL-2 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="pam python static-libs"
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libsodium/libsodium-1.0.19-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libsodium/libsodium-1.0.19-r2.ebuild
index 476c85b120..eebd3c520e 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libsodium/libsodium-1.0.19-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libsodium/libsodium-1.0.19-r2.ebuild
@@ -31,7 +31,7 @@ S="${WORKDIR}"/${PN}-stable
 
 LICENSE="ISC"
 SLOT="0/26"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos"
 IUSE="+asm static-libs +urandom"
 
 CPU_USE=( cpu_flags_x86_{aes,sse4_1} )
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libunistring/libunistring-1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libunistring/libunistring-1.2.ebuild
index 3650da85e1..dfd324c697 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libunistring/libunistring-1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libunistring/libunistring-1.2.ebuild
@@ -12,7 +12,7 @@ SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
 LICENSE="|| ( LGPL-3+ GPL-2+ ) || ( FDL-1.2 GPL-3+ )"
 # Check regularly even on "minor" bumps
 SLOT="0/5"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc static-libs"
 
 QA_CONFIG_IMPL_DECL_SKIP=(
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
index 08d6094e36..1c5d46d282 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest
@@ -1,3 +1,2 @@
-DIST libuv-1.47.0.tar.gz 1316016 BLAKE2B 6c530f8625366a9bf3f99ac4eb6b3bf3d4f6a05f98848e08cdab884934d79862cf8e79dd2d506ec734d701faab517eba2215063dce4b4216add5cfd6bfebd82e SHA512 3d0e76c4e29c5de14fddda07409f8db30dc64261d1c0bdfce7f70eb8f5ac911707fe662e81c4f117e4068cb0728158fc2b8255f8aa497c0f688e46c7fb93a5b3
 DIST libuv-1.48.0.tar.gz 1314877 BLAKE2B 7595797ab732109516ce280fa2efa3474e82e78890087408c7f5b1457ce8f44e53878581bb8d473795e298d7390dd8a269dd2e8970e10b50a2c0bbe1cce187cc SHA512 7ae3a4c02f654a26056db1541e52ccc4c54aaea39c33585f0cf6949af997d0a0a29f30a294c8df6e92f6f6af7ce64c2766b1a2cc67f342e3e139cd55b7326c94
 DIST libuv-1.48.0.tar.gz.sig 833 BLAKE2B f0982f7723fa81afe3fe668fc4497fb182a6093f38b185aba4f7359a3248062e7953acaba3f7fd739c9ff5b590664e4b7b81ee138442ffccd46c989c0a10345b SHA512 3a6441bb250badb7bb54a102dd7a1cf47ee4e0ed93ff0369c5b6a4b1e5440e613d85530f19c9ebdc586a97dfe1e06af09e2f90c13448e875dbaee1c703efa955
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-darwin17.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-darwin17.patch
deleted file mode 100644
index 3fa90de832..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-darwin17.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4785ad6337aac8b78224291f0848f25fc8cb41c9 Mon Sep 17 00:00:00 2001
-From: Sergey Fedorov <vital.had@gmail.com>
-Date: Sat, 18 Nov 2023 16:57:40 +0800
-Subject: [PATCH] unix: unbreak macOS < 10.14 (#4230)
-
-From fc70430b09c49032d41ae97db26da10e20941e75 Mon Sep 17 00:00:00 2001
-From: Bo Anderson <mail@boanderson.me>
-Date: Fri, 24 Nov 2023 10:17:52 +0000
-Subject: [PATCH] unix: correct pwritev conditional (#4233)
-
-
-diff --git a/src/unix/fs.c b/src/unix/fs.c
-index 891306daedc..4de0643a6c3 100644
---- a/src/unix/fs.c
-+++ b/src/unix/fs.c
-@@ -84,7 +84,9 @@
- 
- #if defined(__CYGWIN__) ||                                                    \
-     (defined(__HAIKU__) && B_HAIKU_VERSION < B_HAIKU_VERSION_1_PRE_BETA_5) || \
--    (defined(__sun) && !defined(__illumos__))
-+    (defined(__sun) && !defined(__illumos__)) ||                              \
-+    (defined(__APPLE__) && !TARGET_OS_IPHONE &&                               \
-+     MAC_OS_X_VERSION_MIN_REQUIRED < 110000)
- #define preadv(fd, bufs, nbufs, off)                                          \
-   pread(fd, (bufs)->iov_base, (bufs)->iov_len, off)
- #define pwritev(fd, bufs, nbufs, off)                                         \
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-hppa-kernel.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-hppa-kernel.patch
deleted file mode 100644
index 1871ae2213..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-hppa-kernel.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-https://github.com/libuv/libuv/commit/f1444293652cf5478a67b9305271d73ad6d36232
-
-From f1444293652cf5478a67b9305271d73ad6d36232 Mon Sep 17 00:00:00 2001
-From: matoro <12038583+matoro@users.noreply.github.com>
-Date: Wed, 15 Nov 2023 17:57:06 -0500
-Subject: [PATCH] linux: disable io_uring on hppa below kernel 6.1.51 (#4224)
-
-First kernel with support is 6.1, was only fully functional from .51
-onwards: https://lore.kernel.org/all/cb912694-b1fe-dbb0-4d8c-d608f3526905@gmx.de/
-
-Co-authored-by: matoro <matoro@users.noreply.github.com>
---- a/src/unix/linux.c
-+++ b/src/unix/linux.c
-@@ -487,8 +487,16 @@ static int uv__use_io_uring(void) {
-   use = atomic_load_explicit(&use_io_uring, memory_order_relaxed);
- 
-   if (use == 0) {
-+    use = uv__kernel_version() >=
-+#if defined(__hppa__)
-+    /* io_uring first supported on parisc in 6.1, functional in .51 */
-+    /* https://lore.kernel.org/all/cb912694-b1fe-dbb0-4d8c-d608f3526905@gmx.de/ */
-+    /* 6.1.51 */ 0x060133
-+#else
-     /* Older kernels have a bug where the sqpoll thread uses 100% CPU. */
--    use = uv__kernel_version() >= /* 5.10.186 */ 0x050ABA ? 1 : -1;
-+    /* 5.10.186 */ 0x050ABA
-+#endif
-+    ? 1 : -1;
- 
-     /* But users can still enable it if they so desire. */
-     val = getenv("UV_USE_IO_URING");
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-ipv6-tests.patch b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-ipv6-tests.patch
deleted file mode 100644
index 20176dc7ab..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-ipv6-tests.patch
+++ /dev/null
@@ -1,54 +0,0 @@
-https://github.com/libuv/libuv/issues/4211
-https://github.com/libuv/libuv/pull/4220
-https://github.com/libuv/libuv/commit/54d8364c2406758b572621af381f1d83e01ae46c
-
-From 54d8364c2406758b572621af381f1d83e01ae46c Mon Sep 17 00:00:00 2001
-From: Ben Noordhuis <info@bnoordhuis.nl>
-Date: Tue, 14 Nov 2023 22:09:30 +0100
-Subject: [PATCH] test: check if ipv6 link-local traffic is routable (#4220)
-
-Fixes: https://github.com/libuv/libuv/issues/4211
---- a/test/test-tcp-connect6-error.c
-+++ b/test/test-tcp-connect6-error.c
-@@ -23,6 +23,7 @@
- #include "task.h"
- #include <stdio.h>
- #include <stdlib.h>
-+#include <string.h>
- 
- 
- static int connect_cb_called = 0;
-@@ -75,9 +76,13 @@ TEST_IMPL(tcp_connect6_error_fault) {
- 
- 
- TEST_IMPL(tcp_connect6_link_local) {
-+  uv_interface_address_t* ifs;
-+  uv_interface_address_t* p;
-   struct sockaddr_in6 addr;
-   uv_connect_t req;
-   uv_tcp_t server;
-+  int ok;
-+  int n;
- 
-   if (!can_ipv6())
-     RETURN_SKIP("IPv6 not supported");
-@@ -90,6 +95,18 @@ TEST_IMPL(tcp_connect6_link_local) {
-   RETURN_SKIP("Test does not currently work in QEMU");
- #endif  /* defined(__QEMU__) */
- 
-+  /* Check there's an interface that routes link-local (fe80::/10) traffic. */
-+  ASSERT_OK(uv_interface_addresses(&ifs, &n));
-+  for (p = ifs; p < &ifs[n]; p++)
-+    if (p->address.address6.sin6_family == AF_INET6)
-+      if (!memcmp(&p->address.address6.sin6_addr, "\xfe\x80", 2))
-+        break;
-+  ok = (p < &ifs[n]);
-+  uv_free_interface_addresses(ifs, n);
-+
-+  if (!ok)
-+    RETURN_SKIP("IPv6 link-local traffic not supported");
-+
-   ASSERT_OK(uv_ip6_addr("fe80::0bad:babe", 1337, &addr));
-   ASSERT_OK(uv_tcp_init(uv_default_loop(), &server));
- 
-
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.47.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.47.0-r1.ebuild
deleted file mode 100644
index c102af94ad..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.47.0-r1.ebuild
+++ /dev/null
@@ -1,59 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="Cross-platform asychronous I/O"
-HOMEPAGE="https://github.com/libuv/libuv"
-
-if [[ ${PV} = 9999* ]]; then
-	EGIT_REPO_URI="https://github.com/libuv/libuv.git"
-	inherit git-r3
-else
-	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-LICENSE="BSD BSD-2 ISC MIT"
-SLOT="0/1"
-
-BDEPEND="
-	dev-build/libtool
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-ipv6-tests.patch
-	"${FILESDIR}"/${P}-hppa-kernel.patch
-	"${FILESDIR}"/${P}-darwin17.patch  # upstream
-)
-
-src_prepare() {
-	default
-
-	echo "m4_define([UV_EXTRA_AUTOMAKE_FLAGS], [serial-tests])" \
-		> m4/libuv-extra-automake-flags.m4 || die
-
-	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
-		eapply "${FILESDIR}"/${PN}-1.41.0-darwin.patch
-	fi
-
-	# Upstream fails to ship a configure script
-	eautoreconf
-}
-
-src_configure() {
-	local myeconfargs=(
-		cc_cv_cflags__g=no
-	)
-
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/opensc/opensc-0.25.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/opensc/opensc-0.25.0-r1.ebuild
index 5fbac563e0..cd1b22fb2b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/opensc/opensc-0.25.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/opensc/opensc-0.25.0-r1.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/OpenSC/OpenSC.git"
 else
 	SRC_URI="https://github.com/OpenSC/OpenSC/releases/download/${PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc ~x86"
 fi
 
 LICENSE="LGPL-2.1"
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.10.ebuild
index bc5b156b9d..4ca5a857b6 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.10.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.10.ebuild
@@ -26,7 +26,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
index 1b240bf273..520c7d2dd7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/Manifest
@@ -1,2 +1,3 @@
 DIST docutils-0.19.tar.gz 2056383 BLAKE2B 9983a905642de4e81ca118578671b503ddfda4bef1afcc0524de40543e1f9617fd8d768ef467da49d2f01076683400bad6a0fe15f6b5a3a1e202c42b2e34ab1b SHA512 fb904a899f2b6f3c07c5079577bd7c52a3182cb85f6a4149391e523498df15bfa317f0c04095b890beeb3f89c2b444875a2a609d880ac4d7fbc3125e46b37ea5
 DIST docutils-0.20.1.tar.gz 2058365 BLAKE2B 73fb8302599ffe57b0840c898b0b2e3ccd39ff9ea6eec2b5d345d02c950e1a8357bd821e62733b0484e82bc30e71d30fab381390b0edaef4375b02bcd9eeeb40 SHA512 a0ddca315d03677003036d6a8052ac96fbd3fcc4508564938ea684d79bedb4d322d83449c7b26e55b19b0aadd6e46ca9ac409bb16279a20f06c70e9c15ef5eb0
+DIST docutils-0.21.1.tar.gz 2201080 BLAKE2B a89792a69a7faa0eda7b2470e5e3a3d3cf8250a3577553a8f8f8d3d86d2693394e97dca6c75c1b4815748d2ce126ccd3f71dead5763ec8b70aee7be183165473 SHA512 2816fe074b12d7f15fb6730339f3af5f459f50af0cd2a4922194887f48bfd9931c2f2054a17a5418585b586502b96e05ed18600d31c523084537dc72707ab0ee
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.1.ebuild
new file mode 100644
index 0000000000..773ff8bded
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/docutils-0.21.1.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 optfeature pypi
+
+DESCRIPTION="Python Documentation Utilities (reference reStructuredText impl.)"
+HOMEPAGE="
+	https://docutils.sourceforge.io/
+	https://pypi.org/project/docutils/
+"
+
+# GPL-3+ only for emacs/rst.el
+LICENSE="BSD BSD-2 GPL-3+ PSF-2.4 public-domain"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	dev-python/pillow[${PYTHON_USEDEP}]
+	dev-python/pygments[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+"
+
+PATCHES=(
+	# minimal backport of upstream r9637, r9641
+	"${FILESDIR}/${P}-test.patch"
+)
+
+python_compile_all() {
+	# Generate html docs from reStructured text sources.
+
+	# Place html4css1.css in base directory to ensure that the generated reference to it is correct.
+	cp docutils/writers/html4css1/html4css1.css . || die
+
+	cd tools || die
+	"${EPYTHON}" buildhtml.py --input-encoding=utf-8 --no-datestamp \
+		--stylesheet-path=../html4css1.css, --traceback ../docs || die
+}
+
+src_test() {
+	cd test || die
+	mkdir functional/output || die
+	distutils-r1_src_test
+}
+
+python_test() {
+	"${EPYTHON}" alltests.py -v || die "Testing failed with ${EPYTHON}"
+}
+
+python_install() {
+	distutils-r1_python_install
+
+	# Install tools.
+	python_doscript tools/buildhtml.py
+}
+
+install_txt_doc() {
+	local doc="${1}"
+	local dir="txt/$(dirname ${doc})"
+	docinto "${dir}"
+	dodoc "${doc}"
+}
+
+python_install_all() {
+	local DOCS=( *.txt )
+	local HTML_DOCS=( docs tools docutils/writers/html4css1/html4css1.css )
+
+	distutils-r1_python_install_all
+
+	local doc
+	while IFS= read -r -d '' doc; do
+		install_txt_doc "${doc}"
+	done < <(find docs tools -name '*.txt' -print0)
+}
+
+pkg_postinst() {
+	optfeature \
+		"auto-detecting the image dimensions when using the 'scale' option" \
+		dev-python/pillow
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.1-test.patch b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.1-test.patch
new file mode 100644
index 0000000000..507fd239c1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/docutils/files/docutils-0.21.1-test.patch
@@ -0,0 +1,42 @@
+diff --git a/test/test_writers/test_html5_polyglot_parts.py b/test/test_writers/test_html5_polyglot_parts.py
+index fb2792ee7..cb03fea2f 100644
+--- a/test/test_writers/test_html5_polyglot_parts.py
++++ b/test/test_writers/test_html5_polyglot_parts.py
+@@ -24,11 +24,20 @@ if __name__ == '__main__':
+ 
+ import docutils
+ import docutils.core
++from docutils.parsers.rst.directives.images import PIL
+ from docutils.utils.code_analyzer import with_pygments
+ 
+ ROOT_PREFIX = (Path(__file__).parent.parent/'functional'/'input').as_posix()
+ DATA_ROOT = os.path.abspath(os.path.join(__file__, '..', '..', 'data'))
+ 
++with_pygments = False
++PIL_NOT_FOUND_PATH = 'dummy.png'
++try:
++    if PIL and (tuple(int(i) for i in PIL.__version__.split('.')) >= (10, 3)):
++        PIL_NOT_FOUND_PATH = Path('dummy.png').resolve()
++except:
++    PIL = None
++
+ 
+ class Html5WriterPublishPartsTestCase(unittest.TestCase):
+     """Test case for HTML writer via the publish_parts interface."""
+@@ -642,14 +651,14 @@ totest['system_messages'] = ({'stylesheet_path': '',
+ .. image:: dummy.mp4
+    :scale: 100%
+ """,
+-{'fragment': """\
++{'fragment': f"""\
+ <img alt="dummy.png" src="dummy.png" />
+ <aside class="system-message">
+ <p class="system-message-title">System Message: WARNING/2 \
+ (<span class="docutils literal">&lt;string&gt;</span>, line 1)</p>
+ <p>Cannot scale image!
+   Could not get size from &quot;dummy.png&quot;:
+-  [Errno 2] No such file or directory: 'dummy.png'</p>
++  [Errno 2] No such file or directory: '{PIL_NOT_FOUND_PATH}'</p>
+ </aside>
+ <aside class="system-message">
+ <p class="system-message-title">System Message: ERROR/3 \
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/Manifest
index 82f52b1781..240c220ac3 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/Manifest
@@ -1,2 +1,4 @@
-DIST hatch-hatchling-v1.21.1.gh.tar.gz 774577 BLAKE2B 31e2b50598b4fe120ecea407a37e3262876a2ec1e8cf02f272c25838e73afc37f2fef1f8fab08b2e3b83bfd828f6c558ce303b084081b83504343a8bb057c341 SHA512 91b5684737fac19758d7095b357f99031d46e9f981e093cab848ce770fd1f9440b69212f3ef2217e3700e7dd7985a97c2735bbd27b306c7b8aa7bffc5c950fb4
 DIST hatch-hatchling-v1.22.5.gh.tar.gz 782757 BLAKE2B 3431ef7c4e5f0754e51507e29d88ed0277b530d220eb75bdeab459d88172ba51de3cf2456074fa88483cc89e72726f3e147b97e995f9ccaf699b6c2699776a8c SHA512 d4e77872e34e3aba3fce286f911861b795005c37550a2ca72a83216cea67d53be891afc8861b11582c66d38748f9c8d4980548d216c0fb21b2b4e1cadc314e58
+DIST hatch-hatchling-v1.23.0.gh.tar.gz 802345 BLAKE2B 571ae18bda737acf05bd830c4d835b2c785a595844cefbed030383e9ede166b0cd8bba2d7a6e0a4c7b504be825fbca4fa89861e9ae265e9a24bc756025da8d07 SHA512 ed504577d856e42b46ab861972cfb1c47589ae85887c2fc0aa78ded7a2f1cc8eaef796b9331d4ff853a86b6d808080b15d11943775c600c5d10b191ae65cb400
+DIST hatch-hatchling-v1.24.1.gh.tar.gz 803276 BLAKE2B 61966dbc170ef2b130ae49f78e9c99f81eedc69f6d7f30b28c48be8a2d6aa17f128ca08adc3740c3dead0da30581208b967a3b8e02fd5d3f3f46ab9be1813460 SHA512 47c6f93072f82b15c56eb61b342cde44bb34cc23b89ac426120215ae71ea956380a1a66d12a70a11088df921c0df31a448bb40953e2e3bb32c74ed34a94b9640
+DIST hatch-hatchling-v1.24.2.gh.tar.gz 1054297 BLAKE2B b2da7dc3f3d58998b57d6ee625a2b7e890afc078c0d8f6cb9c332480df561090bb8bc255e3e60d5d25fa55001869429f822014891fe1cec0098b61fbe02efe52 SHA512 e83f57089707a267685c9cac7f29cd5862adec62f6346097aa62bd5b3b9f7222621b2ea71004dd52f62798dab71bcf05c33a2c43dbe39d1bbc5f4a4f99f28c40
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.22.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.22.5-r1.ebuild
index 92ad9f5f83..8fd32731e8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.22.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.22.5-r1.ebuild
@@ -24,7 +24,7 @@ S=${WORKDIR}/${MY_P}/backend
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # deps are listed in backend/src/hatchling/ouroboros.py
 # editables are optional but required for editable installs
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.21.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.23.0.ebuild
similarity index 87%
rename from sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.21.1-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.23.0.ebuild
index 6919c16fa1..0f7cc99b5b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.21.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.23.0.ebuild
@@ -24,12 +24,13 @@ S=${WORKDIR}/${MY_P}/backend
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 # deps are listed in backend/src/hatchling/ouroboros.py
+# editables are optional but required for editable installs
 RDEPEND="
 	>=dev-python/editables-0.3[${PYTHON_USEDEP}]
-	>=dev-python/packaging-21.3[${PYTHON_USEDEP}]
+	>=dev-python/packaging-23.2[${PYTHON_USEDEP}]
 	>=dev-python/pathspec-0.10.1[${PYTHON_USEDEP}]
 	>=dev-python/pluggy-1.0.0[${PYTHON_USEDEP}]
 	$(python_gen_cond_dep '
@@ -75,7 +76,7 @@ python_test() {
 		tests/backend/dep/test_core.py::test_unknown_extra
 		tests/backend/dep/test_core.py::test_version_unmet
 		# broken if CARGO is set
-		tests/backend/builders/test_app.py::TestBuildBootstrap::test_no_cargo
+		tests/backend/builders/test_binary.py::TestBuildBootstrap::test_no_cargo
 	)
 
 	# top-level "tests" directory contains tests both for hatch
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.1.ebuild
new file mode 100644
index 0000000000..0f7cc99b5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.1.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( pypy3 python3_{10..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+
+inherit distutils-r1
+
+TAG=${P/-/-v}
+MY_P=hatch-${TAG}
+DESCRIPTION="Modern, extensible Python build backend"
+HOMEPAGE="
+	https://pypi.org/project/hatchling/
+	https://github.com/pypa/hatch/
+"
+SRC_URI="
+	https://github.com/pypa/hatch/archive/${TAG}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}/backend
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# deps are listed in backend/src/hatchling/ouroboros.py
+# editables are optional but required for editable installs
+RDEPEND="
+	>=dev-python/editables-0.3[${PYTHON_USEDEP}]
+	>=dev-python/packaging-23.2[${PYTHON_USEDEP}]
+	>=dev-python/pathspec-0.10.1[${PYTHON_USEDEP}]
+	>=dev-python/pluggy-1.0.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/tomli-1.2.2[${PYTHON_USEDEP}]
+	' 3.10)
+"
+# always depend on the newest version available, at least until upstream
+# stops treating unknown classifiers as a fatal error
+# https://github.com/pypa/hatch/issues/1368
+RDEPEND+="
+	>=dev-python/trove-classifiers-2024.3.25[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/atomicwrites[${PYTHON_USEDEP}]
+			dev-python/click[${PYTHON_USEDEP}]
+			dev-python/httpx[${PYTHON_USEDEP}]
+			dev-python/platformdirs[${PYTHON_USEDEP}]
+			dev-python/pytest-mock[${PYTHON_USEDEP}]
+			dev-python/rich[${PYTHON_USEDEP}]
+			dev-python/tomli-w[${PYTHON_USEDEP}]
+			dev-python/virtualenv[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping tests on ${EPYTHON}"
+		return
+	fi
+
+	local -x EPYTEST_DESELECT=(
+		# these run pip to install stuff
+		tests/backend/dep/test_core.py::test_dependency_found
+		tests/backend/dep/test_core.py::test_extra_met
+		tests/backend/dep/test_core.py::test_extra_no_dependencies
+		tests/backend/dep/test_core.py::test_extra_unmet
+		tests/backend/dep/test_core.py::test_unknown_extra
+		tests/backend/dep/test_core.py::test_version_unmet
+		# broken if CARGO is set
+		tests/backend/builders/test_binary.py::TestBuildBootstrap::test_no_cargo
+	)
+
+	# top-level "tests" directory contains tests both for hatch
+	# and hatchling
+	cd "${WORKDIR}/${MY_P}" || die
+	local -x PYTHONPATH="src:${PYTHONPATH}"
+	# sigh; standalone test suites are overrated, right?
+	echo "__version__ = '${PV}'" > src/hatch/_version.py || die
+	# tests mock cargo subprocess call but the backend raises if CARGO
+	# is not set and shutil.which() can't find it
+	local -x CARGO=cargo
+	epytest tests/backend
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.2.ebuild
new file mode 100644
index 0000000000..0f7cc99b5b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/hatchling/hatchling-1.24.2.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( pypy3 python3_{10..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+
+inherit distutils-r1
+
+TAG=${P/-/-v}
+MY_P=hatch-${TAG}
+DESCRIPTION="Modern, extensible Python build backend"
+HOMEPAGE="
+	https://pypi.org/project/hatchling/
+	https://github.com/pypa/hatch/
+"
+SRC_URI="
+	https://github.com/pypa/hatch/archive/${TAG}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}/backend
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# deps are listed in backend/src/hatchling/ouroboros.py
+# editables are optional but required for editable installs
+RDEPEND="
+	>=dev-python/editables-0.3[${PYTHON_USEDEP}]
+	>=dev-python/packaging-23.2[${PYTHON_USEDEP}]
+	>=dev-python/pathspec-0.10.1[${PYTHON_USEDEP}]
+	>=dev-python/pluggy-1.0.0[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		>=dev-python/tomli-1.2.2[${PYTHON_USEDEP}]
+	' 3.10)
+"
+# always depend on the newest version available, at least until upstream
+# stops treating unknown classifiers as a fatal error
+# https://github.com/pypa/hatch/issues/1368
+RDEPEND+="
+	>=dev-python/trove-classifiers-2024.3.25[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/atomicwrites[${PYTHON_USEDEP}]
+			dev-python/click[${PYTHON_USEDEP}]
+			dev-python/httpx[${PYTHON_USEDEP}]
+			dev-python/platformdirs[${PYTHON_USEDEP}]
+			dev-python/pytest-mock[${PYTHON_USEDEP}]
+			dev-python/rich[${PYTHON_USEDEP}]
+			dev-python/tomli-w[${PYTHON_USEDEP}]
+			dev-python/virtualenv[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		einfo "Skipping tests on ${EPYTHON}"
+		return
+	fi
+
+	local -x EPYTEST_DESELECT=(
+		# these run pip to install stuff
+		tests/backend/dep/test_core.py::test_dependency_found
+		tests/backend/dep/test_core.py::test_extra_met
+		tests/backend/dep/test_core.py::test_extra_no_dependencies
+		tests/backend/dep/test_core.py::test_extra_unmet
+		tests/backend/dep/test_core.py::test_unknown_extra
+		tests/backend/dep/test_core.py::test_version_unmet
+		# broken if CARGO is set
+		tests/backend/builders/test_binary.py::TestBuildBootstrap::test_no_cargo
+	)
+
+	# top-level "tests" directory contains tests both for hatch
+	# and hatchling
+	cd "${WORKDIR}/${MY_P}" || die
+	local -x PYTHONPATH="src:${PYTHONPATH}"
+	# sigh; standalone test suites are overrated, right?
+	echo "__version__ = '${PV}'" > src/hatch/_version.py || die
+	# tests mock cargo subprocess call but the backend raises if CARGO
+	# is not set and shutil.which() can't find it
+	local -x CARGO=cargo
+	epytest tests/backend
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/inflect/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/inflect/Manifest
index c7a30ab3dc..2059b84209 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/inflect/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/inflect/Manifest
@@ -1,2 +1 @@
-DIST inflect-7.0.0.tar.gz 70963 BLAKE2B ae896109acd33946e05902d121ecbd95e04dc33a1d6da6035148521de5baff8cff877a5c56c104bde29d56025e231e20f97e0ee50686de0ec19b567d53612314 SHA512 b2ca39d0e36cda8c8c42d208443d3b84b10d659dcd0d368273503d6e76df19c61ac3c623d526ea918ca8b347d6db8bdfb691609e480eaa33dd4f1c37e008473b
 DIST inflect-7.2.0.tar.gz 71448 BLAKE2B 33d7d8cf4b4de05a035e1929fd6c70c3635290cf1387927e5fe15315c06135a6b2daf6b67f044b9ea004c2345bdeb8b2f17e5f54daa9cb18f0d3bc1935295439 SHA512 13b698637a8049987675dd419359907baba6d8a9805c3602bbc414ed8fb422bfaa32ec26bcc309508ead5cb72bed632d9142f7796c981269551f1238b88c9019
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.0.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.0.0.ebuild
deleted file mode 100644
index 2081c97362..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.0.0.ebuild
+++ /dev/null
@@ -1,35 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( pypy3 python3_{10..12} )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Correctly inflect words and numbers"
-HOMEPAGE="
-	https://pypi.org/project/inflect/
-	https://github.com/jaraco/inflect/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/pydantic-1.9.1[${PYTHON_USEDEP}]
-	dev-python/typing-extensions[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/setuptools-scm-3.4.1[${PYTHON_USEDEP}]
-"
-
-distutils_enable_tests pytest
-
-EPYTEST_DESELECT=(
-	# broken upstream
-	# https://github.com/jaraco/inflect/issues/204
-	inflect/__init__.py::inflect.engine.compare
-)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.2.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.2.0.ebuild
index a1a608f287..4b40654a88 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.2.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/inflect/inflect-7.2.0.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	>=dev-python/pydantic-1.9.1[${PYTHON_USEDEP}]
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/Manifest
index e95f206d6d..ed864f9d20 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/Manifest
@@ -1,3 +1,2 @@
-DIST jaraco.context-4.3.0.tar.gz 9764 BLAKE2B 2905723ec54c6ae63b2088d677cd486dcdc06dfea06bb058eeb512da508b2ae74990894cb62f3751321cb4c813b66ffe9a3084b21eb0cb4236a9515969432dfc SHA512 8882229fa1a68f2733ec4103fbeaf47625b19790f4461ab18df4c1f1a99d4d26d10d7381ab68ba5df48616a1fdb2d5e4a767496a0e40658fd011ed9cd39255de
 DIST jaraco.context-5.1.0.tar.gz 11626 BLAKE2B c6ac691c6493e0aed5d606784f8418e55fb0c6c8094aa75251ffb12008fb9b4fbfe0912e6ef316d7799d2c0f55be6ba542202f6b8b2bc93afa3a79da4224d35f SHA512 b92c72947060e2219c172c43104055d026f66b119676fcfa31dff34640539d34376b61d209291fffeb558e6051fb92a2a34390fbd3a72f87ee15c5926cb387e5
 DIST jaraco.context-5.3.0.tar.gz 13345 BLAKE2B d2f429335ea80a6b50ea9574adc45c25c0fc78e8ebb5edde218bcbbe7a2b27ae6b5c17453e71904240d0d873ebef36f7c7aeda4424d3fea2dd9aaf01af6fb4c5 SHA512 f63bf272c45ff5c43499621651b78841259040ac98d67c9db75fadebb1c497c1156e05f23bf7c91df3e91f1e070acb9f7dc665e7b242ba7b1ac1cf99a619494d
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-4.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-4.3.0.ebuild
deleted file mode 100644
index b0c8171ea6..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-4.3.0.ebuild
+++ /dev/null
@@ -1,47 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 7 -- sys-apps/portage dep
-EAPI=7
-
-DISTUTILS_USE_PEP517=flit
-PYPI_NO_NORMALIZE=1
-PYPI_PN=${PN/-/.}
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Context managers by jaraco"
-HOMEPAGE="
-	https://github.com/jaraco/jaraco.context/
-	https://pypi.org/project/jaraco.context/
-"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests pytest
-
-src_configure() {
-	grep -q 'build-backend = "setuptools' pyproject.toml ||
-		die "Upstream changed build-backend, recheck"
-	# write a custom pyproject.toml to ease setuptools bootstrap
-	cat > pyproject.toml <<-EOF || die
-		[build-system]
-		requires = ["flit_core >=3.2,<4"]
-		build-backend = "flit_core.buildapi"
-
-		[project]
-		name = "jaraco.context"
-		version = "${PV}"
-		description = "Context managers by jaraco"
-	EOF
-}
-
-python_install() {
-	distutils-r1_python_install
-	# rename to workaround a bug in pkg_resources
-	# https://bugs.gentoo.org/834522
-	mv "${D}$(python_get_sitedir)"/jaraco{_,.}context-${PV}.dist-info || die
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.1.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.1.0.ebuild
index 7cf576c0a8..ca0ae619ca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.1.0.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_tests pytest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
index 32d34277c7..40bdfafed4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-context/jaraco-context-5.3.0.ebuild
@@ -19,7 +19,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~m68k ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~ia64 ~m68k ~ppc ~ppc64 ~riscv ~s390 ~x86"
 
 RDEPEND="
 	$(python_gen_cond_dep '
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
index af2b5b49dc..0c8e216ae7 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/Manifest
@@ -1 +1,2 @@
 DIST jaraco.functools-4.0.0.tar.gz 17779 BLAKE2B ef403411f60e956a723350c949cdbd13fa36473ce77f6b1cea4eb5eaedbd2edd4ea902b8c062d53411c7bc12dcfd3879b0f1c82a1d21c28575f0298eb03f868d SHA512 2545bf3b9c9357ae867e7a5627582e14d0bdf25bac6acc5fbbb7e86f7aa24bc33b5bca584543b4180abdde203610b9716950110253045c1fe11f8bd045283c78
+DIST jaraco_functools-4.0.1.tar.gz 18169 BLAKE2B 86d5b8020f9c44b8dc373fd2f07a8c5f11cb2a7ec069541763ce92562fb230b557a4c3783e899713136c71e457985bc7e4abb0becde9ca7eaacf7798b5815269 SHA512 04e0ea4719ec8c4439e5a1dd3c3ba0241b21b54b06d53ecc44263046e994aa736b9d196490edd3fd9d7ea997c23c177b30db506b2088bd9de62c637856101982
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.0.1.ebuild
new file mode 100644
index 0000000000..5d3cc9f68a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/jaraco-functools/jaraco-functools-4.0.1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYPI_PN=${PN/-/.}
+PYTHON_COMPAT=( pypy3 python3_{10..12} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Additional functions used by other projects by developer jaraco"
+HOMEPAGE="
+	https://github.com/jaraco/jaraco.functools/
+	https://pypi.org/project/jaraco.functools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/more-itertools-0.12.0-r1[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/jaraco-classes[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "jaraco.functools"
+		version = "${PV}"
+		description = "Functools like those found in stdlib"
+	EOF
+}
+
+python_install() {
+	distutils-r1_python_install
+	# rename to workaround a bug in pkg_resources
+	# https://bugs.gentoo.org/834522
+	mv "${D}$(python_get_sitedir)"/jaraco{_,.}functools-${PV}.dist-info || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.1.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.1.1.ebuild
index 73d2ad106a..adc0126c28 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.1.1.ebuild
@@ -23,7 +23,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.1.ebuild
index 9b0492d3f6..b6b8283c06 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-5.2.1.ebuild
@@ -23,7 +23,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
index 851b189299..75d4a2669b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/Manifest
@@ -1 +1,2 @@
 DIST pluggy-1.4.0.tar.gz 65812 BLAKE2B 0a8bff68f1871f0e571105012b0e3961771c6ee34a64711520084d0a951308d192187d01b14136c389b5bc09f127ead1a1f96ebffa7b345d2d5023157c049c43 SHA512 ac21a0c68cfcb9c7c401e5c48404f7447489b75befe8bc8b6e7ea84f24a1c6dbfb3de024577dd9e36ca9f538f9867ef836ba13018e3b8b348bba3e9bbd0c4dfd
+DIST pluggy-1.5.0.tar.gz 67955 BLAKE2B c63e7605b7631adf7fe3a91dae92d2ce8172510574e0b23ded159479077f91c88948487a7a4e1da30dca7da0339cb78fbb521538e67bc2bde37986970403d48f SHA512 032d41e1f2bed56eff22463c4645516e9415ee253e0a3fe5ba83a8de5e21700baae1f6384c979d2c6f622e4216a2b745eec489bc04f52a576d423e771365cc7a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
new file mode 100644
index 0000000000..bb57bffff5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pluggy/pluggy-1.5.0.ebuild
@@ -0,0 +1,26 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Plugin and hook calling mechanisms for Python"
+HOMEPAGE="
+	https://pluggy.readthedocs.io/
+	https://github.com/pytest-dev/pluggy/
+	https://pypi.org/project/pluggy/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+"
+
+distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-0.3-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-0.3-r3.ebuild
index 83a366d11f..2f9f3201db 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-0.3-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-0.3-r3.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-9999.ebuild
index f503d453bc..210c440ca9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/pydecomp/pydecomp-9999.ebuild
@@ -1,10 +1,10 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit distutils-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 31d7ec1a16..28faea0055 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,2 +1,3 @@
 DIST setuptools-69.0.3.tar.gz 2219609 BLAKE2B 1a5e7896c7ea82d51b0aa4794435b9899cef871f6ae43d22ae5e08c57d87b70641f3f2abfcc29956a3de515f90b112fd61d3daf793474b4cf33f8567e3a38f4a SHA512 11df934931f4b73f7e07ea5713479593c6baa134d423556b2ae7aff0f1e5bdbdee1f5b516131adb169c838231ceb0293441fbf275ef7030dabecf74122565b6d
 DIST setuptools-69.2.0.tar.gz 2222950 BLAKE2B 9f2bfee2bc6ca05c319137166d8b7a4fc8352652e7b29385e5dd8e692c2ea17e46b06c9c1ba78d8bb128682e57248e41900fa73bf4c4f323929d170d306e1d38 SHA512 e69abe573304b1c2c074144c9df663fec0d6ce617359f070ca8d57710e4beb99435d0d2124d45a7d8b24889693597e1e03875bc6ff960fa31f6250e1c253b906
+DIST setuptools-69.5.1.tar.gz 2291314 BLAKE2B 3756dd587136c7e688bdfecf4c0434c0e799f50f9a9a95750d41cb75e26b613b3dc178f43a9e0d21f17c42a7c4ad7461e7986966aefb814e3d0ff05178c82542 SHA512 81f4a5184976a0d4aa070261bb56458c54ec6a479786fa469e98cb336e9a1691b281ae771abe41bc5398fac15b2dd039c07cf014ee00572f46908ce6830fcb6a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-69.5.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-69.5.1.ebuild
new file mode 100644
index 0000000000..dc75499399
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-69.5.1.ebuild
@@ -0,0 +1,130 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..12} pypy3 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+# check */_vendor/vendored.txt
+RDEPEND="
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/ordered-set-4.0.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-24[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/build[${PYTHON_USEDEP}]
+			dev-python/importlib-metadata[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.9[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			>=dev-python/pytest-home-0.5[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			dev-python/tomli[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+# setuptools-scm is here because installing plugins apparently breaks stuff at
+# runtime, so let's pull it early. See bug #663324.
+PDEPEND="
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+"
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}"/setuptools-62.4.0-py-compile.patch
+	)
+
+	distutils-r1_src_prepare
+
+	# breaks tests
+	sed -i -e '/--import-mode/d' pytest.ini || die
+
+	# remove bundled dependencies
+	rm -r */_vendor || die
+
+	# remove the ugly */extern hack that breaks on unvendored deps
+	rm -r */extern || die
+	find -name '*.py' -exec sed \
+		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
+		-i {} + || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
+		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
+		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
+		setuptools/tests/test_virtualenv.py::test_clean_env_install
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		setuptools/tests/test_extern.py::test_distribution_picklable
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
+		# Internet, sigh
+		setuptools/tests/test_integration.py
+	)
+
+	case ${EPYTHON} in
+		python3.12)
+			EPYTEST_DESELECT+=(
+				# TODO
+				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_distutils_command_dep
+				setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_transitive_extra_dependency
+			)
+	esac
+
+	local EPYTEST_XDIST=1
+	epytest -o tmp_path_retention_policy=all setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
index 736b73d859..bfd8a713f8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/Manifest
@@ -1,3 +1 @@
-DIST snakeoil-0.10.5.tar.gz 183358 BLAKE2B 6154eb0b5ce55aefc67484dc33c8a6e36ee903bce4293045252a8c9a3b4ecfc27690c720bb46842c1bca8c14ef59fbae4d3c1f02ebd46a7c91c1c9fbd1aa1532 SHA512 fafc04aa65423ebb3db66daa9c239bdf0968722b8ac14c1206dd3f26e3960d832fd15001e320463f98ca142ec7e1d6bff73ebc0ab10c3c5d3cde241b8160fdc3
-DIST snakeoil-0.10.6.tar.gz 174265 BLAKE2B e1d80bdd0eb37604f77b385e31b45a4b5437cf33ca01593b0ec091351e221dd5fea1b631d2962807fd63e5b59cbfa9d953149bf686821011bb37525156cbef79 SHA512 2534398ede5a112c493ffb59c32ad8f1eecea8992d8f97ae37d8d825a428383338820d9a70f784999690367c84eca2bd2cbdb21a73f2b426157a9a917efeb729
-DIST snakeoil-0.10.7.tar.gz 174373 BLAKE2B 73a58adbb653b979b9c3f4b3cbdeef8ec5a3c8ba6262788a9694a41779660efcef724e1b318be1819dd2c2e2170d7d9e8e6bc615d0ad824cccb662527e204bfc SHA512 b84851f39565a0cfdb32e86744472426ac7502507c12e9869ab5f1eb15913ef6372a1f55465a1e6dbf3832a98bb14856004948dbc1197c454ac046423bfb15af
+DIST snakeoil-0.10.8.tar.gz 174380 BLAKE2B 96c5f4e106513ee8061c6278345ac132510202faa0e915b362170ee7de5f23f0b7bfdc671c0c07721f57eeeb90df5f6851be70d4541295029d93126ea680e50b SHA512 7088cd3fb34bc666a51ddd59b0bf6c9d9da2f04727057ffa5b74ffb188efd63153afcf45442e99b8e1611642b71cf92518dafcacb85717dfa82370df18458497
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild
deleted file mode 100644
index 213d63db99..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.5.ebuild
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-PYTHON_REQ_USE="threads(+)"
-inherit distutils-r1
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/snakeoil.git
-		https://github.com/pkgcore/snakeoil.git"
-	inherit git-r3
-else
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
-	inherit pypi
-fi
-
-DESCRIPTION="misc common functionality and useful optimizations"
-HOMEPAGE="https://github.com/pkgcore/snakeoil"
-
-LICENSE="BSD BSD-2 MIT"
-SLOT="0"
-
-RDEPEND="
-	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
-"
-
-distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.6.ebuild
deleted file mode 100644
index 213d63db99..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.6.ebuild
+++ /dev/null
@@ -1,33 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-PYTHON_REQ_USE="threads(+)"
-inherit distutils-r1
-
-if [[ ${PV} == *9999 ]] ; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/pkgcore/snakeoil.git
-		https://github.com/pkgcore/snakeoil.git"
-	inherit git-r3
-else
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-macos"
-	inherit pypi
-fi
-
-DESCRIPTION="misc common functionality and useful optimizations"
-HOMEPAGE="https://github.com/pkgcore/snakeoil"
-
-LICENSE="BSD BSD-2 MIT"
-SLOT="0"
-
-RDEPEND="
-	dev-python/lazy-object-proxy[${PYTHON_USEDEP}]
-"
-BDEPEND="
-	>=dev-python/flit-core-3.8[${PYTHON_USEDEP}]
-"
-
-distutils_enable_tests pytest
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.7.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.8.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.7.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/snakeoil/snakeoil-0.10.8.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
index a9642de6fa..7f4ccd7801 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/Manifest
@@ -1 +1,2 @@
 DIST trove-classifiers-2024.3.25.tar.gz 16040 BLAKE2B 001a307d041e76213f3d2d115a10467b8434afecb0dc268ed9a1943aa7961c9021b49794a593102372c41b6776f3e513db44f680dda700c9897f65ef593ec860 SHA512 3b1d0c08d9a90bfe2314b092270677397d5150f0b641dfaf6ffda7a3447b898ea2c1d2dceab0f61ddceeb6b42945aec19e7a1028bf72ac3a119454f66945db7c
+DIST trove-classifiers-2024.4.10.tar.gz 16036 BLAKE2B bfd0ae5e3e1dc2dab67e66dc9cdf90b3ff789d00fff5f13ddf8974736adf3e37c505488d4aea32b0c4b43a6d77617e9a0672def2e66baf813734b1e3bebb8bd3 SHA512 2705ea82869bb3092dd37c817d5263955249b44ad64c0fcedc523ecc78eaeb2a327500adbafe70c5d08b5961bf8095748e34a0daa1a2ba8db3fa27e1a35a645b
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.4.10.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.4.10.ebuild
new file mode 100644
index 0000000000..3172a692bd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/trove-classifiers/trove-classifiers-2024.4.10.ebuild
@@ -0,0 +1,43 @@
+# Copyright 2022-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYPI_NO_NORMALIZE=1
+PYTHON_COMPAT=( pypy3 python3_{10..12} )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Canonical source for classifiers on PyPI (pypi.org)"
+HOMEPAGE="
+	https://github.com/pypa/trove-classifiers/
+	https://pypi.org/project/trove-classifiers/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "setuptools' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease hatchling bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "trove-classifiers"
+		version = "${PV}"
+		description = "Canonical source for classifiers on PyPI (pypi.org)."
+	EOF
+}
+
+python_test() {
+	epytest
+	"${EPYTHON}" -m tests.lib || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index 96b7a15521..d42f1eba92 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1,2 +1 @@
-DIST typing_extensions-4.10.0.tar.gz 77558 BLAKE2B eddcee7d33437d10d599a7f0e03932525945bc57be5bc62ffa27417458f0fcb96c4fdddb3749f9a6db4615dee88221338cdb2de775db8b503ba3586b9fcf6b6f SHA512 d3d840719ed0cf1435a959f84a65df93f55fb4bfdda926cd74a34a8bb6ab0407108ee8941f40b6cb570e2f7c440abffb0bc1d0f0414814047de6e9c3eeb24093
 DIST typing_extensions-4.11.0.tar.gz 78744 BLAKE2B 641d4a13fcd10151a0b7059d11393c78974883710a860805dc132a148677c80a0be06dc32f66cffc4ae2dd838c607bdaa8d3f44e4e3cf55848d2a315bd74ce5a SHA512 d795fadbe9c0a24c4d3190f375d72576f5b42a14dc3a999127c1356f2ae77d4bffdc04a23b7a05331cc8b703a81f504328aaf5d6c1247ea24cbeed25dccb0a37
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.10.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.10.0.ebuild
deleted file mode 100644
index 2b2ddff925..0000000000
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.10.0.ebuild
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
-HOMEPAGE="
-	https://pypi.org/project/typing-extensions/
-	https://github.com/python/typing_extensions/
-"
-
-LICENSE="PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-distutils_enable_tests unittest
-
-python_test() {
-	cd src || die
-	eunittest
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.11.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.11.0.ebuild
index 795492eaf7..2b2ddff925 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.11.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.11.0.ebuild
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 distutils_enable_tests unittest
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.4-r1.ebuild
index 7b89a32295..7b46a6afbd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.78.4-r1.ebuild
@@ -15,7 +15,7 @@ HOMEPAGE="https://www.gtk.org/"
 
 LICENSE="LGPL-2+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
 
 RDEPEND="
 	${PYTHON_DEPS}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.4.ebuild
index 77241b6573..ce9abacdf4 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.78.4.ebuild
@@ -14,7 +14,7 @@ LICENSE="LGPL-2.1+"
 SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
 
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="${PYTHON_DEPS}"
 DEPEND="${RDEPEND}"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 7a314673a9..a67122a59a 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -448,6 +448,15 @@ unset -f _distutils_set_globals
 # An array containing options to be passed to the build system.
 # Supported by a subset of build systems used by the eclass.
 #
+# For maturin, the arguments will be passed as `maturin build`
+# arguments.
+#
+# For meson-python, the arguments will be passed as `meson setup`
+# arguments.
+#
+# For scikit-build-core, the arguments will be passed as `cmake`
+# options (e.g. `-DFOO=BAR` form should be used).
+#
 # For setuptools, the arguments will be passed as first parameters
 # to setup.py invocations (via esetup.py), as well as to the PEP517
 # backend.  For future compatibility, only global options should be used
@@ -1406,6 +1415,46 @@ distutils_pep517_install() {
 				EOF
 			)
 			;;
+		scikit-build-core)
+			# TODO: split out the config/toolchain logic from cmake.eclass
+			# for now, we copy the most important bits
+			local CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE:-RelWithDebInfo}
+			cat >> "${BUILD_DIR}"/config.cmake <<- _EOF_ || die
+				set(CMAKE_ASM_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_ASM-ATT_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_Fortran_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_EXE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_MODULE_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_SHARED_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+				set(CMAKE_STATIC_LINKER_FLAGS_${CMAKE_BUILD_TYPE^^} "" CACHE STRING "")
+			_EOF_
+
+			# hack around CMake ignoring CPPFLAGS
+			local -x CFLAGS="${CFLAGS} ${CPPFLAGS}"
+			local -x CXXFLAGS="${CXXFLAGS} ${CPPFLAGS}"
+
+			local cmake_args=(
+				"-C${BUILD_DIR}/config.cmake"
+				"${DISTUTILS_ARGS[@]}"
+			)
+
+			# NB: we need to pass strings for boolean fields
+			# https://github.com/scikit-build/scikit-build-core/issues/707
+			config_settings=$(
+				"${EPYTHON}" - "${cmake_args[@]}" <<-EOF || die
+					import json
+					import sys
+					print(json.dumps({
+						"cmake.args": ";".join(sys.argv[1:]),
+						"cmake.build-type": "${CMAKE_BUILD_TYPE}",
+						"cmake.verbose": "true",
+						"install.strip": "false",
+					}))
+				EOF
+			)
+			;;
 		setuptools)
 			if in_iuse debug && use debug; then
 				local -x SETUPTOOLS_RUST_CARGO_PROFILE=dev
diff --git a/sdk_container/src/third_party/portage-stable/eclass/eutils.eclass b/sdk_container/src/third_party/portage-stable/eclass/eutils.eclass
index b48c18f979..bdcc7e110f 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/eutils.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/eutils.eclass
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: eutils.eclass
@@ -7,6 +7,7 @@
 # @SUPPORTED_EAPIS: 6
 # @BLURB: many extra (but common) functions that are used in ebuilds
 # @DEPRECATED: native package manager functions, more specific eclasses
+# @DEAD
 
 if [[ -z ${_EUTILS_ECLASS} ]]; then
 _EUTILS_ECLASS=1
diff --git a/sdk_container/src/third_party/portage-stable/eclass/meson.eclass b/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
index 9d7f830e58..a22a858875 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/meson.eclass
@@ -425,7 +425,10 @@ meson_src_configure() {
 		export -n {C,CPP,CXX,F,OBJC,OBJCXX,LD}FLAGS PKG_CONFIG_{LIBDIR,PATH}
 		echo meson setup "${MESONARGS[@]}" >&2
 		meson setup "${MESONARGS[@]}"
-	) || die -n
+	)
+	local rv=$?
+	[[ ${rv} -eq 0 ]] || die -n "configure failed"
+	return ${rv}
 }
 
 # @FUNCTION: meson_src_compile
@@ -451,9 +454,12 @@ meson_src_compile() {
 
 	set -- meson compile "${mesoncompileargs[@]}"
 	echo "$@" >&2
-	"$@" || die -n "compile failed"
+	"$@"
+	local rv=$?
+	[[ ${rv} -eq 0 ]] || die -n "compile failed"
 
 	popd > /dev/null || die
+	return ${rv}
 }
 
 # @FUNCTION: meson_src_test
@@ -473,9 +479,12 @@ meson_src_test() {
 
 	set -- meson test "${mesontestargs[@]}"
 	echo "$@" >&2
-	"$@" || die -n "tests failed"
+	"$@"
+	local rv=$?
+	[[ ${rv} -eq 0 ]] || die -n "tests failed"
 
 	popd > /dev/null || die
+	return ${rv}
 }
 
 # @FUNCTION: meson_install
@@ -495,9 +504,12 @@ meson_install() {
 
 	set -- meson install "${mesoninstallargs[@]}"
 	echo "$@" >&2
-	"$@" || die -n "install failed"
+	"$@"
+	local rv=$?
+	[[ ${rv} -eq 0 ]] || die -n "install failed"
 
 	popd > /dev/null || die
+	return ${rv}
 }
 
 # @FUNCTION: meson_src_install
diff --git a/sdk_container/src/third_party/portage-stable/eclass/rpm.eclass b/sdk_container/src/third_party/portage-stable/eclass/rpm.eclass
index b9187167eb..c9c21aa6eb 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/rpm.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/rpm.eclass
@@ -1,14 +1,13 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # @ECLASS: rpm.eclass
 # @MAINTAINER:
 # base-system@gentoo.org
-# @SUPPORTED_EAPIS: 6 7 8
+# @SUPPORTED_EAPIS: 7 8
 # @BLURB: convenience class for extracting RPMs
 
 case ${EAPI} in
-	6) inherit epatch eqawarn ;;
 	7|8) ;;
 	*) die "${ECLASS}: EAPI ${EAPI:-0} not supported" ;;
 esac
@@ -18,10 +17,7 @@ _RPM_ECLASS=1
 
 inherit estack
 
-case ${EAPI} in
-	6) DEPEND="app-arch/rpm2targz" ;;
-	*) BDEPEND="app-arch/rpm2targz" ;;
-esac
+BDEPEND="app-arch/rpm2targz"
 
 # @FUNCTION: rpm_unpack
 # @USAGE: <rpms>
@@ -88,59 +84,6 @@ rpm_src_unpack() {
 	done
 }
 
-# @FUNCTION: rpm_spec_epatch
-# @USAGE: [spec]
-# @DEPRECATED: none
-# @DESCRIPTION:
-# Read the specified spec (defaults to ${PN}.spec) and attempt to apply
-# all the patches listed in it.  If the spec does funky things like moving
-# files around, well this won't handle that.
-rpm_spec_epatch() {
-	# no epatch in EAPI 7 and later
-	[[ ${EAPI} == 6 ]] || die "${FUNCNAME} is banned in EAPI ${EAPI}"
-
-	local p spec=$1
-	local dir
-
-	if [[ -z ${spec} ]] ; then
-		# search likely places for the spec file
-		for spec in "${PWD}" "${S}" "${WORKDIR}" ; do
-			spec+="/${PN}.spec"
-			[[ -e ${spec} ]] && break
-		done
-	fi
-	[[ ${spec} == */* ]] \
-		&& dir=${spec%/*} \
-		|| dir=
-
-	ebegin "Applying patches from ${spec}"
-
-	grep '^%patch' "${spec}" | \
-	while read line ; do
-		# expand the %patch line
-		set -- ${line}
-		p=$1
-		shift
-
-		# process the %patch arguments
-		local arg
-		EPATCH_OPTS=
-		for arg in "$@" ; do
-			case ${arg} in
-			-b) EPATCH_OPTS+=" --suffix" ;;
-			*)  EPATCH_OPTS+=" ${arg}" ;;
-			esac
-		done
-
-		# extract the patch name from the Patch# line
-		set -- $(grep "^P${p#%p}: " "${spec}")
-		shift
-		epatch "${dir:+${dir}/}$*"
-	done
-
-	eend
-}
-
 fi
 
 EXPORT_FUNCTIONS src_unpack
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 6a515f9b5c..a5d4345e7f 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -117,6 +117,13 @@ tc_version_is_between() {
 # Ignore missing baseline/reference data and create new baseline.
 : "${GCC_TESTS_IGNORE_NO_BASELINE:=}"
 
+# @ECLASS_VARIABLE: GCC_TESTS_REGEN_BASELINE
+# @DEFAULT_UNSET
+# @USER_VARIABLE
+# @DESCRIPTION:
+# Ignore baseline/reference data and create new baseline.
+: "${GCC_TESTS_REGEN_BASELINE:=}"
+
 # @ECLASS_VARIABLE: GCC_TESTS_CHECK_TARGET
 # @USER_VARIABLE
 # @DESCRIPTION:
@@ -399,6 +406,12 @@ if tc_has_feature d && tc_version_is_at_least 12.0 ; then
 	BDEPEND+=" d? ( || ( sys-devel/gcc[d(-)] <sys-devel/gcc-12[d(-)] ) )"
 fi
 
+if tc_has_feature rust && tc_version_is_at_least 14.0.0_pre20230421 ; then
+	# This was added upstream in r14-9968-g3e1e73fc995844 as a temporary measure.
+	# See https://inbox.sourceware.org/gcc/34fec7ea-8762-4cac-a1c8-ff54e20e31ed@embecosm.com/
+	BDEPEND+=" rust? ( virtual/rust )"
+fi
+
 PDEPEND=">=sys-devel/gcc-config-2.11"
 
 #---->> S + SRC_URI essentials <<----
@@ -1449,7 +1462,7 @@ toolchain_src_configure() {
 			# respect USE=graphite here in case the user passes some
 			# graphite flags rather than try strip them out.
 			$(use_with graphite isl)
-			--without-zstd
+			$(use_with zstd)
 			--with-system-zlib
 		)
 
@@ -1908,17 +1921,34 @@ toolchain_src_test() {
 	# the exit code of targets other than 'check' may be unreliable.
 	nonfatal emake -C "${WORKDIR}"/build -k "${GCC_TESTS_CHECK_TARGET}" RUNTESTFLAGS="${GCC_TESTS_RUNTESTFLAGS}"
 
-	if [[ -z ${GCC_TESTS_IGNORE_NO_BASELINE} && -f "${GCC_TESTS_COMPARISON_DIR}/${GCC_TESTS_COMPARISON_SLOT}/${CHOST}.xfail" ]] ; then
+	# Produce an updated failure manifest.
+	einfo "Generating a new failure manifest ${T}/${CHOST}.xfail"
+	rm -f "${T}"/${CHOST}.xfail
+	edo "${T}"/validate_failures.py \
+		--srcpath="${S}" \
+		--build_dir="${WORKDIR}"/build \
+		--manifest="${T}"/${CHOST}.xfail \
+		--produce_manifest &> /dev/null
+
+	local manifest="${GCC_TESTS_COMPARISON_DIR}/${GCC_TESTS_COMPARISON_SLOT}/${CHOST}.xfail"
+
+	if [[ -f "${manifest}" ]] ; then
 		# TODO: Distribute some baseline results in e.g. gcc-patches.git?
 		# validate_failures.py manifest files support include directives.
-		einfo "Comparing with previous cached results at GCC_TESTS_COMPARISON_DIR=${GCC_TESTS_COMPARISON_DIR}/${GCC_TESTS_COMPARISON_SLOT}/${CHOST}.xfail"
+		einfo "Comparing with previous cached results at ${manifest}"
 
-		edo "${T}"/validate_failures.py \
+		nonfatal edo "${T}"/validate_failures.py \
 			--srcpath="${S}" \
 			--build_dir="${WORKDIR}"/build \
-			--manifest="${GCC_TESTS_COMPARISON_DIR}/${GCC_TESTS_COMPARISON_SLOT}/${CHOST}.xfail"
+			--manifest="${manifest}"
+		ret=$?
+
+		if [[ -n ${GCC_TESTS_REGEN_BASELINE} ]] ; then
+			eerror "GCC_TESTS_REGEN_BASELINE is set, ignoring test result and creating a new baseline..."
+		elif [[ ${ret} != 0 ]]; then
+			die "Tests failed (failures not listed in the baseline data)"
+		fi
 	else
-		# nonfatal first because we want to run again with comparison data if available.
 		nonfatal edo "${T}"/validate_failures.py \
 			--srcpath="${S}" \
 			--build_dir="${WORKDIR}"/build
@@ -1926,23 +1956,18 @@ toolchain_src_test() {
 
 		# We have no reference data saved from a previous run to know if
 		# the failures are tolerable or not, so we bail out.
-		eerror "No reference test data at GCC_TESTS_COMPARISON_DIR=${GCC_TESTS_COMPARISON_DIR}/${GCC_TESTS_COMPARISON_SLOT}/${CHOST}.xfail!"
+		eerror "No reference test data at ${manifest}!"
 		eerror "GCC's tests require a baseline to compare with for any reasonable interpretation of results."
 
 		if [[ -n ${GCC_TESTS_IGNORE_NO_BASELINE} ]] ; then
-			eerror "GCC_TESTS_IGNORE_NO_BASELINE is set, creating new baseline manifest..."
+			eerror "GCC_TESTS_IGNORE_NO_BASELINE is set, ignoring test result and creating a new baseline..."
+		elif [[ -n ${GCC_TESTS_REGEN_BASELINE} ]] ; then
+			eerror "GCC_TESTS_REGEN_BASELINE is set, ignoring test result and creating using a new baseline..."
 		elif [[ ${ret} != 0 ]]; then
-			eerror "(Set GCC_TESTS_IGNORE_NO_BASELINE=1 to make this non-fatal for initial run.)"
+			eerror "(Set GCC_TESTS_IGNORE_NO_BASELINE=1 to make this non-fatal and generate a baseline.)"
 			die "Tests failed (failures occurred with no reference data)"
 		fi
 	fi
-
-	# Produce an updated set of expected results
-	edo "${T}"/validate_failures.py \
-		--srcpath="${S}" \
-		--build_dir="${WORKDIR}"/build \
-		--manifest="${T}"/${CHOST}.xfail \
-		--produce_manifest &> /dev/null
 }
 
 #---->> src_install <<----
@@ -2325,7 +2350,7 @@ create_revdep_rebuild_entry() {
 #---->> pkg_pre* <<----
 
 toolchain_pkg_preinst() {
-	if use test ; then
+	if [[ ${MERGE_TYPE} != binary ]] && use test ; then
 		# Install as orphaned to allow comparison across more versions even
 		# after unmerged. Also useful for historical records and tracking
 		# down regressions a while after they first appeared, but were only
diff --git a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.43.ebuild b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.43.ebuild
index 40132d2da1..d8d9cd7bdd 100644
--- a/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.43.ebuild
+++ b/sdk_container/src/third_party/portage-stable/media-libs/libpng/libpng-1.6.43.ebuild
@@ -19,7 +19,7 @@ SRC_URI="
 
 LICENSE="libpng2"
 SLOT="0/16"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="apng cpu_flags_arm_neon cpu_flags_x86_sse static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
index 265575fbda..1ac95af896 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/Manifest
@@ -4,3 +4,5 @@ DIST c-ares-1.26.0.tar.gz 1298394 BLAKE2B 9bcbb321b31518fdd3481447e1bba733dbf0ea
 DIST c-ares-1.26.0.tar.gz.asc 488 BLAKE2B 89c420ed235dce86c3d18ce62b58f50b78abf919c178e9a786fce5ee11da2b7a1314f8eb76bef20df0e43d18f636508540d9a9d2dfcd84df0c62691497f3a9a0 SHA512 84cd9918c22346a975400f17bf64e5093aa7b2d8f3377799cde5f6ab508e8f5ab6a004497747b702b7249b2b1369cdd22149519da01a405cf928806007e7a599
 DIST c-ares-1.27.0.tar.gz 1301440 BLAKE2B 112bf16288efc3ca1c69216de6bb42fdfc5348e70879321fb27f9602a8f469a21fa502a1cdd2f935e4ad0505ea7e22bd3a3326ce83bdb2acbe5ff266fc11cc6f SHA512 d0bffeeabdc5f1d4cececd46bd495b8224a64eaaf6d2a91c5475517440effe0e096146a1ebf19ece07367198be576c61b11961d5e4c3f601c5c5529ce4fcb46a
 DIST c-ares-1.27.0.tar.gz.asc 488 BLAKE2B 64798140a1d61e32ba45467034d9da75abd8f48810643947c94b04dcaae1b8c68da7a6d9acb7476808601acfe6a527b2cd855d99912f5ac069a597b9c9c890e3 SHA512 dbaa2e96035283e55c7a3c940255d9cc81d98961f59a10586cd666525a0fddf0e3ada01fd79133a278159f47c344bce70bcc4ad1b5df5c853273941b744357e4
+DIST c-ares-1.28.1.tar.gz 1312102 BLAKE2B 2d0f12aeb4b947f76fe6c45e2bb0a7401c5d3ae5c84a94f2387f05b639587275e12cb0a2798caa381726e37757973b28c543249f9528b60746b8bf543a70be77 SHA512 9a24f40002b661d97c9b49a617d2e6b12bad1c9f22e872611252d051ec650f886c010207939fac6992610b3cd5a87588f802d7dfa1310ced7c6621ea2f99dd90
+DIST c-ares-1.28.1.tar.gz.asc 488 BLAKE2B 90f3aedc3b56f31519a9b2746e528bb952364748b6053ecebaa3edf4269aab6b3badad459a14e8afe623340b294fd072b13c60af540eb59d7f4d82eb5204be83 SHA512 62659e3c41ea7158c7fdaab3246fee6a6a1502dec12d322efd353e5a0fb1b0aa4c1caf7ace37e1d3ea0b2937522814fdf66af2d19a501e9b9995b86e2369410d
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.26.0.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.26.0.ebuild
index 1381b08f29..fd6862db05 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.26.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.26.0.ebuild
@@ -17,7 +17,7 @@ SRC_URI="
 LICENSE="MIT ISC"
 # Subslot = SONAME of libcares.so.2
 SLOT="0/2"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.28.1.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.28.1.ebuild
new file mode 100644
index 0000000000..f066b76c4e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-dns/c-ares/c-ares-1.28.1.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/danielstenberg.asc
+inherit edo multilib-minimal verify-sig
+
+DESCRIPTION="C library that resolves names asynchronously"
+HOMEPAGE="https://c-ares.org/"
+SRC_URI="
+	https://c-ares.org/download/${P}.tar.gz
+	verify-sig? ( https://c-ares.org/download/${P}.tar.gz.asc )
+"
+
+# ISC for lib/{bitncmp.c,inet_ntop.c,inet_net_pton.c} (bug #912405)
+LICENSE="MIT ISC"
+# Subslot = SONAME of libcares.so.2
+SLOT="0/2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="static-libs test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	test? ( dev-cpp/gtest )
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
+
+DOCS=( AUTHORS CHANGES NEWS README.md RELEASE-NOTES.md TODO )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ares_build.h
+)
+
+A__QA_CONFIG_IMPL_DECL_SKIP=(
+	# Checking for obsolete headers
+	malloc
+	calloc
+	free
+
+	# Non-existent on Linux
+	closesocket
+	CloseSocket
+	ioctlsocket
+	bitncmp
+	ConvertInterfaceIndexToLuid
+	ConvertInterfaceLuidToNameA
+)
+
+multilib_src_configure() {
+	local myeconfargs=(
+		--enable-symbol-hiding
+		$(use_enable static-libs static)
+		$(use_enable test tests)
+	)
+
+	# Needed for running unit tests only
+	# Violates sandbox and tests pass fine without
+	export ax_cv_uts_namespace=no
+	export ax_cv_user_namespace=no
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+multilib_src_test() {
+	cd "${BUILD_DIR}"/test || die
+
+	# We're skipping the "real" network tests with the filter
+	# see https://github.com/c-ares/c-ares/tree/main/test
+	local network_tests=(
+		# Most live tests have Live in the name
+		*Live*
+		# These don't but are still in ares-test-live.cc => live
+		*GetTCPSock*
+		*TimeoutValue*
+		*GetSock*
+		*GetSock_virtualized*
+		*VerifySocketFunctionCallback*
+		# Seems flaky, even run manually
+		# https://github.com/c-ares/c-ares/commit/9e542a8839f81c990bb0dff14beeaf9aa6bcc18d
+		*MockUDPMaxQueriesTest.GetHostByNameParallelLookups*
+	)
+
+	# The format for disabling test1, test2, and test3 looks like:
+	# -test1:test2:test3
+	edo ./arestest --gtest_filter=-$(echo $(IFS=:; echo "${network_tests[*]}"))
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r5 b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r5
deleted file mode 100644
index 0c73cec68c..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/files/ipset.initd-r5
+++ /dev/null
@@ -1,105 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2013 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-extra_commands="save"
-extra_started_commands="reload"
-
-IPSET_SAVE=${IPSET_SAVE:-/var/lib/ipset/rules-save}
-
-depend() {
-    before iptables ip6tables
-}
-
-checkconfig() {
-    if [ ! -f "${IPSET_SAVE}" ] ; then
-        eerror "Not starting ${SVCNAME}. First create some rules then run:"
-        eerror "/etc/init.d/${SVCNAME} save"
-        return 1
-    fi
-    return 0
-}
-
-start() {
-    checkconfig || return 1
-    ebegin "Loading ipset session"
-    ipset restore < "${IPSET_SAVE}"
-    eend $?
-}
-
-stop() {
-    # check if there are any references to current sets
-
-    if ! ipset list | gawk '
-        ($1 == "References:") { refcnt += $2 }
-        ($1 == "Type:" && $2 == "list:set") { set = 1 }
-        (scan) { if ($0 != "") setcnt++; else { scan = 0; set = 0 } }
-        (set && $1 == "Members:") {scan = 1}
-        END { if ((refcnt - setcnt) > 0) exit 1 }
-    '; then
-        eerror "ipset is in use, can't stop"
-        return 1
-    fi
-
-    if [ "${SAVE_ON_STOP}" = "yes" ] ; then
-        save || return 1
-    fi
-
-    ebegin "Removing kernel IP sets"
-    ipset flush
-    ipset destroy
-    eend $?
-}
-
-reload() {
-    ebegin "Reloading ipsets"
-
-    # Loading sets from a save file is only additive (there is no
-    # automatic flushing or replacing). And, we can not remove sets
-    # that are currently used in existing iptables rules.
-    #
-    # Instead, we create new temp sets for any set that is already
-    # in use, and then atomically swap them into place.
-    #
-    # XXX: This does not clean out previously used ipsets that are
-    # not in the new saved policy--it can't, because they may still
-    # be referenced in the current iptables rules.
-    
-
-    # Build a list of all currently used sets (if any).
-    running_ipset_list=$(ipset save | gawk '/^create/{printf "%s ",$2}')
-	running_ipset_list="${running_ipset_list% }"
-
-    # Check the configured suffix, and make sure there are no collisions
-    if test -z "${TEMP_SUFFIX}" ; then
-      eend 1 "TEMP_SUFFIX cannot be empty"
-      return 1
-    elif echo "$running_ipset_list" | grep -q -E "${TEMP_SUFFIX}( |$)" ; then
-      eend 1 "Existing set(s) match TEMP_SUFFIX pattern ('${TEMP_SUFFIX}'), cannot continue"
-      return 1
-    fi
-
-    # Build a regular expression that matches those set names.
-    running_ipset_list_regex="$(echo "$running_ipset_list" | tr -s ' ' '|' )"
-
-    # Load up sets from the save file, but rename any set that already
-    # exists to a temporary name that we will swap later.
-    if ! cat ${IPSET_SAVE} | sed -r "s/^(create|add) (${running_ipset_list_regex}) /\1 \2${TEMP_SUFFIX} /" | ipset restore ; then
-        eend $? "Failed to load new ipsets"
-    fi
-
-    # Now for every set name that currently exists, atomically swap it
-    # with the temporary new one we created, and then destroy the old set.
-    for ipset_name in ${running_ipset_list} ; do
-        ipset swap ${ipset_name} ${ipset_name}${TEMP_SUFFIX} || eend $? "Failed to swap in new ipset $ipset_name"
-        ipset destroy ${ipset_name}${TEMP_SUFFIX} || eend $? "Failed to delete obsolete ipset ${ipset_name}${TEMP_SUFFIX}"
-    done
-    eend 0
-}
-
-save() {
-    ebegin "Saving ipset session"
-    checkpath --file --mode 0600 "${IPSET_SAVE}"
-    ipset save > "${IPSET_SAVE}"
-    eend $?
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/Manifest b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/Manifest
index e5ae19ed07..16707337f4 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/Manifest
@@ -1,2 +1 @@
-DIST cifs-utils-6.15.tar.bz2 416592 BLAKE2B 8af926bf255c5b3a66bf52ccca99632aacb9ed1c83ad7db5543b32df2f3bcd4be9a9cd17b744ec115d1568d07084e2bd2d03849aa9ab97cff2862f39bcf137b8 SHA512 eedb8066563db584595a8ba7cb7a603e6b763ac2c1261430d605c327fcc5a831acd48b58ea55dd243af778dfdc827ab8c6daf4015764ff550dcffc2182773510
 DIST cifs-utils-7.0.tar.bz2 418638 BLAKE2B 514d35f243d0ef7b866068a9a53a4b1704d2856d491d56aa469e8e3919b4030cb920a7f60d08851b0a23d28a020d1ddf7daa8b9ac412f1567a0a60d2f6ee6774 SHA512 4c57741af0c4567a78f352c73caca998881666a5ed36536275cfa775efd66ff1a44ebe539a8ed96c409c5b08a1378266964ce667a27e9fc7f2d43999c63dd0eb
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15-r1.ebuild
deleted file mode 100644
index 469484d3db..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-6.15-r1.ebuild
+++ /dev/null
@@ -1,145 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit autotools bash-completion-r1 flag-o-matic linux-info pam python-single-r1
-
-DESCRIPTION="Tools for Managing Linux CIFS Client Filesystems"
-HOMEPAGE="https://wiki.samba.org/index.php/LinuxCIFS_utils https://git.samba.org/cifs-utils.git/?p=cifs-utils.git"
-SRC_URI="https://ftp.samba.org/pub/linux-cifs/${PN}/${P}.tar.bz2"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux"
-IUSE="+acl +ads +caps creds pam +python systemd"
-
-RDEPEND="
-	ads? (
-		sys-apps/keyutils:=
-		sys-libs/talloc
-		virtual/krb5
-	)
-	caps? ( sys-libs/libcap-ng )
-	creds? ( sys-apps/keyutils:= )
-	pam? (
-		sys-apps/keyutils:=
-		sys-libs/pam
-	)
-	python? ( ${PYTHON_DEPS} )
-"
-DEPEND="${RDEPEND}"
-BDEPEND="dev-python/docutils"
-PDEPEND="
-	acl? ( >=net-fs/samba-4.0.0_alpha1 )
-"
-
-REQUIRED_USE="
-	acl? ( ads )
-	python? ( ${PYTHON_REQUIRED_USE} )
-"
-
-DOCS="doc/linux-cifs-client-guide.odt"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-6.12-ln_in_destdir.patch" #766594
-	"${FILESDIR}/${PN}-6.15-musl.patch"
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-
-	if ! linux_config_exists || ! linux_chkconfig_present CIFS; then
-		ewarn "You must enable CIFS support in your kernel config, "
-		ewarn "to be able to mount samba shares. You can find it at"
-		ewarn
-		ewarn "  File systems"
-		ewarn "	Network File Systems"
-		ewarn "			CIFS support"
-		ewarn
-		ewarn "and recompile your kernel ..."
-	fi
-
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	if has_version app-crypt/heimdal ; then
-		# https://bugs.gentoo.org/612584
-		eapply "${FILESDIR}/${PN}-6.7-heimdal.patch"
-	fi
-
-	eautoreconf
-}
-
-src_configure() {
-	# bug #927809
-	filter-flags -fno-semantic-interposition
-
-	local myeconfargs=(
-		--enable-man
-		--enable-smbinfo
-		$(use_enable acl cifsacl cifsidmap)
-		$(use_enable ads cifsupcall)
-		$(use_with caps libcap)
-		$(use_enable creds cifscreds)
-		$(use_enable pam)
-		$(use_with pam pamdir $(getpam_mod_dir))
-		$(use_enable python pythontools)
-		# mount.cifs can get passwords from systemd
-		$(use_enable systemd)
-	)
-	ROOTSBINDIR="${EPREFIX}"/sbin \
-	econf "${myeconfargs[@]}"
-}
-
-src_install() {
-	default
-
-	# remove empty directories
-	find "${ED}" -type d -empty -delete || die
-
-	if use acl ; then
-		dodir /etc/cifs-utils
-		dosym ../../usr/$(get_libdir)/cifs-utils/idmapwb.so \
-			/etc/cifs-utils/idmap-plugin
-		dodir /etc/request-key.d
-		echo 'create cifs.idmap * * /usr/sbin/cifs.idmap %k' \
-			> "${ED}/etc/request-key.d/cifs.idmap.conf"
-	fi
-
-	if use ads ; then
-		dodir /etc/request-key.d
-		echo 'create dns_resolver * * /usr/sbin/cifs.upcall %k' \
-			> "${ED}/etc/request-key.d/cifs.upcall.conf"
-		echo 'create cifs.spnego * * /usr/sbin/cifs.upcall %k' \
-			> "${ED}/etc/request-key.d/cifs.spnego.conf"
-	fi
-
-	dobashcomp bash-completion/smbinfo
-	use python && python_fix_shebang "${ED}"
-}
-
-pkg_postinst() {
-	# Inform about set-user-ID bit of mount.cifs
-	ewarn "setuid use flag was dropped due to multiple security implications"
-	ewarn "such as CVE-2009-2948, CVE-2011-3585 and CVE-2012-1586"
-	ewarn "You are free to set setuid flags by yourself"
-
-	# Inform about upcall usage
-	if use acl ; then
-		einfo "The cifs.idmap utility has been enabled by creating the"
-		einfo "configuration file /etc/request-key.d/cifs.idmap.conf"
-		einfo "This enables you to get and set CIFS acls."
-	fi
-
-	if use ads ; then
-		einfo "The cifs.upcall utility has been enabled by creating the"
-		einfo "configuration file /etc/request-key.d/cifs.upcall.conf"
-		einfo "This enables you to mount DFS shares."
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
index 8720d8f3a0..aa0f9fee76 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0-r1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{9..12} )
 
 inherit autotools bash-completion-r1 flag-o-matic linux-info pam python-single-r1
 
@@ -37,7 +37,6 @@ PDEPEND="
 "
 
 REQUIRED_USE="
-	acl? ( ads )
 	python? ( ${PYTHON_REQUIRED_USE} )
 "
 
diff --git a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0.ebuild b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0.ebuild
index 469484d3db..95cf49c098 100644
--- a/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-fs/cifs-utils/cifs-utils-7.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{9..12} )
 
 inherit autotools bash-completion-r1 flag-o-matic linux-info pam python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
index 87345ee3d0..9c87bccf88 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/Manifest
@@ -6,3 +6,5 @@ DIST gnutls-3.8.0.tar.xz 6378480 BLAKE2B 64784e9c0ac4dcab2c9e90d7d17d0bd8a002122
 DIST gnutls-3.8.0.tar.xz.sig 684 BLAKE2B c5dbed12b8233ed8502dac16b77d6043591296f4b9ddb0445271e8fe875c2a05b9663ad6523cca6355faaa9d244cc6e6fb8ff0d65fee47b36ab6b57f57d89f64 SHA512 9db8db74aa0ebd871287b07b6a8a9f4ce90188633618e669fe07cb8bb314b624c14761f6fe1970e2fbffa87f7c0d6daa4b0fa838bd05f74b8b18cd1b5325c654
 DIST gnutls-3.8.3.tar.xz 6463720 BLAKE2B 27a4bb4d8a5697e2187113351b2ad1e849bca7bcfb556c1b54fc2d02bef16e2789e7c437ac8db8fe6d2bcfc0e3e3467bbff2dd5d2fc0adb9bf8bda81cb89e452 SHA512 74eddba01ce4c2ffdca781c85db3bb52c85f1db3c09813ee2b8ceea0608f92ca3912fd9266f55deb36a8ba4d01802895ca5d5d219e7d9caec45e1a8534e45a84
 DIST gnutls-3.8.3.tar.xz.sig 580 BLAKE2B 25875eb17d9e59bf1f1b6a61dfc7657d838ac154dbb3e26c8df1995884077878ca607de62a8ce3b9287df1ea7ff523c0abc7c4548f1ca789c308eb6bda0edbaa SHA512 5b2ca0648ca5feeda1de933de2bbaf71fadb70e830a8f0d494d2f0380b6d0d7b79445257cc79e59bba1a7ff639ab4573da3e3e124eb80c20ac6141e29a4827ff
+DIST gnutls-3.8.5.tar.xz 6491504 BLAKE2B 30ea0e213b426df896af7cddfc39a7c50fd3130f99ced8386dc55e851122a37f6171722d2cb4abb68b9d2523cd3ba044b01248d740571a3bdd0cadf555894cdf SHA512 4bac1aa7ec1dce9b3445cc515cc287a5af032d34c207399aa9722e3dc53ed652f8a57cfbc9c5e40ccc4a2631245d89ab676e3ba2be9563f60ba855aaacb8e23c
+DIST gnutls-3.8.5.tar.xz.sig 119 BLAKE2B 62ff7b33fb80422774f8252f574560679b7dc4fa56fa680a4cf570320fa9692aa6f8b6a7e4683a684572287cfd22168f58679d2dc4cc507dc50269ed126990fd SHA512 b0f7a8ec348765112cac75fd732e066adaa1595bb83024cfeff6633aba35277d8aceda145c733c3d95f1e0eb4d34fead2479abdb08d6041362094a235460fa67
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.8.1-fix-gnutls-header.patch b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.8.1-fix-gnutls-header.patch
deleted file mode 100644
index b3d10c1788..0000000000
--- a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/files/gnutls-3.8.1-fix-gnutls-header.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-https://bugs.gentoo.org/911872
-https://gitlab.com/gnutls/gnutls/-/commit/abfa8634db940115a11a07596ce53c8f9c4f87d2
-
-From abfa8634db940115a11a07596ce53c8f9c4f87d2 Mon Sep 17 00:00:00 2001
-From: Adrian Bunk <bunk@debian.org>
-Date: Sun, 6 Aug 2023 22:46:22 +0300
-Subject: [PATCH] Move the GNUTLS_NO_EXTENSIONS compatibility #define to
- gnutls.h
-
-Signed-off-by: Adrian Bunk <bunk@debian.org>
---- a/lib/ext/ext_master_secret.h
-+++ b/lib/ext/ext_master_secret.h
-@@ -23,9 +23,6 @@
- #ifndef GNUTLS_LIB_EXT_EXT_MASTER_SECRET_H
- #define GNUTLS_LIB_EXT_EXT_MASTER_SECRET_H
- 
--/* Keep backward compatibility */
--#define GNUTLS_NO_EXTENSIONS GNUTLS_NO_DEFAULT_EXTENSIONS
--
- #include <hello_ext.h>
- 
- extern const hello_ext_entry_st ext_mod_ext_master_secret;
---- a/lib/includes/gnutls/gnutls.h.in
-+++ b/lib/includes/gnutls/gnutls.h.in
-@@ -542,6 +542,9 @@ typedef enum {
- #define GNUTLS_ENABLE_CERT_TYPE_NEG 0
- // Here for compatibility reasons
- 
-+/* Keep backward compatibility */
-+#define GNUTLS_NO_EXTENSIONS GNUTLS_NO_DEFAULT_EXTENSIONS
-+
- /**
-  * gnutls_alert_level_t:
-  * @GNUTLS_AL_WARNING: Alert of warning severity.
---- a/lib/state.h
-+++ b/lib/state.h
-@@ -110,7 +110,4 @@ inline static int _gnutls_PRF(gnutls_session_t session, const uint8_t *secret,
- 
- #define DEFAULT_CERT_TYPE GNUTLS_CRT_X509
- 
--/* Keep backward compatibility */
--#define GNUTLS_NO_EXTENSIONS GNUTLS_NO_DEFAULT_EXTENSIONS
--
- #endif /* GNUTLS_LIB_STATE_H */
--- 
-GitLab
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.5.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.5.ebuild
new file mode 100644
index 0000000000..19002c1972
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-libs/gnutls/gnutls-3.8.5.ebuild
@@ -0,0 +1,149 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnutls.asc
+inherit libtool multilib-minimal verify-sig
+
+DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
+HOMEPAGE="https://www.gnutls.org/"
+SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3 LGPL-2.1+"
+# As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
+# component for it until libgnutls.so breaks ABI, to avoid pointless rebuilds.
+# Subslot format:
+# <libgnutls.so number>.<libgnutlsxx.so number>
+SLOT="0/30.30"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
+REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
+	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
+	>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
+	>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
+	brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
+	dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
+	nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
+	pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] )
+	idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] )
+	zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
+	zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		seccomp? ( sys-libs/libseccomp )
+	)
+"
+BDEPEND="
+	dev-build/gtk-doc-am
+	>=virtual/pkgconfig-0-r1
+	doc? ( dev-util/gtk-doc )
+	nls? ( sys-devel/gettext )
+	test-full? (
+		app-crypt/dieharder
+		|| ( sys-libs/libfaketime >=app-misc/datefudge-1.22 )
+		dev-libs/softhsm:2[-bindist(-)]
+		net-dialup/ppp
+		net-misc/socat
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20240415 )
+"
+
+DOCS=( README.md doc/certtool.cfg )
+
+HTML_DOCS=()
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs
+	MIN
+	alignof
+	static_assert
+)
+
+src_prepare() {
+	default
+
+	# bug #520818
+	export TZ=UTC
+
+	use doc && HTML_DOCS+=( doc/gnutls.html )
+
+	# don't try to use system certificate store on macOS, it is
+	# confusingly ignoring our ca-certificates and more importantly
+	# fails to compile in certain configurations
+	sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die
+
+	# Use sane .so versioning on FreeBSD.
+	elibtoolize
+}
+
+multilib_src_configure() {
+	LINGUAS="${LINGUAS//en/en@boldquot en@quot}"
+
+	local libconf=()
+
+	# TPM needs to be tested before being enabled
+	# Note that this may add a libltdl dep when enabled. Check configure.ac.
+	libconf+=(
+		--without-tpm
+		--without-tpm2
+	)
+
+	# hardware-accel is disabled on OSX because the asm files force
+	#   GNU-stack (as doesn't support that) and when that's removed ld
+	#   complains about duplicate symbols
+	[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
+
+	# -fanalyzer substantially slows down the build and isn't useful for
+	# us. It's useful for upstream as it's static analysis, but it's not
+	# useful when just getting something built.
+	export gl_cv_warn_c__fanalyzer=no
+
+	local myeconfargs=(
+		--disable-valgrind-tests
+		$(multilib_native_enable manpages)
+		$(multilib_native_use_enable doc gtk-doc)
+		$(multilib_native_use_enable doc)
+		$(multilib_native_use_enable seccomp seccomp-tests)
+		$(multilib_native_use_enable test tests)
+		$(multilib_native_use_enable test-full full-test-suite)
+		$(multilib_native_use_enable tools)
+		$(use_enable cxx)
+		$(use_enable dane libdane)
+		$(use_enable nls)
+		$(use_enable openssl openssl-compatibility)
+		$(use_enable sslv2 ssl2-support)
+		$(use_enable sslv3 ssl3-support)
+		$(use_enable static-libs static)
+		$(use_enable tls-heartbeat heartbeat-support)
+		$(use_with brotli)
+		$(use_with idn)
+		$(use_with pkcs11 p11-kit)
+		$(use_with zlib)
+		$(use_with zstd)
+		--disable-rpath
+		--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
+		--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+		--without-included-libtasn1
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use examples; then
+		docinto examples
+		dodoc doc/examples/*.c
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild
index 1f34a56472..52f59946de 100644
--- a/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-libs/libnftnl/libnftnl-1.2.6-r1.ebuild
@@ -17,7 +17,7 @@ else
 		https://netfilter.org/projects/${PN}/files/${P}.tar.xz
 		verify-sig? ( https://netfilter.org/projects/${PN}/files/${P}.tar.xz.sig )
 	"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 	BDEPEND+="verify-sig? ( sec-keys/openpgp-keys-netfilter )"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.7.1-r3.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.7.1-r3.ebuild
new file mode 100644
index 0000000000..f32362f424
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.7.1-r3.ebuild
@@ -0,0 +1,368 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/danielstenberg.asc
+inherit autotools multilib-minimal multiprocessing prefix toolchain-funcs verify-sig
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.se/"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/curl/curl.git"
+else
+	SRC_URI="
+		https://curl.se/download/${P}.tar.xz
+		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="BSD curl ISC test? ( BSD-4 )"
+SLOT="0"
+IUSE="+adns +alt-svc brotli +ftp gnutls gopher +hsts +http2 idn +imap kerberos ldap mbedtls nghttp3 +openssl +pop3"
+IUSE+=" +psl +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
+# These select the default SSL implementation
+IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
+RESTRICT="!test? ( test )"
+
+# Only one default ssl provider can be enabled
+# The default ssl provider needs its USE satisfied
+# nghttp3 = https://bugs.gentoo.org/912029
+REQUIRED_USE="
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_mbedtls
+			curl_ssl_openssl
+			curl_ssl_rustls
+		)
+	)
+	curl_ssl_gnutls? ( gnutls )
+	curl_ssl_mbedtls? ( mbedtls )
+	curl_ssl_openssl? ( openssl )
+	curl_ssl_rustls? ( rustls )
+	nghttp3? (
+		!openssl
+		alt-svc )
+"
+
+# cURL's docs and CI/CD are great resources for confirming supported versions
+# particulary for fast-moving targets like HTTP/2 and TCP/2 e.g.:
+# - https://github.com/curl/curl/blob/master/docs/INTERNALS.md (core dependencies + minimum versions)
+# - https://github.com/curl/curl/blob/master/docs/HTTP3.md (example of a feature that moves quickly)
+# - https://github.com/curl/curl/blob/master/.github/workflows/quiche-linux.yml (CI/CD for TCP/2)
+# However 'supported' vs 'works' are two entirely different things; be sane but
+# don't be afraid to require a later version.
+
+RDEPEND="
+	>=sys-libs/zlib-1.1.4[${MULTILIB_USEDEP}]
+	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	http2? ( >=net-libs/nghttp2-1.12.0:=[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	ldap? ( >=net-nds/openldap-2.0.0:=[static-libs?,${MULTILIB_USEDEP}] )
+	nghttp3? (
+		>=net-libs/nghttp3-0.15.0[${MULTILIB_USEDEP}]
+		>=net-libs/ngtcp2-0.19.1[gnutls,ssl,-openssl,${MULTILIB_USEDEP}]
+	)
+	psl? ( net-libs/libpsl[${MULTILIB_USEDEP}] )
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( >=net-libs/libssh2-1.0.0[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			app-misc/ca-certificates
+			>=net-libs/gnutls-3.1.10:=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:=[${MULTILIB_USEDEP}]
+		)
+		mbedtls? (
+			app-misc/ca-certificates
+			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
+		)
+		openssl? (
+			>=dev-libs/openssl-0.9.7:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+		)
+		rustls? ( >=net-libs/rustls-ffi-0.12.1:=[${MULTILIB_USEDEP}]
+			<net-libs/rustls-ffi-0.13.0:=[${MULTILIB_USEDEP}]
+		)
+	)
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
+		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
+
+DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	__builtin_available
+	closesocket
+	CloseSocket
+	getpass_r
+	ioctlsocket
+	IoctlSocket
+	mach_absolute_time
+	setmode
+	_fseeki64
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-prefix.patch
+	"${FILESDIR}"/${PN}-respect-cflags-3.patch
+	"${FILESDIR}"/${PN}-8.7.1-rustls-fixes.patch
+	"${FILESDIR}"/${P}-chunked-post.patch
+	"${FILESDIR}"/${P}-fix-compress-option.patch
+)
+
+src_prepare() {
+	default
+
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	if use ssl; then
+		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
+
+		if use gnutls; then
+			multilib_is_native_abi && einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls )
+		fi
+		if use mbedtls; then
+			multilib_is_native_abi && einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use openssl; then
+			multilib_is_native_abi && einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use rustls; then
+			multilib_is_native_abi && einfo "SSL provided by rustls"
+			myconf+=( --with-rustls )
+		fi
+		if use curl_ssl_gnutls; then
+			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_mbedtls; then
+			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_openssl; then
+			multilib_is_native_abi && einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_rustls; then
+			multilib_is_native_abi && einfo "Default SSL provided by rustls"
+			myconf+=( --with-default-ssl-backend=rustls )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+		fi
+
+	else
+		myconf+=( --without-ssl )
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	myconf+=(
+		$(use_enable alt-svc)
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-digest-auth
+		--enable-kerberos-auth
+		--enable-negotiate-auth
+		--enable-aws
+		--enable-dict
+		--disable-ech
+		--enable-file
+		$(use_enable ftp)
+		$(use_enable gopher)
+		$(use_enable hsts)
+		--enable-http
+		$(use_enable imap)
+		$(use_enable ldap)
+		$(use_enable ldap ldaps)
+		--enable-ntlm
+		--disable-ntlm-wb
+		$(use_enable pop3)
+		--enable-rt
+		--enable-rtsp
+		$(use_enable samba smb)
+		$(use_with ssh libssh2)
+		$(use_enable smtp)
+		$(use_enable telnet)
+		$(use_enable tftp)
+		--enable-tls-srp
+		$(use_enable adns ares)
+		--enable-cookies
+		--enable-dateparse
+		--enable-dnsshuffle
+		--enable-doh
+		--enable-symbol-hiding
+		--enable-http-auth
+		--enable-ipv6
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-netrc
+		$(use_enable progress-meter)
+		--enable-proxy
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-pthreads
+		--enable-threaded-resolver
+		--disable-versioned-symbols
+		--without-amissl
+		--without-bearssl
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with http2 nghttp2)
+		--without-hyper
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		--without-libgsasl
+		$(use_with psl libpsl)
+		--without-msh3
+		$(use_with nghttp3)
+		$(use_with nghttp3 ngtcp2)
+		--without-quiche
+		$(use_with rtmp librtmp)
+		--without-schannel
+		--without-secure-transport
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
+		$(use_enable websockets)
+		--without-winidn
+		--without-wolfssl
+		--with-zlib
+		$(use_with zstd)
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+	)
+
+	if use test && multilib_is_native_abi && ( use http2 || use nghttp3 ); then
+		myconf+=(
+			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
+		)
+	fi
+
+	if [[ ${CHOST} == *mingw* ]] ; then
+		myconf+=(
+			--disable-pthreads
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# Avoid building the client (we just want libcurl for multilib)
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+	# Fix up the pkg-config file to be more robust.
+	# https://github.com/curl/curl/issues/864
+	local priv=() libs=()
+	# We always enable zlib.
+	libs+=( "-lz" )
+	priv+=( "zlib" )
+	if use http2; then
+		libs+=( "-lnghttp2" )
+		priv+=( "libnghttp2" )
+	fi
+	if use nghttp3; then
+		libs+=( "-lnghttp3" "-lngtcp2" )
+		priv+=( "libnghttp3" "libngtcp2" )
+	fi
+	if use ssl && use curl_ssl_openssl; then
+		libs+=( "-lssl" "-lcrypto" )
+		priv+=( "openssl" )
+	fi
+	grep -q Requires.private libcurl.pc && die "need to update ebuild"
+	libs=$(printf '|%s' "${libs[@]}")
+	sed -i -r \
+		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
+		libcurl.pc || die
+	echo "Requires.private: ${priv[*]}" >> libcurl.pc || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts
+	fi
+}
+
+# There is also a pytest harness that tests for bugs in some very specific
+# situations; we can rely on upstream for this rather than adding additional test deps.
+multilib_src_test() {
+	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
+	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
+	# -v: verbose
+	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
+	# -k: keep test files after completion
+	# -am: automake style TAP output
+	# -p: print logs if test fails
+	# Note: if needed, we can skip specific tests. See e.g. Fedora's packaging
+	# or just read https://github.com/curl/curl/tree/master/tests#run.
+	# Note: we don't run the testsuite for cross-compilation.
+	# Upstream recommend 7*nproc as a starting point for parallel tests, but
+	# this ends up breaking when nproc is huge (like -j80).
+	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
+	# as most gentoo users don't have an 'ip6-localhost'
+	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p -j$((2*$(makeopts_jobs))) !241 !1083"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts DESTDIR="${D}" install
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+	rm -rf "${ED}"/etc/ || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-chunked-post.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-chunked-post.patch
new file mode 100644
index 0000000000..9d1fef73d3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-chunked-post.patch
@@ -0,0 +1,57 @@
+https://github.com/curl/curl/commit/721941aadf4adf4f6aeb3f4c0ab489bb89610c36
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 1 Apr 2024 15:41:18 +0200
+Subject: [PATCH] http: with chunked POST forced, disable length check on read
+ callback
+
+- when an application forces HTTP/1.1 chunked transfer encoding
+  by setting the corresponding header and instructs curl to use
+  the CURLOPT_READFUNCTION, disregard any POST length information.
+- this establishes backward compatibility with previous curl versions
+
+Applications are encouraged to not force "chunked", but rather
+set length information for a POST. By setting -1, curl will
+auto-select chunked on HTTP/1.1 and work properly on other HTTP
+versions.
+
+Reported-by: Jeff King
+Fixes #13229
+Closes #13257
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -2046,8 +2046,19 @@ static CURLcode set_reader(struct Curl_easy *data, Curl_HttpReq httpreq)
+       else
+         result = Curl_creader_set_null(data);
+     }
+-    else { /* we read the bytes from the callback */
+-      result = Curl_creader_set_fread(data, postsize);
++    else {
++      /* we read the bytes from the callback. In case "chunked" encoding
++       * is forced by the application, we disregard `postsize`. This is
++       * a backward compatibility decision to earlier versions where
++       * chunking disregarded this. See issue #13229. */
++      bool chunked = FALSE;
++      char *ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
++      if(ptr) {
++        /* Some kind of TE is requested, check if 'chunked' is chosen */
++        chunked = Curl_compareheader(ptr, STRCONST("Transfer-Encoding:"),
++                                     STRCONST("chunked"));
++      }
++      result = Curl_creader_set_fread(data, chunked? -1 : postsize);
+     }
+     return result;
+ 
+@@ -2115,6 +2126,13 @@ CURLcode Curl_http_req_set_reader(struct Curl_easy *data,
+     data->req.upload_chunky =
+       Curl_compareheader(ptr,
+                          STRCONST("Transfer-Encoding:"), STRCONST("chunked"));
++    if(data->req.upload_chunky &&
++       Curl_use_http_1_1plus(data, data->conn) &&
++       (data->conn->httpversion >= 20)) {
++       infof(data, "suppressing chunked transfer encoding on connection "
++             "using HTTP version 2 or higher");
++       data->req.upload_chunky = FALSE;
++    }
+   }
+   else {
+     curl_off_t req_clen = Curl_creader_total_length(data);
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-fix-compress-option.patch b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-fix-compress-option.patch
new file mode 100644
index 0000000000..a06a537295
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/files/curl-8.7.1-fix-compress-option.patch
@@ -0,0 +1,153 @@
+https://github.com/curl/curl/commit/b30d694a027eb771c02a3db0dee0ca03ccab7377
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 28 Mar 2024 11:08:15 +0100
+Subject: [PATCH] content_encoding: brotli and others, pass through 0-length
+ writes
+
+- curl's transfer handling may write 0-length chunks at the end of the
+  download with an EOS flag. (HTTP/2 does this commonly)
+
+- content encoders need to pass-through such a write and not count this
+  as error in case they are finished decoding
+
+Fixes #13209
+Fixes #13212
+Closes #13219
+--- a/lib/content_encoding.c
++++ b/lib/content_encoding.c
+@@ -300,7 +300,7 @@ static CURLcode deflate_do_write(struct Curl_easy *data,
+   struct zlib_writer *zp = (struct zlib_writer *) writer;
+   z_stream *z = &zp->z;     /* zlib state structure */
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   /* Set the compressed input when this function is called */
+@@ -457,7 +457,7 @@ static CURLcode gzip_do_write(struct Curl_easy *data,
+   struct zlib_writer *zp = (struct zlib_writer *) writer;
+   z_stream *z = &zp->z;     /* zlib state structure */
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(zp->zlib_init == ZLIB_INIT_GZIP) {
+@@ -669,7 +669,7 @@ static CURLcode brotli_do_write(struct Curl_easy *data,
+   CURLcode result = CURLE_OK;
+   BrotliDecoderResult r = BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(!bp->br)
+@@ -762,7 +762,7 @@ static CURLcode zstd_do_write(struct Curl_easy *data,
+   ZSTD_outBuffer out;
+   size_t errorCode;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   if(!zp->decomp) {
+@@ -916,7 +916,7 @@ static CURLcode error_do_write(struct Curl_easy *data,
+   (void) buf;
+   (void) nbytes;
+ 
+-  if(!(type & CLIENTWRITE_BODY))
++  if(!(type & CLIENTWRITE_BODY) || !nbytes)
+     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
+ 
+   failf(data, "Unrecognized content encoding type. "
+--- a/tests/http/test_02_download.py
++++ b/tests/http/test_02_download.py
+@@ -394,6 +394,19 @@ def test_02_27_paused_no_cl(self, env: Env, httpd, nghttpx, repeat):
+         r = client.run(args=[url])
+         r.check_exit_code(0)
+ 
++    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
++    def test_02_28_get_compressed(self, env: Env, httpd, nghttpx, repeat, proto):
++        if proto == 'h3' and not env.have_h3():
++            pytest.skip("h3 not supported")
++        count = 1
++        urln = f'https://{env.authority_for(env.domain1brotli, proto)}/data-100k?[0-{count-1}]'
++        curl = CurlClient(env=env)
++        r = curl.http_download(urls=[urln], alpn_proto=proto, extra_args=[
++            '--compressed'
++        ])
++        r.check_exit_code(code=0)
++        r.check_response(count=count, http_status=200)
++
+     def check_downloads(self, client, srcfile: str, count: int,
+                         complete: bool = True):
+         for i in range(count):
+--- a/tests/http/testenv/env.py
++++ b/tests/http/testenv/env.py
+@@ -129,10 +129,11 @@ def __init__(self):
+         self.htdocs_dir = os.path.join(self.gen_dir, 'htdocs')
+         self.tld = 'http.curl.se'
+         self.domain1 = f"one.{self.tld}"
++        self.domain1brotli = f"brotli.one.{self.tld}"
+         self.domain2 = f"two.{self.tld}"
+         self.proxy_domain = f"proxy.{self.tld}"
+         self.cert_specs = [
+-            CertificateSpec(domains=[self.domain1, 'localhost'], key_type='rsa2048'),
++            CertificateSpec(domains=[self.domain1, self.domain1brotli, 'localhost'], key_type='rsa2048'),
+             CertificateSpec(domains=[self.domain2], key_type='rsa2048'),
+             CertificateSpec(domains=[self.proxy_domain, '127.0.0.1'], key_type='rsa2048'),
+             CertificateSpec(name="clientsX", sub_specs=[
+@@ -376,6 +377,10 @@ def htdocs_dir(self) -> str:
+     def domain1(self) -> str:
+         return self.CONFIG.domain1
+ 
++    @property
++    def domain1brotli(self) -> str:
++        return self.CONFIG.domain1brotli
++
+     @property
+     def domain2(self) -> str:
+         return self.CONFIG.domain2
+--- a/tests/http/testenv/httpd.py
++++ b/tests/http/testenv/httpd.py
+@@ -50,6 +50,7 @@ class Httpd:
+         'alias', 'env', 'filter', 'headers', 'mime', 'setenvif',
+         'socache_shmcb',
+         'rewrite', 'http2', 'ssl', 'proxy', 'proxy_http', 'proxy_connect',
++        'brotli',
+         'mpm_event',
+     ]
+     COMMON_MODULES_DIRS = [
+@@ -203,6 +204,7 @@ def _mkpath(self, path):
+ 
+     def _write_config(self):
+         domain1 = self.env.domain1
++        domain1brotli = self.env.domain1brotli
+         creds1 = self.env.get_credentials(domain1)
+         domain2 = self.env.domain2
+         creds2 = self.env.get_credentials(domain2)
+@@ -285,6 +287,24 @@ def _write_config(self):
+                 f'</VirtualHost>',
+                 f'',
+             ])
++            # Alternate to domain1 with BROTLI compression
++            conf.extend([  # https host for domain1, h1 + h2
++                f'<VirtualHost *:{self.env.https_port}>',
++                f'    ServerName {domain1brotli}',
++                f'    Protocols h2 http/1.1',
++                f'    SSLEngine on',
++                f'    SSLCertificateFile {creds1.cert_file}',
++                f'    SSLCertificateKeyFile {creds1.pkey_file}',
++                f'    DocumentRoot "{self._docs_dir}"',
++                f'    SetOutputFilter BROTLI_COMPRESS',
++            ])
++            conf.extend(self._curltest_conf(domain1))
++            if domain1 in self._extra_configs:
++                conf.extend(self._extra_configs[domain1])
++            conf.extend([
++                f'</VirtualHost>',
++                f'',
++            ])
+             conf.extend([  # https host for domain2, no h2
+                 f'<VirtualHost *:{self.env.https_port}>',
+                 f'    ServerName {domain2}',
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240117.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240117.ebuild
index c76cdaa9b4..30d11a82c6 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240117.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iputils/iputils-20240117.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == *9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/iputils/iputils/releases/download/${PV}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 DESCRIPTION="Network monitoring tools including ping and ping6"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
index 4c221b7908..677e1a06ba 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/Manifest
@@ -1,2 +1,4 @@
 DIST wget-1.21.4.tar.gz 5059591 BLAKE2B ced6fb9a20343d41e4d8e0c8f171c60535847504fa4c32abc81d104a1594dc7b7c97b5b301836e31dacc7a0f2155c0a2e70e42ff60dc3fa471deb1dad33ba736 SHA512 7a1539045174f6b97ab6980811c2ac1799edc20db72987b5ba9b1710cffb19669a7736813d15c8da3aa2d4a384246ff946b77ecb0baeb6fd3e12ae591f1bf6a3
 DIST wget-1.21.4.tar.gz.sig 854 BLAKE2B 162c4f358e781bbfb0fa73910191c29dd411f48c9b2c8e8fe00a12741153e624955393d769aa7311b03115d04b6b946a84b636f643d7cdc8c8cd81387b9cf143 SHA512 72603493c2d799dca08700175a2010d8736fd6d3cb9bea3987db8814e9f133ab0fbd1477892115f7fbbd1a7d4d416ec370bdbff6dbe8f00d1eea84f0c4f8d84b
+DIST wget-1.24.5.tar.gz 5182521 BLAKE2B d33274d599f91384c2a7db0b145ec6b315cf87cbbd02026d686a79220e3f15ca9ad0f9d8b507895f6c8486b7ac2ae5fa5c9ea010e883b6eec68d3aba038b02de SHA512 572aa54717e51a9eb9959e127c7afb696645088f32ff7df2cfe9d243957e34ee235e98988fa94649df023d2e3d62b6973e8c9f2eb92beba820dd96d5de2a950d
+DIST wget-1.24.5.tar.gz.sig 854 BLAKE2B 67c084cb8dcbe6184c58203afe11c7426be1f190a6073a68aa658f8480f7046786eb70e47fed4c45b86ea1fda0812a401f530dafd9be816d33d46d54b90223d2 SHA512 f819dc43a466682ace38e8537698e3c7c3919203f77373bdaea1b63ead40c4d3663590209dfeb6187d98edd00e30848a3abd5735795fb47878924f1d9b2ee10d
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/files/wget-1.24.5-libproxy-no-debug.patch b/sdk_container/src/third_party/portage-stable/net-misc/wget/files/wget-1.24.5-libproxy-no-debug.patch
new file mode 100644
index 0000000000..9f75dc471a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/files/wget-1.24.5-libproxy-no-debug.patch
@@ -0,0 +1,50 @@
+https://bugs.gentoo.org/930060
+https://gitlab.com/gnuwget/wget/-/issues/19
+https://gitlab.com/gnuwget/wget/-/merge_requests/39
+
+From 5f0aa59239c36fc945b94d8ab91562d56e5bf776 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Tue, 16 Apr 2024 03:18:40 +0100
+Subject: [PATCH] Fix libproxy build with --disable-debug
+
+The definition of debug_logprintf in src/log.c is guarded by ENABLE_DEBUG
+(although its prototype is unconditionally available in src/log.h).
+
+The uses of debug_logprintf in src/retr.c aren't guarded by ENABLE_DEBUG.
+
+Use the DEBUGP macro which is designed for this purpose.
+
+* src/retr.c (getproxy): Use DEBUGP macro.
+
+Fixes: https://gitlab.com/gnuwget/wget/-/issues/19
+Copyright-paperwork-exempt: Yes
+--- a/src/retr.c
++++ b/src/retr.c
+@@ -1498,21 +1498,21 @@ getproxy (struct url *u)
+       pxProxyFactory *pf = px_proxy_factory_new ();
+       if (!pf)
+         {
+-          debug_logprintf ("Allocating memory for libproxy failed");
++          DEBUGP (("Allocating memory for libproxy failed"));
+          return NULL;
+         }
+ 
+-      debug_logprintf ("asking libproxy about url '%s'\n", u->url);
++      DEBUGP (("asking libproxy about url '%s'\n", u->url));
+       char **proxies = px_proxy_factory_get_proxies (pf, u->url);
+       if (proxies)
+         {
+           if (proxies[0])
+             {
+-              debug_logprintf ("libproxy suggest to use '%s'\n", proxies[0]);
++              DEBUGP (("libproxy suggest to use '%s'\n", proxies[0]));
+               if (strcmp (proxies[0], "direct://") != 0)
+                 {
+                   proxy = xstrdup (proxies[0]);
+-                  debug_logprintf ("libproxy setting to use '%s'\n", proxy);
++                  DEBUGP (("libproxy setting to use '%s'\n", proxy));
+                 }
+             }
+ 
+-- 
+GitLab
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/metadata.xml b/sdk_container/src/third_party/portage-stable/net-misc/wget/metadata.xml
index 07aa81b0e8..bc5cb81f48 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/wget/metadata.xml
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/metadata.xml
@@ -7,6 +7,7 @@
 	</maintainer>
 	<use>
 		<flag name="cookie-check">Enable cookie checks via <pkg>net-libs/libpsl</pkg></flag>
+		<flag name="libproxy">Support for automatic proxy configuration management through <pkg>net-libs/libproxy</pkg>.</flag>
 		<flag name="metalink">Enable support for <pkg>media-libs/libmetalink</pkg></flag>
 		<flag name="ntlm">Enable support for NTLM (Windows-based) authorization</flag>
 		<flag name="uuid">Generate UUIDs for the WARC (Web ARChive file format) using libuuid; otherwise use a simple RNG (random number generator)</flag>
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.24.5.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.24.5.ebuild
new file mode 100644
index 0000000000..6626e1328e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/wget/wget-1.24.5.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/wget.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+DESCRIPTION="Network utility to retrieve files from the WWW"
+HOMEPAGE="https://www.gnu.org/software/wget/"
+SRC_URI="mirror://gnu/wget/${P}.tar.gz"
+SRC_URI+=" verify-sig? ( mirror://gnu/wget/${P}.tar.gz.sig )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="cookie-check debug gnutls idn ipv6 libproxy metalink nls ntlm pcre +ssl static test uuid zlib"
+REQUIRED_USE="ntlm? ( !gnutls ssl ) gnutls? ( ssl )"
+RESTRICT="!test? ( test )"
+
+# * Force a newer libidn2 to avoid libunistring deps. #bug #612498
+# * Metalink can use gpgme automagically (so let's always depend on it)
+# for signed metalink resources.
+LIB_DEPEND="
+	cookie-check? ( net-libs/libpsl )
+	idn? ( >=net-dns/libidn2-0.14:=[static-libs(+)] )
+	libproxy? ( net-libs/libproxy )
+	metalink? (
+		app-crypt/gpgme
+		media-libs/libmetalink
+	)
+	pcre? ( dev-libs/libpcre2[static-libs(+)] )
+	ssl? (
+		gnutls? ( net-libs/gnutls:=[static-libs(+)] )
+		!gnutls? ( dev-libs/openssl:=[static-libs(+)] )
+	)
+	uuid? ( sys-apps/util-linux[static-libs(+)] )
+	zlib? ( sys-libs/zlib[static-libs(+)] )
+"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	sys-apps/texinfo
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+	test? (
+		${PYTHON_DEPS}
+		>=dev-perl/HTTP-Daemon-6.60.0
+		dev-perl/HTTP-Message
+		dev-perl/IO-Socket-SSL
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-wget-20240415 )
+"
+
+DOCS=( AUTHORS MAILING-LIST NEWS README )
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN alignof static_assert )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.24.5-libproxy-no-debug.patch
+)
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+	sed -i -e "s:/usr/local/etc:${EPREFIX}/etc:g" doc/{sample.wgetrc,wget.texi} || die
+}
+
+src_configure() {
+	# fix compilation on Solaris, we need filio.h for FIONBIO as used in
+	# the included gnutls -- force ioctl.h to include this header
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -DBSD_COMP=1
+
+	if use static ; then
+		append-ldflags -static
+		tc-export PKG_CONFIG
+		PKG_CONFIG+=" --static"
+	fi
+
+	# There is no flag that controls this.  libunistring-prefix only
+	# controls the search path (which is why we turn it off below).
+	# Further, libunistring is only needed w/older libidn2 installs,
+	# and since we force the latest, we can force off libunistring. # bug #612498
+	local myeconfargs=(
+		ac_cv_libunistring=no
+		--disable-assert
+		--disable-pcre
+		--disable-rpath
+		--without-included-libunistring
+		--without-libunistring-prefix
+		$(use_enable debug)
+		$(use_enable idn iri)
+		$(use_enable ipv6)
+		$(use_enable nls)
+		$(use_enable ntlm)
+		$(use_enable pcre pcre2)
+		$(use_enable ssl digest)
+		$(use_enable ssl opie)
+		$(use_with cookie-check libpsl)
+		$(use_enable idn iri)
+		$(use_enable libproxy)
+		$(use_with metalink)
+		$(use_with ssl ssl $(usex gnutls gnutls openssl))
+		$(use_with uuid libuuid)
+		$(use_with zlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index 3b6df5e08a..a3a882bc12 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -390,11 +390,6 @@ net-libs/gnutls test-full
 # libilbc has not been ported to alpha and likely never will be.
 media-video/ffmpeg libilbc
 
-# Tobias Klausmann <klausman@gentoo.org> (2017-03-02)
-# BSON requires pymongo and assorted other packages that are not available on
-# alpha.
-app-portage/g-sorcery bson
-
 # Tobias Klausmann <klausman@gentoo.org> (2016-01-25)
 # The tests use hypothesis which complains about too-slow tests on
 # hardware that is "too slow".
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index b50df1912e..101301028d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,14 @@
 
 #--- END OF EXAMPLES ---
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-20)
+# only keyworded for amd64 currently
+media-gfx/blender -gnome
+
+# Ionen Wolkens <ionen@gentoo.org> (2024-04-16)
+# dev-qt/qtlanguageserver:6 is keyworded here
+dev-qt/qtdeclarative:6 -qmlls
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-17)
 # virt-firmware is keyworded here
 sys-kernel/installkernel -efistub
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index 233f448771..6309d1e2f7 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -17,6 +17,11 @@
 
 #--- END OF EXAMPLES ---
 
+# Ionen Wolkens <ionen@gentoo.org> (2024-04-16)
+# Temporary mask to give a little bit of time before stabilizing
+# the just added dev-qt/qtlanguageserver-6.7.0 for amd64
+dev-qt/qtdeclarative:6 qmlls
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-17)
 # Experimental, virt-firmware is keyworded only unstable
 sys-kernel/installkernel efistub
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index ebc94c196b..8049967550 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -amd64
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-14)
+# media-libs/quirc is keyworded on amd64
+-quirc
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2024-03-28)
 # dev-libs/optix works on amd64
 -optix
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
index ee3f8e2db1..0f64711a55 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.mask
@@ -39,7 +39,6 @@ dev-python/plotly
 dev-python/plotly-geo
 dev-python/chart-studio
 sci-visualization/dash
-sci-visualization/jupyter-dash
 >=dev-python/notebook-7
 dev-python/spyder-notebook
 app-emacs/emacs-ipython-notebook
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index 1f4b5d9ba9..1a7446c4fe 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -370,10 +370,6 @@ media-video/ffmpeg -mmal
 media-video/ffmpeg-chromium -mmal
 media-video/mpv -mmal
 
-# Markus Meier <maekke@gentoo.org> (2015-10-10)
-# unkeyworded deps, bug #552330
-app-portage/g-sorcery bson
-
 # Alexis Ballier <aballier@gentoo.org> (2015-04-02)
 # Needs ilmbase (openexr), which does not build and is masked on arm.
 media-libs/freeimage tiff
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
index 2f70b36b7b..a0427c5c55 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.force
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-12)
+# supports 64 bit neon
+media-libs/opencv cpu_flags_arm_neon
+
 # Matt Jolly <kangie@gentoo.org> (2024-01-30)
 # Google does not provide an arm64 toolchain
 www-client/chromium system-toolchain
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index c95fe6418e..a95fa3ba22 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-12)
+# Supports 64-bit NEON
+media-libs/opencv -cpu_flags_arm_neon
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-02)
 # Supports 64-bit NEON
 media-libs/openpgl -cpu_flags_arm_neon
@@ -351,10 +355,6 @@ media-video/mplayer -sdl
 media-video/mpv -sdl
 >=x11-libs/wxGTK-3 -sdl
 
-# Michał Górny <mgorny@gentoo.org> (2018-07-07)
-# Unkeyworded dependencies.
-net-libs/gnome-online-accounts gnome
-
 # Jan Vesely <jano.vesely@gmail.com> (2018-06-15)
 # Mesa clover only works on r600 or radeonsi GPUs. The corresponding
 # video_cards useflags are not available on arm
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index afb21417b1..d0a0ec7455 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-20)
+# only keyworded for amd64 currently
+media-gfx/blender gnome
+
+# Ionen Wolkens <ionen@gentoo.org> (2024-04-16)
+# dev-qt/qtlanguageserver:6 currently has very few keywords
+dev-qt/qtdeclarative:6 qmlls
+
+# Mike Gilbert <floppym@gentoo.org> (2024-04-13)
+# Missing keywords on dev-python/looseversion.
+sys-fs/fuse:3 test
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-17)
 # Experimental, only keyworded for amd64 currently
 sys-kernel/installkernel efistub
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 451dd7d0fa..d1cd9910ec 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-14)
+# media-libs/quirc only keyworded on amd64, x86
+quirc
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2024-03-28)
 # dev-libs/optix only works on amd64 and arm64
 optix
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
index 3aa516a35f..9f34c46e0b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
@@ -332,10 +332,6 @@ mail-mta/exim redis
 # Many unkeyworded rails deps, bug #650642
 net-analyzer/wireshark doc
 
-# Sergei Trofimovich <slyfox@gentoo.org> (2018-03-18)
-# unkeyworded deps, bug #552330
-app-portage/g-sorcery bson
-
 # Mart Raudsepp <leio@gentoo.org> (2018-01-08)
 # mail-client/evolution[ytnef] requires net-mail/ytnef which is not keyworded
 mail-client/evolution ytnef
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index a2f88a42c1..d13f419ced 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -204,11 +204,6 @@ gnome-base/gvfs google
 # x11-libs/libXpresent is not keyworded on mips
 xfce-base/xfwm4 xpresent
 
-# Brian Dolbec <dolsen@gentoo.org> (2017-03-21)
-# This is masked as mongo-db needed for bson use flag
-# which is not keyworded on many arches.
-app-portage/g-sorcery bson
-
 # Mart Raudsepp <leio@gentoo.org> (2017-02-07)
 # dev-python/gmpy fails tests about sizeof (conch), bug 608496
 # dev-python/attrs fails tests on slow mips, couldn't test service_identity test path (crypt), bug 608570
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index ad13c1cfaa..ab34fd9573 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -274,10 +274,6 @@ sys-power/nut ups_drivers_nut-ipmipsu
 # Requires USE=opencl that is masked in this profile.
 net-misc/bfgminer adl lm-sensors
 
-# Michael Weber <xmw@gentoo.org> (2017-04-06)
-# mask unkeyworded dep pymongo -> mongodb
-app-portage/g-sorcery bson
-
 # Michał Górny <mgorny@gentoo.org> (2017-03-24)
 # libcxx fails to compile on ppc*, #595744.
 sys-devel/clang-common default-libcxx
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use
index 65ce352e9a..bd39f8122a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Sam James <sam@gentoo.org> (2024-01-05)
 # keyutils is masked here
-net-fs/cifs-utils -ads -acl
+net-fs/cifs-utils -ads
 
 # Ionen Wolkens <ionen@gentoo.org> (2023-10-09)
 # media-libs/shaderc is not keyworded here, so enable glslang fallback.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.stable.force b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.stable.force
new file mode 100644
index 0000000000..93ccd2bb78
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.stable.force
@@ -0,0 +1,7 @@
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Ben Kohler <bkohler@gentoo.org> (2024-04-18)
+# Force system-mitkrb5, as the bundled copy requires sys-apps/keyutils which
+# is not stable here due to test failures, bug #636252
+net-fs/samba system-mitkrb5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.force
index 5d6499cf5a..3a750ec50b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64le/package.use.force
@@ -1,9 +1,10 @@
-# Copyright 2021-2023 Gentoo Authors
+# Copyright 2021-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Georgy Yakovlev <gyakovlev@gentoo.org> (2022-01-20)
 # force users to use system versions
 # internal bootstrap only needed in parent big-endian profile
+dev-java/openjdk:8 system-bootstrap
 dev-java/openjdk:11 system-bootstrap
 dev-java/openjdk:17 system-bootstrap
 dev-java/openjdk:21 system-bootstrap
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.force
index 173cf4ca17..fbff0a723e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/64ul/package.use.force
@@ -1,9 +1,10 @@
-# Copyright 2022-2023 Gentoo Authors
+# Copyright 2022-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Arthur Zamarin <arthurzam@gentoo.org> (2022-01-13)
 # Bootstrapping is possible using our build snapshot, so don't force
 # system bootstrap
+dev-java/openjdk:8 -system-bootstrap
 dev-java/openjdk:11 -system-bootstrap
 dev-java/openjdk:17 -system-bootstrap
 dev-java/openjdk:21 -system-bootstrap
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index e4646a6549..bb9f219524 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# José de Paula R. N. Assis <espinafre@gmail.com> (2024-03-25)
+# No PyQt6 (which is needed by USE=qt6 for qscintilla-python) on ppc64.
+>=dev-python/qscintilla-python-2.14.1-r1 qt6
+
 # Sam James <sam@gentoo.org> (2024-03-23)
 # dev-qt/qtwebengine not available here
 dev-python/QtPy webengine test
@@ -189,11 +193,6 @@ net-irc/kvirc kde
 app-arch/p7zip kde
 dev-vcs/subversion kwallet
 
-# Patrice Clement <monsieurp@gentoo.org> (2016-02-08)
-# I would need to keyword an awful lot of packages on ppc64
-# that would need Java 7 otherwise.
-dev-java/ant-apache-bsf python
-
 # Jeroen Roovers <jer@gentoo.org> (2015-12-26)
 # Mask until >sys-cluster/ceph-0.94 goes stable
 net-analyzer/rrdtool rados
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index d1fa8c8782..144e11dcf5 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# NRK <nrk@disroot.org> (2024-04-08)
+# media-libs/libraw is not keyworded
+media-libs/imlib2 raw
+
 # Viorel Munteanu <ceamac@gentoo.org> (2024-04-06)
 # sys-libs/nss_wrapper unavailable for tests
 net-misc/dropbear test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index 36e301d72b..de6fb1921f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -406,10 +406,6 @@ net-misc/scponly unison
 # hardware related dependencies are not keyworded
 net-analyzer/nagios-plugin-check_raid 3ware aacraid hpa hpsa megaraid-sas mpt-sas2 mpt
 
-# Rolf Eike Beer <eike@sf-mail.de> (2020-04-04)
-# dev-python/pymongo is not keyworded
-app-portage/g-sorcery bson
-
 # Rolf Eike Beer <eike@sf-mail.de> (2020-04-04)
 # app-emacs/wanderlust is not keyworded
 app-emacs/elscreen wanderlust
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.force b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.force
new file mode 100644
index 0000000000..93ccd2bb78
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.stable.force
@@ -0,0 +1,7 @@
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Ben Kohler <bkohler@gentoo.org> (2024-04-18)
+# Force system-mitkrb5, as the bundled copy requires sys-apps/keyutils which
+# is not stable here due to test failures, bug #636252
+net-fs/samba system-mitkrb5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
index 580b0657bf..9c933318d0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.mask
@@ -83,8 +83,3 @@ sci-mathematics/rkward:5
 sci-visualization/labplot:5
 www-client/falkon
 www-client/otter
-
-# Viorel Munteanu <ceamac@gentoo.org> (2022-12-22)
-# The x86 build is broken and no longer available.  Bug #887831
-# Removal on 2023-01-22.
-dev-util/clion
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 6dafc718a1..3a7916b4e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# José de Paula R. N. Assis <espinafre@gmail.com> (2024-03-25)
+# No PyQt6 (which is needed by USE=qt6 for qscintilla-python) on x86.
+>=dev-python/qscintilla-python-2.14.1-r1 qt6
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-03-24)
 # Requires unkeyworded dev-qt/qtwebengine
 net-p2p/ktorrent rss
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
index 267e27efdc..38dc83097d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
@@ -4,6 +4,10 @@
 # Unmask the flag which corresponds to ARCH.
 -x86
 
+# Paul Zander <negril.nx+gentoo@gmail.com> (2024-04-14)
+# media-libs/quirc is keyworded on amd64
+-quirc
+
 # Paul Zander <negril.nx+gentoo@gmail.com> (2024-03-29)
 # not keyworded
 openimageio
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index 440df61536..65e6df80c2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -1,6 +1,20 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Ionen Wolkens <ionen@gentoo.org> (2024-04-10)
+# Flipping the zstd USE state is unsafe and can break *tons* of Qt revdeps
+# including many KDE packages and Qt itself without rebuilds due to losing
+# the qt_resourceFeatureZstd@Qt_6 (non-private) symbol making it unrealistic
+# to have [zstd=] everywhere.
+#
+# Given prebuilt revdeps may also need this and that it may speed up
+# resources usage, picking to always enable rather than disable.
+#
+# If *really* want to un-force and disable this, please rebuild all
+# qtbase revdeps after.
+dev-qt/qtbase:6 zstd
+dev-qt/qttools:6 zstd
+
 # Matt Turner <mattst88@gentoo.org> (2024-02-28)
 # A large number of packages still need /usr/bin/pkg-config
 # including meson.eclass consumers.
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 729776a88a..ac1edb0749 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,10 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Mike Gilbert <floppym@gentoo.org> (2024-04-18)
+# Wayland client is broken/deprecated by upstream. Bug 930197.
+>=net-misc/freerdp-3 wayland
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2024-04-06)
 # Depends on last-rited kde-apps/ktp-accounts-kcm
 dev-util/kdevelop reviewboard
@@ -31,13 +35,6 @@ app-crypt/pinentry qt6
 # https://github.com/psycopg/psycopg/issues/734
 <=dev-python/psycopg-3.1.18 native-extensions
 
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-03-10)
-# These packages have RESTRICT="test" and depend on dev-java/ant-junit
-# which is going away. Remove this mask when ebuilds are updated.
-dev-java/ant-ivy test
-dev-java/rhino test
-www-servers/tomcat test
-
 # Guilherme Amadio <amadio@gentoo.org> (2024-03-09)
 # Requires manually installing dependencies, see bug #791802
 # Please use MYCMAKEARGS instead.
@@ -179,6 +176,9 @@ app-admin/ansible-molecule doc
 
 # William Hubbs <williamh@gentoo.org> (2023-06-30)
 # multiple repeated issues: Bug: #909394
+# Joonas Niilola <juippis@gentoo.org> (2024-04-22)
+# Can break reverse dependencies (Chromium, Firefox), debugging not always 
+# obvious.
 net-libs/nodejs lto
 
 # Sam James <sam@gentoo.org> (2023-06-29)
@@ -626,10 +626,6 @@ dev-python/autobahn xbr
 # Mostly intended for development and not for general use.
 >=www-client/chromium-84 headless
 
-# Mikle Kolyada <zlogene@gentoo.org> (2020-06-21)
-# Multiple runtime crashes, see bug #724672
-media-gfx/inkscape jemalloc
-
 # Ben Kohler <bkohler@gentoo.org> (2020-04-29)
 # Dependency pam_wrapper missing for tests, and RESTRICT=test is already set
 net-fs/samba test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index e8fd188ba2..242387dc57 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -4,6 +4,11 @@
 # This file requires eapi 5 or later. New entries go on top.
 # Please use the same syntax as in package.use.mask
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-04-14)
+# Qt6 dependencies are not yet available in stable. Moreover,
+# Qt6 support in freecad is not completely finished.
+media-gfx/freecad qt6
+
 # Joonas Niilola <juippis@gentoo.org> (2023-07-14)
 # Calendar is broken with some languages on 115.0 release with <icu-75.
 # Bug #910229, #920713
diff --git a/sdk_container/src/third_party/portage-stable/profiles/default/linux/riscv/23.0/rv32/package.mask b/sdk_container/src/third_party/portage-stable/profiles/default/linux/riscv/23.0/rv32/package.mask
new file mode 100644
index 0000000000..2302e45c18
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/default/linux/riscv/23.0/rv32/package.mask
@@ -0,0 +1,6 @@
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2024-04-08)
+# musl only supports this since 1.2.5
+<sys-libs/musl-1.2.5
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
index 108ea5cfcc..a83df9315c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/big-endian/package.use.mask
@@ -35,6 +35,7 @@ mail-client/thunderbird system-av1
 gui-libs/gtk wayland
 gnome-base/gnome-control-center wayland
 sys-apps/xdg-desktop-portal-gnome wayland
+net-libs/webkit-gtk:6 wayland
 
 # matoro <matoro_gentoo@matoro.tk> (2023-04-10)
 # media-libs/libldac casualties (#80238)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/merged-usr/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/merged-usr/package.mask
index 96ac454f83..b416adef06 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/merged-usr/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/merged-usr/package.mask
@@ -1,6 +1,7 @@
-# Copyright 2023 Gentoo Authors
+# Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2023-12-07)
 # Can be used on a merged-usr profile.
 ->=sys-apps/systemd-255
+->=sys-process/systemd-cron-2.3.4-r1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 1c6aa91f0d..7773402d23 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -1,6 +1,12 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Akinori Hattori <hattya@gentoo.org> (2024-04-14)
+# musl iconv does not implement required encodings.
+app-i18n/nkf
+app-text/cmigemo
+www-client/jd
+
 # Marek Szuba <marecki@gentoo.org> (2024-04-07)
 # Relies on musl-incompatible ldconfig behaviour to determine the list of host
 # library directories. More importantly however, protontricks is useless without
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
index 534ed3ad3d..07d0f014aa 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.use.mask
@@ -1,6 +1,12 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Akinori Hattori <hattya@gentoo.org> (2024-04-15)
+# app-i18n/nkf is masked on musl
+app-i18n/multiskkserv test
+app-text/namazu l10n_ja
+games-roguelike/hengband l10n_ja
+
 # Pacho Ramos <pacho@gentoo.org> (2024-04-07)
 # sof tools need glibc at runtime, bug #925179
 sys-firmware/sof-firmware tools
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.mask
index 3c95fbece0..3a36d4e863 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/split-usr/package.mask
@@ -1,7 +1,8 @@
-# Copyright 2023 Gentoo Authors
+# Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2023-12-07)
 # Does not support split-usr filesystem geometry. Please migrate to
 # a merged-usr profile.
 >=sys-apps/systemd-255
+>=sys-process/systemd-cron-2.3.4-r1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
index b563d5da90..999cc6d4ee 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/wd40/package.mask
@@ -1,6 +1,11 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Agostino Sarubbo <ago@gentoo.org> (2024-04-10)
+# Requires rust on armv4/armv4t/arm5te
+dev-util/bugbite-cli
+dev-util/cargo-nextest
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-19)
 # Requires dev-python/cryptography
 app-emulation/virt-firmware
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
index db4bc1db6d..ef557ec07d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.deprecated
@@ -35,13 +35,6 @@ dev-python/shiboken2
 # Superseded by dev-python/psycopg:0 (version 3).
 dev-python/psycopg:2
 
-# Petr Vaněk <arkamar@gentoo.org> (2023-10-26)
-# dev-libs/hyperscan upstream is inactive [1], please switch to more portable,
-# drop-in replacement dev-libs/vectorscan. dev-libs/hyperscan will be
-# last-rited when all its revdeps are gone.
-# [1] https://github.com/intel/hyperscan/issues/421
-dev-libs/hyperscan
-
 # Matt Whitlock <gentoo@mattwhitlock.name> (2023-10-24)
 # Transitional meta packages. Please update dependencies:
 #   dev-util/bitcoin-tx          -> net-p2p/bitcoin-core
@@ -100,13 +93,6 @@ dev-python/python-distutils-extra
 # details. Please migrate to app-admin/rasdaemon instead.
 sys-apps/edac-utils
 
-# Michał Górny <mgorny@gentoo.org> (2022-12-24)
-# Unmaintained with last release in 2019.  We already patched it to work
-# with Python 3.9+.  The upstream code is also vulnerable
-# to CVE-2022-40899.  Above all, this library is completely redundant
-# to packages not supporting Python 2 anymore.
-dev-python/future
-
 # Matt Turner <mattst88@gentoo.org> (2022-10-02)
 # Dummy packages, now merged into app-accessibility/at-spi2-core.
 # When possible, replace dependencies on these packages with a dependency on
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index 593e66496a..3654f7ca45 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,74 @@
 
 #--- END OF EXAMPLES ---
 
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-04-20)
+# EAPI6 package, with no reverse dependencies. Not really maintained
+# since gentoo's transition to git. Distfile is fetch and mirror
+# restricted, and based on comment in ebuild, the source isn't stable
+# and we can lose the only source for distfile.
+# Removal on 2024-05-20, bug #930346.
+sys-block/megamgr
+
+# Maciej Barć <xgqt@gentoo.org> (2024-04-20)
+# No reverse dependencies, old packages for mono, uses abandoned mono.eclass.
+# Dotnet Project is not willing to take up those packages.
+# Open bugs: #679440
+# Removal on 2024-05-20
+dev-dotnet/monocalendar
+dev-dotnet/ndesk-dbus
+dev-dotnet/ndesk-dbus-glib
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-04-19)
+# EAPI=6, library only without any reverse dependencies, uses
+# deprecated go eclasses, maintainer-needed.
+# Removal on 2024-05-19, bug #930249
+dev-go/qr
+dev-go/twofactor
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-04-18)
+# Upstream gone, unfetchable, stuck on EAPI 6. Bug 605796
+# Removal on 2024-05-18
+sci-visualization/spectromatic
+
+# Fabian Groffen <grobian@gentoo.org> (2024-04-16)
+# Official latest Python support 3.8, replacement app-metrics/go-carbon
+# is more performant and designed to be a drop-in replacement.
+# Removal on 2024-05-16, bug #929444
+dev-python/carbon
+
+# Fabian Groffen <grobian@gentoo.org> (2024-04-13)
+# Python wrapper around liblmsensors, no reverse dependencies
+# Removal on 2024-05-13, bug #929495
+dev-python/PySensors
+
+# Arthur Zamarin <arthurzam@gentoo.org> (2024-04-12)
+# EAPI6. Fails to compile with go versions in tree. Upstream is archived.
+# Uses deprecated go eclasses. Maintainer needed, no rev deps.
+# Removal: 2024-05-12.  Bugs #794913, #679348, #771072, #844607.
+app-emulation/runv
+
+# Michał Górny <mgorny@gentoo.org> (2024-04-11)
+# Contains a bug that could render the kernel fail to boot.
+# https://lore.kernel.org/oe-lkp/202403221630.2692c998-oliver.sang@intel.com/
+# The fix is:
+# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e7d24c0aa8e678f41457d1304e2091cac6fd1a2e
+=sys-kernel/gentoo-kernel-6.6.26
+=sys-kernel/gentoo-kernel-bin-6.6.26
+=sys-kernel/vanilla-kernel-6.6.26
+=sys-kernel/vanilla-kernel-6.8.5
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-04-08)
+# Obsolete java-vm, bugs #848804 #830248.
+# Removal on 2024-05-08
+dev-java/icedtea-bin
+
+# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-04-08)
+# Java libraries without consumers.
+# Removal on 2024-05-08, bugs #853100 #716228.
+dev-java/gin
+dev-java/gwt
+dev-java/validation-api
+
 # Ben Kohler <bkohler@gentoo.org> (2024-04-07)
 # Abandoned upstream long ago in favor of Unifi Protect (running only on an
 # official Unifi appliance.  Likely contains lots of security holes in bundled
@@ -43,8 +111,8 @@ acct-user/unifi-video
 media-video/unifi-video
 
 # Ben Kohler <bkohler@gentoo.org> (2024-04-07)
-# Long ago forked to and obsoleted by sys-apps/memtest86+.  Upstream has 
-# abandoned this for their proprietary UEFI-based one (packaged in gentoo as 
+# Long ago forked to and obsoleted by sys-apps/memtest86+.  Upstream has
+# abandoned this for their proprietary UEFI-based one (packaged in gentoo as
 # as sys-apps/memtest86-bin).
 # Removal on 2024-05-07.  Bug #502464, #607494, #628528, #750677, #887003,
 # #912973, #920109
@@ -148,11 +216,6 @@ x11-libs/scw
 # Removal on 2024-04-25.  Bug #926550.
 sys-firmware/bluez-firmware
 
-# Michał Górny <mgorny@gentoo.org> (2024-03-26)
-# Wrapper library that's stuck on Qt5.  No reverse dependencies left.
-# Removal on 2024-04-25.  Bug #926548.
-dev-python/anyqt
-
 # Michał Górny <mgorny@gentoo.org> (2024-03-26)
 # Unfinished package from 2021 that was added as a short-lived
 # dependency of dev-python/GitPython.  No reverse dependencies remain.
@@ -235,133 +298,12 @@ dev-ruby/atomic
 # https://github.com/containers/buildah/issues/5320
 =app-containers/buildah-1.34.0
 
-# Eli Schwartz <eschwartz93@gmail.com> (2024-03-14)
-# Deprecated, doesn't work with python 3.12. Unmaintained with last
-# serious release in 2019, and another release in 2024 that claims
-# to support python 3.12 but fails tests if you actually do. No
-# route to making it work with python 3.13 at all, and upstream
-# explicitly states that future "like Python 2, is now done". The
-# package is entirely redundant to packages not supporting python
-# 2 anymore, and the ones that do support it should be using
-# dev-python/six instead, anyways.  Bug #888271
-# Removal on 2024-04-13.
-dev-python/future
-
-# Petr Vaněk <arkamar@gentoo.org> (2024-03-13)
-# dev-libs/hyperscan upstream is inactive [1], please switch to more portable,
-# drop-in replacement dev-libs/vectorscan.
-# [1] https://github.com/intel/hyperscan/issues/421
-# Removal: 2024-04-12.
-dev-libs/hyperscan
-
-# Alfredo Tupone <tupone@gentoo.org> (2024-03-12)
-# Not more needed, >=sci-visualization/dash-2.11 provide
-# direct integration with jupyter nodebook
-# Removal on 2024-04-11.
-sci-visualization/jupyter-dash
-
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-03-12)
-# Unused java libraries. Removal on 2024-04-11.
-dev-java/ant-eclipse-ecj
-
-# Matt Jolly <kangie@gentoo.org> (2024-03-11)
-# Obsolete, does not compile, archived upstream.
-# Removal: 2024-04-10.  Bugs #876977, #907705.
-media-video/obs-v4l2sink
-
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2024-03-10)
-# Unused java libraries. The ant tasks are now provided by dev-java/ant.
-# Removal on 2024-04-09.
-dev-java/ant-apache-regexp
-dev-java/ant-apache-log4j
-dev-java/ant-apache-xalan2
-dev-java/ant-commons-logging
-dev-java/ant-swing
-dev-java/ant-junit4
-dev-java/ant-testutil
-dev-java/ant-junitlauncher
-dev-java/ant-jai
-dev-java/ant-commons-net
-dev-java/ant-apache-bsf
-dev-java/ant-jmf
-dev-java/ant-apache-oro
-dev-java/ant-javamail
-dev-java/ant-junit
-dev-java/ant-jdepend
-dev-java/ant-antlr
-dev-java/ant-apache-bcel
-dev-java/ant-apache-resolver
-dev-java/ant-jsch
-dev-java/ant-xz
-dev-java/gnu-jaf
-dev-java/failureaccess
-
-# Michał Górny <mgorny@gentoo.org> (2024-03-10)
-# Packages that still require <dev-python/cython-3 and do not promise
-# a fix anytime soon.
-#
-# dev-python/python-efl: econnman as revdep, bug #925692.
-# dev-python/pygame_sdl2: also py3.12, bug #911781
-# games-engines/renpy: also py3.12, bug #925693
-# sci-chemistry/mdtraj: also py3.12, PEP517, bug #911646.
-#
-# Includes their few reverse dependencies and their exclusive
-# dependencies without Python 3.12 support.
-#
-# Removal on 2024-04-09.
-dev-python/astunparse
-dev-python/pygame_sdl2
-dev-python/python-efl
-games-engines/renpy
-net-misc/econnman
-sci-chemistry/mdtraj
-
-# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-10)
-# Archived upstream, latest release is 3 years old. One test
-# failure with python 3.11, more with python 3.12.
-# Removal on: 2024-04-10.  Bug #920439
-sci-libs/scikit-optimize
-
 # Eray Aslan <eras@gentoo.org> (2024-03-10)
 # Mask experimental software
 =mail-mta/postfix-3.10*
 
-# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-03-09)
-# Requires pyside2/shiboken2, which is unmaintained upstream and
-# not compatible with llvm-16 and up or python-3.12 and up.
-# No upstream activity for 2 years.
-# dev-python/QtPy is an alternative that does support Qt6.
-# Removal on: 2024-04-09.  Bug #926548
-dev-python/anyqt
-
-# Arthur Zamarin <arthurzam@gentoo.org> (2024-03-08)
-# A library without reverse dependencies.
-# Removal on: 2024-04-07.  Bug #926486.
-dev-libs/yascreen
-
-# Ulrich Müller <ulm@gentoo.org> (2024-03-06)
-# Inactive upstream maintainer. Needs porting to PEP 517 (or better,
-# from Python to Emacs Lisp) and from layman to repository.eselect.
-# Removal on 2024-05-05. Bug #909887, #909890.
-app-portage/g-sorcery
-app-portage/gs-elpa
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-02-28)
-# Stopped working after GMail changes some 1.5 years ago,
-# no more upstream development.
-# Removal on 2024-04-03.
-kde-misc/gmail-feed
-
-# Eli Schwartz <eschwartz93@gmail.com> (2024-02-29)
-# Ancient fork of gmp from 2017. Various build issues, fails tests. All
-# reverse dependencies turned out to be incorrect or preferred gmp
-# anyways. No path forward to keeping it buildable, no use case for
-# keeping it around.  Bug #812950, #874537, #925308
-# Removal on 2024-03-31.
-sci-libs/mpir
-
-# Andreas Sturmlechner <asturm@gentoo.org> (2024-02-28)
-# KDE Plasma 6.0.3, Gear 24.02.1 and Frameworks 6.0.0 mask
+# Andreas Sturmlechner <asturm@gentoo.org> (2024-04-16)
+# KDE Plasma 6.0.4, Gear 24.02.2 and Frameworks 6.1.0 mask
 #
 # Don't do anything unless you're intentionally moving to Plasma 6, which is
 # masked still for a reason. If you get this message just from conflicts where
@@ -379,350 +321,350 @@ sci-libs/mpir
 #   - file a bug after making sure none exists yet for your issue
 # - runtime bugs: https://community.kde.org/Plasma/Plasma_6#How_to_use/test_it
 #   - work with upstream and help test patches using /etc/portage/patches
-~kde-frameworks/frameworkintegration-6.0.0
-~kde-frameworks/attica-6.0.0
-~kde-frameworks/bluez-qt-6.0.0
-~kde-frameworks/breeze-icons-6.0.0
-~kde-frameworks/extra-cmake-modules-6.0.0
-~kde-frameworks/karchive-6.0.0
-~kde-frameworks/kcalendarcore-6.0.0
-~kde-frameworks/kcodecs-6.0.0
-~kde-frameworks/kconfig-6.0.0
-~kde-frameworks/kcoreaddons-6.0.0
-~kde-frameworks/kdbusaddons-6.0.0
-~kde-frameworks/kdnssd-6.0.0
-~kde-frameworks/kguiaddons-6.0.0
-~kde-frameworks/kholidays-6.0.0
-~kde-frameworks/ki18n-6.0.0
-~kde-frameworks/kidletime-6.0.0
-~kde-frameworks/kirigami-6.0.0
-~kde-frameworks/kitemmodels-6.0.0
-~kde-frameworks/kitemviews-6.0.0
-~kde-frameworks/kplotting-6.0.0
-~kde-frameworks/kquickcharts-6.0.0
-~kde-frameworks/ktexttemplate-6.0.0
-~kde-frameworks/kuserfeedback-6.0.0
-~kde-frameworks/kwidgetsaddons-6.0.0
-~kde-frameworks/kwindowsystem-6.0.0
-~kde-frameworks/modemmanager-qt-6.0.0
-~kde-frameworks/networkmanager-qt-6.0.0
-~kde-frameworks/prison-6.0.0
-~kde-frameworks/solid-6.0.0
-~kde-frameworks/sonnet-6.0.0
-~kde-frameworks/syntax-highlighting-6.0.0
-~kde-frameworks/threadweaver-6.0.0
-~kde-frameworks/kauth-6.0.0
-~kde-frameworks/kcolorscheme-6.0.0
-~kde-frameworks/kcompletion-6.0.0
-~kde-frameworks/kcontacts-6.0.0
-~kde-frameworks/kcrash-6.0.0
-~kde-frameworks/kdoctools-6.0.0
-~kde-frameworks/kfilemetadata-6.0.0
-~kde-frameworks/kimageformats-6.0.0
-~kde-frameworks/kjobwidgets-6.0.0
-~kde-frameworks/knotifications-6.0.0
-~kde-frameworks/kpackage-6.0.0
-~kde-frameworks/kpeople-6.0.0
-~kde-frameworks/kpty-6.0.0
-~kde-frameworks/kstatusnotifieritem-6.0.0
-~kde-frameworks/ksvg-6.0.0
-~kde-frameworks/kunitconversion-6.0.0
-~kde-frameworks/syndication-6.0.0
-~kde-frameworks/baloo-6.0.0
-~kde-frameworks/kbookmarks-6.0.0
-~kde-frameworks/kcmutils-6.0.0
-~kde-frameworks/kconfigwidgets-6.0.0
-~kde-frameworks/kdav-6.0.0
-~kde-frameworks/kdeclarative-6.0.0
-~kde-frameworks/kded-6.0.0
-~kde-frameworks/kdesu-6.0.0
-~kde-frameworks/kglobalaccel-6.0.0
-~kde-frameworks/kiconthemes-6.0.0
-~kde-frameworks/kio-6.0.0
-~kde-frameworks/knewstuff-6.0.0
-~kde-frameworks/knotifyconfig-6.0.0
-~kde-frameworks/kparts-6.0.0
-~kde-frameworks/krunner-6.0.0
-~kde-frameworks/kservice-6.0.0
-~kde-frameworks/ktexteditor-6.0.0
-~kde-frameworks/ktextwidgets-6.0.0
-~kde-frameworks/kwallet-6.0.0
-~kde-frameworks/kxmlgui-6.0.0
-~kde-frameworks/purpose-6.0.0
-~kde-frameworks/qqc2-desktop-style-6.0.0
-~kde-plasma/bluedevil-6.0.3
-~kde-plasma/breeze-6.0.3
-~kde-plasma/breeze-grub-6.0.3
-~kde-plasma/breeze-gtk-6.0.3
-~kde-plasma/breeze-plymouth-6.0.3
-~kde-plasma/discover-6.0.3
-~kde-plasma/drkonqi-6.0.3
-~kde-plasma/flatpak-kcm-6.0.3
-~kde-plasma/kactivitymanagerd-6.0.3
-~kde-plasma/kde-cli-tools-6.0.3
-~kde-plasma/kde-gtk-config-6.0.3
-~kde-plasma/kdecoration-6.0.3
-~kde-plasma/kdeplasma-addons-6.0.3
-~kde-plasma/kgamma-6.0.3
-~kde-plasma/kglobalacceld-6.0.3
-~kde-plasma/kinfocenter-6.0.3
-~kde-plasma/kmenuedit-6.0.3
-~kde-plasma/kpipewire-6.0.3
-~kde-plasma/kscreen-6.0.3
-~kde-plasma/kscreenlocker-6.0.3
-~kde-plasma/ksshaskpass-6.0.3
-~kde-plasma/ksystemstats-6.0.3
-~kde-plasma/kwallet-pam-6.0.3
-~kde-plasma/kwayland-6.0.3
-~kde-plasma/kwayland-integration-6.0.3
-~kde-plasma/kwin-6.0.3.1
-~kde-plasma/kwrited-6.0.3
-~kde-plasma/layer-shell-qt-6.0.3
-~kde-plasma/libkscreen-6.0.3
-~kde-plasma/libksysguard-6.0.3
-~kde-plasma/libplasma-6.0.3
-~kde-plasma/milou-6.0.3
-~kde-plasma/ocean-sound-theme-6.0.3
-~kde-plasma/oxygen-6.0.3
-~kde-plasma/oxygen-sounds-6.0.3
-~kde-plasma/plasma-activities-6.0.3
-~kde-plasma/plasma-activities-stats-6.0.3
-~kde-plasma/plasma-browser-integration-6.0.3
-~kde-plasma/plasma-desktop-6.0.3
-~kde-plasma/plasma-disks-6.0.3
-~kde-plasma/plasma-firewall-6.0.3
-~kde-plasma/plasma-integration-6.0.3
-~kde-plasma/plasma-meta-6.0.3
-~kde-plasma/plasma-nm-6.0.3
-~kde-plasma/plasma-pa-6.0.3
-~kde-plasma/plasma-sdk-6.0.3
-~kde-plasma/plasma-systemmonitor-6.0.3
-~kde-plasma/plasma-thunderbolt-6.0.3
-~kde-plasma/plasma-vault-6.0.3
-~kde-plasma/plasma-welcome-6.0.3
-~kde-plasma/plasma-workspace-6.0.3
-~kde-plasma/plasma-workspace-wallpapers-6.0.3
-~kde-plasma/plasma5support-6.0.3
-~kde-plasma/plymouth-kcm-6.0.3
-~kde-plasma/polkit-kde-agent-6.0.3
-~kde-plasma/powerdevil-6.0.3
-~kde-plasma/print-manager-6.0.3
-~kde-plasma/qqc2-breeze-style-6.0.3
-~kde-plasma/sddm-kcm-6.0.3
-~kde-plasma/systemsettings-6.0.3
-~kde-plasma/wacomtablet-6.0.3
-~kde-plasma/xdg-desktop-portal-kde-6.0.3
-~kde-apps/baloo-widgets-24.02.1
-~kde-apps/dolphin-24.02.1
-~kde-apps/ffmpegthumbs-24.02.1
-~kde-apps/kate-24.02.1
-~kde-apps/kate-addons-24.02.1
-~kde-apps/kate-lib-24.02.1
-~kde-apps/kde-apps-meta-24.02.1
-~kde-apps/kdecore-meta-24.02.1
-~kde-apps/khelpcenter-24.02.1
-~kde-apps/konsole-24.02.1
-~kde-apps/kwrite-24.02.1
-~kde-apps/kdialog-24.02.1
-~kde-apps/keditbookmarks-24.02.1
-~kde-apps/kfind-24.02.1
-~kde-apps/konqueror-24.02.1
-~www-client/falkon-24.02.1
-~app-accessibility/kontrast-24.02.1
-~kde-apps/kdeaccessibility-meta-24.02.1
-~kde-apps/kmag-24.02.1
-~kde-apps/kmousetool-24.02.1
-~kde-apps/kmouth-24.02.1
-~kde-apps/kdeadmin-meta-24.02.1
-~kde-apps/kcron-24.02.1
-~kde-apps/ksystemlog-24.02.1
-~kde-apps/analitza-24.02.1
-~kde-apps/blinken-24.02.1
-~kde-apps/kalgebra-24.02.1
-~kde-apps/kanagram-24.02.1
-~kde-apps/kbruch-24.02.1
-~kde-apps/kdeedu-meta-24.02.1
-~kde-apps/kgeography-24.02.1
-~kde-apps/khangman-24.02.1
-~kde-apps/kiten-24.02.1
-~kde-apps/klettres-24.02.1
-~kde-apps/kturtle-24.02.1
-~kde-apps/kwordquiz-24.02.1
-~kde-apps/libkeduvocdocument-24.02.1
-~kde-apps/parley-24.02.1
-~kde-apps/bomber-24.02.1
-~kde-apps/bovo-24.02.1
-~kde-apps/granatier-24.02.1
-~kde-apps/kajongg-24.02.1
-~kde-apps/kapman-24.02.1
-~kde-apps/katomic-24.02.1
-~kde-apps/kblackbox-24.02.1
-~kde-apps/kblocks-24.02.1
-~kde-apps/kbounce-24.02.1
-~kde-apps/kbreakout-24.02.1
-~kde-apps/kdegames-meta-24.02.1
-~kde-apps/kdiamond-24.02.1
-~kde-apps/kfourinline-24.02.1
-~kde-apps/kgoldrunner-24.02.1
-~kde-apps/kigo-24.02.1
-~kde-apps/killbots-24.02.1
-~kde-apps/kiriki-24.02.1
-~kde-apps/kjumpingcube-24.02.1
-~kde-apps/klickety-24.02.1
-~kde-apps/klines-24.02.1
-~kde-apps/kmahjongg-24.02.1
-~kde-apps/kmines-24.02.1
-~kde-apps/knavalbattle-24.02.1
-~kde-apps/knetwalk-24.02.1
-~kde-apps/knights-24.02.1
-~kde-apps/kolf-24.02.1
-~kde-apps/kollision-24.02.1
-~kde-apps/konquest-24.02.1
-~kde-apps/kpat-24.02.1
-~kde-apps/kreversi-24.02.1
-~kde-apps/kshisen-24.02.1
-~kde-apps/ksirk-24.02.1
-~kde-apps/ksnakeduel-24.02.1
-~kde-apps/kspaceduel-24.02.1
-~kde-apps/ksquares-24.02.1
-~kde-apps/ksudoku-24.02.1
-~kde-apps/ktuberling-24.02.1
-~kde-apps/kubrick-24.02.1
-~kde-apps/libkdegames-24.02.1
-~kde-apps/libkmahjongg-24.02.1
-~kde-apps/lskat-24.02.1
-~kde-apps/palapeli-24.02.1
-~kde-apps/picmi-24.02.1
-~kde-apps/gwenview-24.02.1
-~kde-apps/kamera-24.02.1
-~kde-apps/kcolorchooser-24.02.1
-~kde-apps/kdegraphics-meta-24.02.1
-~kde-apps/kdegraphics-mobipocket-24.02.1
-~kde-apps/kruler-24.02.1
-~kde-apps/libkdcraw-24.02.1
-~kde-apps/libkexiv2-24.02.1
-~kde-apps/okular-24.02.1
-~kde-apps/spectacle-24.02.1
-~kde-apps/svgpart-24.02.1
-~kde-apps/thumbnailers-24.02.1
-~kde-misc/colord-kde-24.02.1
-~media-gfx/skanpage-24.02.1
-~media-libs/ksanecore-24.02.1
-~kde-apps/audiocd-kio-24.02.1
-~kde-apps/dragon-24.02.1
-~kde-apps/juk-24.02.1
-~kde-apps/kdemultimedia-meta-24.02.1
-~kde-apps/kdenlive-24.02.1
-~kde-apps/libkcddb-24.02.1
-~kde-apps/libkcompactdisc-24.02.1
-~media-sound/elisa-24.02.1
-~media-sound/kasts-24.02.1
-~media-sound/krecorder-24.02.1
-~kde-apps/dolphin-plugins-dropbox-24.02.1
-~kde-apps/kaccounts-integration-24.02.1
-~kde-apps/kaccounts-providers-24.02.1
-~kde-apps/kdenetwork-meta-24.02.1
-~kde-apps/kdenetwork-filesharing-24.02.1
-~kde-apps/kget-24.02.1
-~kde-apps/kio-extras-24.02.1
-~kde-apps/krfb-24.02.1
-~kde-apps/signon-kwallet-extension-24.02.1
-~kde-misc/kdeconnect-24.02.1
-~kde-misc/kio-gdrive-24.02.1
-~net-im/neochat-24.02.1
-~net-im/tokodon-24.02.1
-~net-irc/konversation-24.02.1
-~net-libs/libktorrent-24.02.1
-~net-misc/kio-zeroconf-24.02.1
-~net-news/alligator-24.02.1
-~net-p2p/ktorrent-24.02.1
-~app-office/merkuro-24.02.1
-~dev-libs/kopeninghours-24.02.1
-~dev-libs/kosmindoormap-24.02.1
-~dev-libs/kpublictransport-24.02.1
-~kde-apps/akonadi-24.02.1
-~kde-apps/akonadi-calendar-24.02.1
-~kde-apps/akonadi-contacts-24.02.1
-~kde-apps/akonadi-import-wizard-24.02.1
-~kde-apps/akonadi-mime-24.02.1
-~kde-apps/akonadi-notes-24.02.1
-~kde-apps/akonadi-search-24.02.1
-~kde-apps/akonadiconsole-24.02.1
-~kde-apps/akregator-24.02.1
-~kde-apps/calendarjanitor-24.02.1
-~kde-apps/calendarsupport-24.02.1
-~kde-apps/eventviews-24.02.1
-~kde-apps/grantlee-editor-24.02.1
-~kde-apps/grantleetheme-24.02.1
-~kde-apps/incidenceeditor-24.02.1
-~kde-apps/kaddressbook-24.02.1
-~kde-apps/kalarm-24.02.1
-~kde-apps/kcalutils-24.02.1
-~kde-apps/kdepim-addons-24.02.1
-~kde-apps/kdepim-meta-24.02.1
-~kde-apps/kdepim-runtime-24.02.1
-~kde-apps/kidentitymanagement-24.02.1
-~kde-apps/kimap-24.02.1
-~kde-apps/kitinerary-24.02.1
-~kde-apps/kldap-24.02.1
-~kde-apps/kleopatra-24.02.1
-~kde-apps/kmail-24.02.1
-~kde-apps/kmail-account-wizard-24.02.1
-~kde-apps/kmailtransport-24.02.1
-~kde-apps/kmbox-24.02.1
-~kde-apps/kmime-24.02.1
-~kde-apps/knotes-24.02.1
-~kde-apps/konsolekalendar-24.02.1
-~kde-apps/kontact-24.02.1
-~kde-apps/kontactinterface-24.02.1
-~kde-apps/korganizer-24.02.1
-~kde-apps/kpimtextedit-24.02.1
-~kde-apps/kpkpass-24.02.1
-~kde-apps/ksmtp-24.02.1
-~kde-apps/libgravatar-24.02.1
-~kde-apps/libkdepim-24.02.1
-~kde-apps/libkgapi-24.02.1
-~kde-apps/libkleo-24.02.1
-~kde-apps/libksieve-24.02.1
-~kde-apps/libktnef-24.02.1
-~kde-apps/mailcommon-24.02.1
-~kde-apps/mailimporter-24.02.1
-~kde-apps/mbox-importer-24.02.1
-~kde-apps/messagelib-24.02.1
-~kde-apps/mimetreeparser-24.02.1
-~kde-apps/pim-data-exporter-24.02.1
-~kde-apps/pim-sieve-editor-24.02.1
-~kde-apps/pimcommon-24.02.1
-~kde-misc/zanshin-24.02.1
-~kde-apps/dolphin-plugins-git-24.02.1
-~kde-apps/dolphin-plugins-mercurial-24.02.1
-~kde-apps/dolphin-plugins-subversion-24.02.1
-~kde-apps/kapptemplate-24.02.1
-~kde-apps/kcachegrind-24.02.1
-~kde-apps/kde-dev-utils-24.02.1
-~kde-apps/kdesdk-meta-24.02.1
-~app-cdr/dolphin-plugins-mountiso-24.02.1
-~app-cdr/isoimagewriter-24.02.1
-~app-crypt/keysmith-24.02.1
-~kde-apps/ark-24.02.1
-~kde-apps/filelight-24.02.1
-~kde-apps/kbackup-24.02.1
-~kde-apps/kcalc-24.02.1
-~kde-apps/kcharselect-24.02.1
-~kde-apps/kdebugsettings-24.02.1
-~kde-apps/kdeutils-meta-24.02.1
-~kde-apps/kdf-24.02.1
-~kde-apps/kgpg-24.02.1
-~kde-apps/kteatime-24.02.1
-~kde-apps/ktimer-24.02.1
-~kde-apps/kwalletmanager-24.02.1
-~kde-apps/sweeper-24.02.1
-~kde-apps/yakuake-24.02.1
-~kde-misc/kclock-24.02.1
-~kde-misc/kweather-24.02.1
-~kde-misc/markdownpart-24.02.1
-~sys-block/partitionmanager-24.02.1
-~sys-libs/kpmcore-24.02.1
+~kde-frameworks/frameworkintegration-6.1.0
+~kde-frameworks/attica-6.1.0
+~kde-frameworks/bluez-qt-6.1.0
+~kde-frameworks/breeze-icons-6.1.0
+~kde-frameworks/extra-cmake-modules-6.1.0
+~kde-frameworks/karchive-6.1.0
+~kde-frameworks/kcalendarcore-6.1.0
+~kde-frameworks/kcodecs-6.1.0
+~kde-frameworks/kconfig-6.1.0
+~kde-frameworks/kcoreaddons-6.1.0
+~kde-frameworks/kdbusaddons-6.1.0
+~kde-frameworks/kdnssd-6.1.0
+~kde-frameworks/kguiaddons-6.1.0
+~kde-frameworks/kholidays-6.1.0
+~kde-frameworks/ki18n-6.1.0
+~kde-frameworks/kidletime-6.1.0
+~kde-frameworks/kirigami-6.1.0
+~kde-frameworks/kitemmodels-6.1.0
+~kde-frameworks/kitemviews-6.1.0
+~kde-frameworks/kplotting-6.1.0
+~kde-frameworks/kquickcharts-6.1.0
+~kde-frameworks/ktexttemplate-6.1.0
+~kde-frameworks/kuserfeedback-6.1.0
+~kde-frameworks/kwidgetsaddons-6.1.0
+~kde-frameworks/kwindowsystem-6.1.0
+~kde-frameworks/modemmanager-qt-6.1.0
+~kde-frameworks/networkmanager-qt-6.1.0
+~kde-frameworks/prison-6.1.0
+~kde-frameworks/solid-6.1.1
+~kde-frameworks/sonnet-6.1.0
+~kde-frameworks/syntax-highlighting-6.1.0
+~kde-frameworks/threadweaver-6.1.0
+~kde-frameworks/kauth-6.1.0
+~kde-frameworks/kcolorscheme-6.1.0
+~kde-frameworks/kcompletion-6.1.0
+~kde-frameworks/kcontacts-6.1.0
+~kde-frameworks/kcrash-6.1.0
+~kde-frameworks/kdoctools-6.1.0
+~kde-frameworks/kfilemetadata-6.1.0
+~kde-frameworks/kimageformats-6.1.0
+~kde-frameworks/kjobwidgets-6.1.0
+~kde-frameworks/knotifications-6.1.0
+~kde-frameworks/kpackage-6.1.0
+~kde-frameworks/kpeople-6.1.0
+~kde-frameworks/kpty-6.1.0
+~kde-frameworks/kstatusnotifieritem-6.1.0
+~kde-frameworks/ksvg-6.1.0
+~kde-frameworks/kunitconversion-6.1.0
+~kde-frameworks/syndication-6.1.0
+~kde-frameworks/baloo-6.1.0
+~kde-frameworks/kbookmarks-6.1.0
+~kde-frameworks/kcmutils-6.1.0
+~kde-frameworks/kconfigwidgets-6.1.0
+~kde-frameworks/kdav-6.1.0
+~kde-frameworks/kdeclarative-6.1.0
+~kde-frameworks/kded-6.1.0
+~kde-frameworks/kdesu-6.1.0
+~kde-frameworks/kglobalaccel-6.1.0
+~kde-frameworks/kiconthemes-6.1.0
+~kde-frameworks/kio-6.1.0
+~kde-frameworks/knewstuff-6.1.0
+~kde-frameworks/knotifyconfig-6.1.0
+~kde-frameworks/kparts-6.1.0
+~kde-frameworks/krunner-6.1.0
+~kde-frameworks/kservice-6.1.0
+~kde-frameworks/ktexteditor-6.1.0
+~kde-frameworks/ktextwidgets-6.1.0
+~kde-frameworks/kwallet-6.1.0
+~kde-frameworks/kxmlgui-6.1.0
+~kde-frameworks/purpose-6.1.0
+~kde-frameworks/qqc2-desktop-style-6.1.0
+~kde-plasma/bluedevil-6.0.4
+~kde-plasma/breeze-6.0.4
+~kde-plasma/breeze-grub-6.0.4
+~kde-plasma/breeze-gtk-6.0.4.1
+~kde-plasma/breeze-plymouth-6.0.4.1
+~kde-plasma/discover-6.0.4
+~kde-plasma/drkonqi-6.0.4
+~kde-plasma/flatpak-kcm-6.0.4
+~kde-plasma/kactivitymanagerd-6.0.4
+~kde-plasma/kde-cli-tools-6.0.4
+~kde-plasma/kde-gtk-config-6.0.4
+~kde-plasma/kdecoration-6.0.4
+~kde-plasma/kdeplasma-addons-6.0.4
+~kde-plasma/kgamma-6.0.4
+~kde-plasma/kglobalacceld-6.0.4
+~kde-plasma/kinfocenter-6.0.4
+~kde-plasma/kmenuedit-6.0.4
+~kde-plasma/kpipewire-6.0.4
+~kde-plasma/kscreen-6.0.4
+~kde-plasma/kscreenlocker-6.0.4
+~kde-plasma/ksshaskpass-6.0.4
+~kde-plasma/ksystemstats-6.0.4
+~kde-plasma/kwallet-pam-6.0.4
+~kde-plasma/kwayland-6.0.4
+~kde-plasma/kwayland-integration-6.0.4
+~kde-plasma/kwin-6.0.4
+~kde-plasma/kwrited-6.0.4
+~kde-plasma/layer-shell-qt-6.0.4
+~kde-plasma/libkscreen-6.0.4
+~kde-plasma/libksysguard-6.0.4
+~kde-plasma/libplasma-6.0.4
+~kde-plasma/milou-6.0.4
+~kde-plasma/ocean-sound-theme-6.0.4
+~kde-plasma/oxygen-6.0.4
+~kde-plasma/oxygen-sounds-6.0.4
+~kde-plasma/plasma-activities-6.0.4
+~kde-plasma/plasma-activities-stats-6.0.4
+~kde-plasma/plasma-browser-integration-6.0.4
+~kde-plasma/plasma-desktop-6.0.4
+~kde-plasma/plasma-disks-6.0.4
+~kde-plasma/plasma-firewall-6.0.4
+~kde-plasma/plasma-integration-6.0.4
+~kde-plasma/plasma-meta-6.0.4
+~kde-plasma/plasma-nm-6.0.4
+~kde-plasma/plasma-pa-6.0.4
+~kde-plasma/plasma-sdk-6.0.4
+~kde-plasma/plasma-systemmonitor-6.0.4
+~kde-plasma/plasma-thunderbolt-6.0.4
+~kde-plasma/plasma-vault-6.0.4
+~kde-plasma/plasma-welcome-6.0.4
+~kde-plasma/plasma-workspace-6.0.4
+~kde-plasma/plasma-workspace-wallpapers-6.0.4
+~kde-plasma/plasma5support-6.0.4
+~kde-plasma/plymouth-kcm-6.0.4
+~kde-plasma/polkit-kde-agent-6.0.4
+~kde-plasma/powerdevil-6.0.4
+~kde-plasma/print-manager-6.0.4
+~kde-plasma/qqc2-breeze-style-6.0.4
+~kde-plasma/sddm-kcm-6.0.4
+~kde-plasma/systemsettings-6.0.4
+~kde-plasma/wacomtablet-6.0.4
+~kde-plasma/xdg-desktop-portal-kde-6.0.4
+~kde-apps/baloo-widgets-24.02.2
+~kde-apps/dolphin-24.02.2
+~kde-apps/ffmpegthumbs-24.02.2
+~kde-apps/kate-24.02.2
+~kde-apps/kate-addons-24.02.2
+~kde-apps/kate-lib-24.02.2
+~kde-apps/kde-apps-meta-24.02.2
+~kde-apps/kdecore-meta-24.02.2
+~kde-apps/khelpcenter-24.02.2
+~kde-apps/konsole-24.02.2
+~kde-apps/kwrite-24.02.2
+~kde-apps/kdialog-24.02.2
+~kde-apps/keditbookmarks-24.02.2
+~kde-apps/kfind-24.02.2
+~kde-apps/konqueror-24.02.2
+~www-client/falkon-24.02.2
+~app-accessibility/kontrast-24.02.2
+~kde-apps/kdeaccessibility-meta-24.02.2
+~kde-apps/kmag-24.02.2
+~kde-apps/kmousetool-24.02.2
+~kde-apps/kmouth-24.02.2
+~kde-apps/kdeadmin-meta-24.02.2
+~kde-apps/kcron-24.02.2
+~kde-apps/ksystemlog-24.02.2
+~kde-apps/analitza-24.02.2
+~kde-apps/blinken-24.02.2
+~kde-apps/kalgebra-24.02.2
+~kde-apps/kanagram-24.02.2
+~kde-apps/kbruch-24.02.2
+~kde-apps/kdeedu-meta-24.02.2
+~kde-apps/kgeography-24.02.2
+~kde-apps/khangman-24.02.2
+~kde-apps/kiten-24.02.2
+~kde-apps/klettres-24.02.2
+~kde-apps/kturtle-24.02.2
+~kde-apps/kwordquiz-24.02.2
+~kde-apps/libkeduvocdocument-24.02.2
+~kde-apps/parley-24.02.2
+~kde-apps/bomber-24.02.2
+~kde-apps/bovo-24.02.2
+~kde-apps/granatier-24.02.2
+~kde-apps/kajongg-24.02.2
+~kde-apps/kapman-24.02.2
+~kde-apps/katomic-24.02.2
+~kde-apps/kblackbox-24.02.2
+~kde-apps/kblocks-24.02.2
+~kde-apps/kbounce-24.02.2
+~kde-apps/kbreakout-24.02.2
+~kde-apps/kdegames-meta-24.02.2
+~kde-apps/kdiamond-24.02.2
+~kde-apps/kfourinline-24.02.2
+~kde-apps/kgoldrunner-24.02.2
+~kde-apps/kigo-24.02.2
+~kde-apps/killbots-24.02.2
+~kde-apps/kiriki-24.02.2
+~kde-apps/kjumpingcube-24.02.2
+~kde-apps/klickety-24.02.2
+~kde-apps/klines-24.02.2
+~kde-apps/kmahjongg-24.02.2
+~kde-apps/kmines-24.02.2
+~kde-apps/knavalbattle-24.02.2
+~kde-apps/knetwalk-24.02.2
+~kde-apps/knights-24.02.2
+~kde-apps/kolf-24.02.2
+~kde-apps/kollision-24.02.2
+~kde-apps/konquest-24.02.2
+~kde-apps/kpat-24.02.2
+~kde-apps/kreversi-24.02.2
+~kde-apps/kshisen-24.02.2
+~kde-apps/ksirk-24.02.2
+~kde-apps/ksnakeduel-24.02.2
+~kde-apps/kspaceduel-24.02.2
+~kde-apps/ksquares-24.02.2
+~kde-apps/ksudoku-24.02.2
+~kde-apps/ktuberling-24.02.2
+~kde-apps/kubrick-24.02.2
+~kde-apps/libkdegames-24.02.2
+~kde-apps/libkmahjongg-24.02.2
+~kde-apps/lskat-24.02.2
+~kde-apps/palapeli-24.02.2
+~kde-apps/picmi-24.02.2
+~kde-apps/gwenview-24.02.2
+~kde-apps/kamera-24.02.2
+~kde-apps/kcolorchooser-24.02.2
+~kde-apps/kdegraphics-meta-24.02.2
+~kde-apps/kdegraphics-mobipocket-24.02.2
+~kde-apps/kruler-24.02.2
+~kde-apps/libkdcraw-24.02.2
+~kde-apps/libkexiv2-24.02.2
+~kde-apps/okular-24.02.2
+~kde-apps/spectacle-24.02.2
+~kde-apps/svgpart-24.02.2
+~kde-apps/thumbnailers-24.02.2
+~kde-misc/colord-kde-24.02.2
+~media-gfx/skanpage-24.02.2
+~media-libs/ksanecore-24.02.2
+~kde-apps/audiocd-kio-24.02.2
+~kde-apps/dragon-24.02.2
+~kde-apps/juk-24.02.2
+~kde-apps/kdemultimedia-meta-24.02.2
+~kde-apps/kdenlive-24.02.2
+~kde-apps/libkcddb-24.02.2
+~kde-apps/libkcompactdisc-24.02.2
+~media-sound/elisa-24.02.2
+~media-sound/kasts-24.02.2
+~media-sound/krecorder-24.02.2
+~kde-apps/dolphin-plugins-dropbox-24.02.2
+~kde-apps/kaccounts-integration-24.02.2
+~kde-apps/kaccounts-providers-24.02.2
+~kde-apps/kdenetwork-meta-24.02.2
+~kde-apps/kdenetwork-filesharing-24.02.2
+~kde-apps/kget-24.02.2
+~kde-apps/kio-extras-24.02.2
+~kde-apps/krfb-24.02.2
+~kde-apps/signon-kwallet-extension-24.02.2
+~kde-misc/kdeconnect-24.02.2
+~kde-misc/kio-gdrive-24.02.2
+~net-im/neochat-24.02.2
+~net-im/tokodon-24.02.2
+~net-irc/konversation-24.02.2
+~net-libs/libktorrent-24.02.2
+~net-misc/kio-zeroconf-24.02.2
+~net-news/alligator-24.02.2
+~net-p2p/ktorrent-24.02.2
+~app-office/merkuro-24.02.2
+~dev-libs/kopeninghours-24.02.2
+~dev-libs/kosmindoormap-24.02.2
+~dev-libs/kpublictransport-24.02.2
+~kde-apps/akonadi-24.02.2
+~kde-apps/akonadi-calendar-24.02.2
+~kde-apps/akonadi-contacts-24.02.2
+~kde-apps/akonadi-import-wizard-24.02.2
+~kde-apps/akonadi-mime-24.02.2
+~kde-apps/akonadi-notes-24.02.2
+~kde-apps/akonadi-search-24.02.2
+~kde-apps/akonadiconsole-24.02.2
+~kde-apps/akregator-24.02.2
+~kde-apps/calendarjanitor-24.02.2
+~kde-apps/calendarsupport-24.02.2
+~kde-apps/eventviews-24.02.2
+~kde-apps/grantlee-editor-24.02.2
+~kde-apps/grantleetheme-24.02.2
+~kde-apps/incidenceeditor-24.02.2
+~kde-apps/kaddressbook-24.02.2
+~kde-apps/kalarm-24.02.2
+~kde-apps/kcalutils-24.02.2
+~kde-apps/kdepim-addons-24.02.2
+~kde-apps/kdepim-meta-24.02.2
+~kde-apps/kdepim-runtime-24.02.2
+~kde-apps/kidentitymanagement-24.02.2
+~kde-apps/kimap-24.02.2
+~kde-apps/kitinerary-24.02.2
+~kde-apps/kldap-24.02.2
+~kde-apps/kleopatra-24.02.2
+~kde-apps/kmail-24.02.2
+~kde-apps/kmail-account-wizard-24.02.2
+~kde-apps/kmailtransport-24.02.2
+~kde-apps/kmbox-24.02.2
+~kde-apps/kmime-24.02.2
+~kde-apps/knotes-24.02.2
+~kde-apps/konsolekalendar-24.02.2
+~kde-apps/kontact-24.02.2
+~kde-apps/kontactinterface-24.02.2
+~kde-apps/korganizer-24.02.2
+~kde-apps/kpimtextedit-24.02.2
+~kde-apps/kpkpass-24.02.2
+~kde-apps/ksmtp-24.02.2
+~kde-apps/libgravatar-24.02.2
+~kde-apps/libkdepim-24.02.2
+~kde-apps/libkgapi-24.02.2
+~kde-apps/libkleo-24.02.2
+~kde-apps/libksieve-24.02.2
+~kde-apps/libktnef-24.02.2
+~kde-apps/mailcommon-24.02.2
+~kde-apps/mailimporter-24.02.2
+~kde-apps/mbox-importer-24.02.2
+~kde-apps/messagelib-24.02.2
+~kde-apps/mimetreeparser-24.02.2
+~kde-apps/pim-data-exporter-24.02.2
+~kde-apps/pim-sieve-editor-24.02.2
+~kde-apps/pimcommon-24.02.2
+~kde-misc/zanshin-24.02.2
+~kde-apps/dolphin-plugins-git-24.02.2
+~kde-apps/dolphin-plugins-mercurial-24.02.2
+~kde-apps/dolphin-plugins-subversion-24.02.2
+~kde-apps/kapptemplate-24.02.2
+~kde-apps/kcachegrind-24.02.2
+~kde-apps/kde-dev-utils-24.02.2
+~kde-apps/kdesdk-meta-24.02.2
+~app-cdr/dolphin-plugins-mountiso-24.02.2
+~app-cdr/isoimagewriter-24.02.2
+~app-crypt/keysmith-24.02.2
+~kde-apps/ark-24.02.2
+~kde-apps/filelight-24.02.2
+~kde-apps/kbackup-24.02.2
+~kde-apps/kcalc-24.02.2
+~kde-apps/kcharselect-24.02.2
+~kde-apps/kdebugsettings-24.02.2
+~kde-apps/kdeutils-meta-24.02.2
+~kde-apps/kdf-24.02.2
+~kde-apps/kgpg-24.02.2
+~kde-apps/kteatime-24.02.2
+~kde-apps/ktimer-24.02.2
+~kde-apps/kwalletmanager-24.02.2
+~kde-apps/sweeper-24.02.2
+~kde-apps/yakuake-24.02.2
+~kde-misc/kclock-24.02.2
+~kde-misc/kweather-24.02.2
+~kde-misc/markdownpart-24.02.2
+~sys-block/partitionmanager-24.02.2
+~sys-libs/kpmcore-24.02.2
 =kde-apps/kio-extras-23.08.5-r100
 =kde-apps/libkgapi-23.08.5-r100
 =kde-misc/kio-gdrive-23.08.5-r1
@@ -769,12 +711,6 @@ sci-libs/mpir
 # Test failure in watchpoints.dem, undefined function FresnelC.
 ~sci-visualization/gnuplot-6.0.0
 
-# Michał Górny <mgorny@gentoo.org> (2024-02-07)
-# Does not build anymore.  Carries a large stack of patches already.
-# Last upstream activity in late 2020.  No reverse dependencies left.
-# Removal on 2024-03-08.  Bug #806079.
-sys-libs/libhugetlbfs
-
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2024-01-24)
 # app-misc/ddcutil-2.1.0 causes core-dump crashes in
 # kde-plasma/powerdevil[brightness-control].
@@ -865,19 +801,6 @@ sys-libs/libhugetlbfs
 # Breaks building scipy: https://github.com/cython/cython/issues/5748
 =dev-python/cython-3.0.3
 
-# Jaco Kroon <jaco@uls.co.za> (2023-09-19)
-# Joonas Niilola <juippis@gentoo.org> (2023-09-21)
-# DAHDI is not suited for a rolling-release distribution. Upstream releases new
-# versions sporadically and it may take multiple years between them. Old
-# versions are constantly broken with newer kernels, requiring heavy patching
-# downstream. Has no active maintainer in Gentoo. If you use DAHDI and have
-# some ideas how to help, please see bug #914477.
-# Removal on 2024-03-01.
-net-libs/libpri
-net-misc/dahdi
-net-misc/dahdi-tools
-net-misc/openr2
-
 # Sam James <sam@gentoo.org> (2023-09-09)
 # OpenSSL 1.1.x is EOL on 2023-09-11. Please upgrade immediately to >= OpenSSL 3.
 # https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/
@@ -1056,7 +979,7 @@ app-office/texmacs
 # If you still use one of these old toolchain packages, please upgrade (and
 # switch the compiler / the binutils) ASAP. If you need them for a specific
 # (isolated) use case, feel free to unmask them on your system.
-<sys-libs/glibc-2.37-r3
+<sys-libs/glibc-2.38-r10
 <sys-libs/binutils-libs-2.40
 <sys-devel/binutils-2.40
 <sys-devel/binutils-hppa64-2.40
diff --git a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
index 7b463faf93..3a9f5b22b1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
+++ b/sdk_container/src/third_party/portage-stable/profiles/profiles.desc
@@ -29,23 +29,23 @@ alpha		default/linux/alpha/23.0/split-usr/desktop/gnome		exp
 
 # AMD64 Profiles
 # @MAINTAINER: amd64@gentoo.org
-amd64		default/linux/amd64/17.1					exp
-amd64		default/linux/amd64/17.1/selinux				exp
-amd64		default/linux/amd64/17.1/hardened				exp
-amd64		default/linux/amd64/17.1/hardened/selinux			exp
-amd64		default/linux/amd64/17.1/desktop				exp
-amd64		default/linux/amd64/17.1/desktop/gnome				exp
-amd64		default/linux/amd64/17.1/desktop/gnome/systemd/merged-usr	exp
-amd64		default/linux/amd64/17.1/desktop/plasma				exp
-amd64		default/linux/amd64/17.1/desktop/plasma/systemd/merged-usr	exp
-amd64		default/linux/amd64/17.1/desktop/systemd/merged-usr		exp
+amd64		default/linux/amd64/17.1					stable
+amd64		default/linux/amd64/17.1/selinux				stable
+amd64		default/linux/amd64/17.1/hardened				stable
+amd64		default/linux/amd64/17.1/hardened/selinux			stable
+amd64		default/linux/amd64/17.1/desktop				stable
+amd64		default/linux/amd64/17.1/desktop/gnome				stable
+amd64		default/linux/amd64/17.1/desktop/gnome/systemd/merged-usr	stable
+amd64		default/linux/amd64/17.1/desktop/plasma				stable
+amd64		default/linux/amd64/17.1/desktop/plasma/systemd/merged-usr	stable
+amd64		default/linux/amd64/17.1/desktop/systemd/merged-usr		stable
 amd64		default/linux/amd64/17.1/developer				exp
-amd64		default/linux/amd64/17.1/no-multilib				exp
-amd64		default/linux/amd64/17.1/no-multilib/hardened			exp
-amd64		default/linux/amd64/17.1/no-multilib/hardened/selinux		exp
-amd64		default/linux/amd64/17.1/no-multilib/systemd/merged-usr		exp
+amd64		default/linux/amd64/17.1/no-multilib				stable
+amd64		default/linux/amd64/17.1/no-multilib/hardened			stable
+amd64		default/linux/amd64/17.1/no-multilib/hardened/selinux		stable
+amd64		default/linux/amd64/17.1/no-multilib/systemd/merged-usr		dev
 amd64		default/linux/amd64/17.1/no-multilib/systemd/selinux/merged-usr	exp
-amd64		default/linux/amd64/17.1/systemd/merged-usr			exp
+amd64		default/linux/amd64/17.1/systemd/merged-usr			stable
 amd64		default/linux/amd64/17.1/systemd/selinux/merged-usr		exp
 amd64		default/linux/amd64/17.1/clang					exp
 amd64		default/linux/amd64/17.1/systemd/clang/merged-usr		exp
@@ -92,7 +92,7 @@ amd64		default/linux/amd64/23.0/split-usr/hardened/selinux		stable
 
 # AMD64 Profiles
 # @MAINTAINER: amd64@gentoo.org
-amd64		default/linux/amd64/17.0/x32					exp
+amd64		default/linux/amd64/17.0/x32					dev
 amd64		default/linux/amd64/17.0/x32/systemd/merged-usr			exp
 amd64		default/linux/amd64/23.0/x32					dev
 amd64		default/linux/amd64/23.0/x32/systemd				exp
@@ -101,49 +101,49 @@ amd64		default/linux/amd64/23.0/split-usr/x32				exp
 
 # ARM Profiles
 # @MAINTAINER: arm@gentoo.org
-arm		default/linux/arm/17.0						exp
-arm		default/linux/arm/17.0/desktop					exp
-arm		default/linux/arm/17.0/desktop/gnome				exp
-arm		default/linux/arm/17.0/desktop/gnome/systemd/merged-usr		exp
-arm		default/linux/arm/17.0/desktop/plasma				exp
-arm		default/linux/arm/17.0/desktop/plasma/systemd/merged-usr	exp
+arm		default/linux/arm/17.0						stable
+arm		default/linux/arm/17.0/desktop					dev
+arm		default/linux/arm/17.0/desktop/gnome				dev
+arm		default/linux/arm/17.0/desktop/gnome/systemd/merged-usr		dev
+arm		default/linux/arm/17.0/desktop/plasma				dev
+arm		default/linux/arm/17.0/desktop/plasma/systemd/merged-usr	dev
 arm		default/linux/arm/17.0/developer				exp
-arm		default/linux/arm/17.0/armv4					exp
-arm		default/linux/arm/17.0/armv4/desktop				exp
-arm		default/linux/arm/17.0/armv4/desktop/gnome			exp
-arm		default/linux/arm/17.0/armv4/desktop/plasma			exp
+arm		default/linux/arm/17.0/armv4					dev
+arm		default/linux/arm/17.0/armv4/desktop				dev
+arm		default/linux/arm/17.0/armv4/desktop/gnome			dev
+arm		default/linux/arm/17.0/armv4/desktop/plasma			dev
 arm		default/linux/arm/17.0/armv4/developer				exp
-arm		default/linux/arm/17.0/armv4t					exp
-arm		default/linux/arm/17.0/armv4t/desktop				exp
-arm		default/linux/arm/17.0/armv4t/desktop/gnome			exp
-arm		default/linux/arm/17.0/armv4t/desktop/plasma			exp
+arm		default/linux/arm/17.0/armv4t					dev
+arm		default/linux/arm/17.0/armv4t/desktop				dev
+arm		default/linux/arm/17.0/armv4t/desktop/gnome			dev
+arm		default/linux/arm/17.0/armv4t/desktop/plasma			dev
 arm		default/linux/arm/17.0/armv4t/developer				exp
-arm		default/linux/arm/17.0/armv4t/systemd/merged-usr		exp
-arm		default/linux/arm/17.0/armv5te					exp
-arm		default/linux/arm/17.0/armv5te/desktop				exp
-arm		default/linux/arm/17.0/armv5te/desktop/gnome			exp
-arm		default/linux/arm/17.0/armv5te/desktop/plasma			exp
+arm		default/linux/arm/17.0/armv4t/systemd/merged-usr		dev
+arm		default/linux/arm/17.0/armv5te					dev
+arm		default/linux/arm/17.0/armv5te/desktop				dev
+arm		default/linux/arm/17.0/armv5te/desktop/gnome			dev
+arm		default/linux/arm/17.0/armv5te/desktop/plasma			dev
 arm		default/linux/arm/17.0/armv5te/developer			exp
-arm		default/linux/arm/17.0/armv5te/systemd/merged-usr		exp
-arm		default/linux/arm/17.0/armv6j					exp
+arm		default/linux/arm/17.0/armv5te/systemd/merged-usr		dev
+arm		default/linux/arm/17.0/armv6j					stable
 arm		default/linux/arm/17.0/armv6j/hardened				exp
 arm		default/linux/arm/17.0/armv6j/hardened/selinux			exp
-arm		default/linux/arm/17.0/armv6j/desktop				exp
-arm		default/linux/arm/17.0/armv6j/desktop/gnome			exp
-arm		default/linux/arm/17.0/armv6j/desktop/plasma			exp
+arm		default/linux/arm/17.0/armv6j/desktop				dev
+arm		default/linux/arm/17.0/armv6j/desktop/gnome			dev
+arm		default/linux/arm/17.0/armv6j/desktop/plasma			dev
 arm		default/linux/arm/17.0/armv6j/developer				exp
 arm		default/linux/arm/17.0/armv6j/selinux				exp
-arm		default/linux/arm/17.0/armv6j/systemd/merged-usr		exp
-arm		default/linux/arm/17.0/armv7a					exp
+arm		default/linux/arm/17.0/armv6j/systemd/merged-usr		dev
+arm		default/linux/arm/17.0/armv7a					stable
 arm		default/linux/arm/17.0/armv7a/hardened				exp
-arm		default/linux/arm/17.0/armv7a/hardened/selinux			exp
-arm		default/linux/arm/17.0/armv7a/desktop				exp
-arm		default/linux/arm/17.0/armv7a/desktop/gnome			exp
-arm		default/linux/arm/17.0/armv7a/desktop/gnome/systemd/merged-usr	exp
-arm		default/linux/arm/17.0/armv7a/desktop/plasma			exp
-arm		default/linux/arm/17.0/armv7a/desktop/plasma/systemd/merged-usr	exp
+arm		default/linux/arm/17.0/armv7a/hardened/selinux			dev
+arm		default/linux/arm/17.0/armv7a/desktop				dev
+arm		default/linux/arm/17.0/armv7a/desktop/gnome			dev
+arm		default/linux/arm/17.0/armv7a/desktop/gnome/systemd/merged-usr	dev
+arm		default/linux/arm/17.0/armv7a/desktop/plasma			dev
+arm		default/linux/arm/17.0/armv7a/desktop/plasma/systemd/merged-usr	dev
 arm		default/linux/arm/17.0/armv7a/developer				exp
-arm		default/linux/arm/17.0/armv7a/systemd/merged-usr		exp
+arm		default/linux/arm/17.0/armv7a/systemd/merged-usr		dev
 arm		default/linux/arm/23.0						stable
 arm		default/linux/arm/23.0/desktop					dev
 arm		default/linux/arm/23.0/desktop/gnome				dev
@@ -210,17 +210,17 @@ arm		default/linux/arm/23.0/split-usr/armv7a_hf/desktop/plasma	dev
 
 # ARM64 Profiles
 # @MAINTAINER: arm64@gentoo.org
-arm64		default/linux/arm64/17.0					exp
+arm64		default/linux/arm64/17.0					stable
 arm64		default/linux/arm64/17.0/hardened				exp
-arm64		default/linux/arm64/17.0/hardened/selinux			exp
-arm64		default/linux/arm64/17.0/desktop				exp
-arm64		default/linux/arm64/17.0/desktop/gnome				exp
-arm64		default/linux/arm64/17.0/desktop/gnome/systemd/merged-usr	exp
-arm64		default/linux/arm64/17.0/desktop/plasma				exp
-arm64		default/linux/arm64/17.0/desktop/plasma/systemd/merged-usr	exp
-arm64		default/linux/arm64/17.0/desktop/systemd/merged-usr		exp
+arm64		default/linux/arm64/17.0/hardened/selinux			dev
+arm64		default/linux/arm64/17.0/desktop				stable
+arm64		default/linux/arm64/17.0/desktop/gnome				stable
+arm64		default/linux/arm64/17.0/desktop/gnome/systemd/merged-usr	stable
+arm64		default/linux/arm64/17.0/desktop/plasma				stable
+arm64		default/linux/arm64/17.0/desktop/plasma/systemd/merged-usr	stable
+arm64		default/linux/arm64/17.0/desktop/systemd/merged-usr		stable
 arm64		default/linux/arm64/17.0/developer				exp
-arm64		default/linux/arm64/17.0/systemd/merged-usr			exp
+arm64		default/linux/arm64/17.0/systemd/merged-usr			stable
 arm64		default/linux/arm64/17.0/systemd/selinux/merged-usr		exp
 arm64		default/linux/arm64/17.0/llvm					exp
 arm64		default/linux/arm64/17.0/systemd/llvm/merged-usr		exp
@@ -259,9 +259,9 @@ arm64		default/linux/arm64/23.0/split-usr/big-endian			exp
 
 # HPPA Profiles
 # @MAINTAINER: hppa@gentoo.org
-hppa		default/linux/hppa/17.0						exp
+hppa		default/linux/hppa/17.0						stable
 hppa		default/linux/hppa/17.0/systemd/merged-usr			exp
-hppa		default/linux/hppa/17.0/desktop					exp
+hppa		default/linux/hppa/17.0/desktop					stable
 hppa		default/linux/hppa/17.0/developer				exp
 hppa		default/linux/hppa/23.0/hppa1.1					stable
 hppa		default/linux/hppa/23.0/hppa1.1/systemd				stable
@@ -279,10 +279,10 @@ hppa		default/linux/hppa/23.0/hppa2.0/split-usr/desktop		exp
 
 # IA64 Profiles
 # @MAINTAINER: ia64@gentoo.org
-ia64		default/linux/ia64/17.0						exp
-ia64		default/linux/ia64/17.0/desktop					exp
-ia64		default/linux/ia64/17.0/desktop/gnome				exp
-ia64		default/linux/ia64/17.0/desktop/gnome/systemd/merged-usr	exp
+ia64		default/linux/ia64/17.0						stable
+ia64		default/linux/ia64/17.0/desktop					stable
+ia64		default/linux/ia64/17.0/desktop/gnome				stable
+ia64		default/linux/ia64/17.0/desktop/gnome/systemd/merged-usr	stable
 ia64		default/linux/ia64/17.0/developer				exp
 ia64		default/linux/ia64/17.0/systemd/merged-usr			exp
 ia64		default/linux/ia64/23.0						stable
@@ -297,19 +297,19 @@ ia64		default/linux/ia64/23.0/split-usr/desktop/gnome			exp
 
 # LoongArch Profiles
 # @MAINTAINER: loong@gentoo.org
-loong		default/linux/loong/22.0/la64v100/lp64d						exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop					exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome				exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd			exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr	exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma				exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd			exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr	exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd				exp
-loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd/merged-usr		exp
+loong		default/linux/loong/22.0/la64v100/lp64d						stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop					stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome				dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd			dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/gnome/systemd/merged-usr	dev
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma				stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd			stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/plasma/systemd/merged-usr	stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd				stable
+loong		default/linux/loong/22.0/la64v100/lp64d/desktop/systemd/merged-usr		stable
 loong		default/linux/loong/22.0/la64v100/lp64d/developer				exp
-loong		default/linux/loong/22.0/la64v100/lp64d/systemd					exp
-loong		default/linux/loong/22.0/la64v100/lp64d/systemd/merged-usr			exp
+loong		default/linux/loong/22.0/la64v100/lp64d/systemd					stable
+loong		default/linux/loong/22.0/la64v100/lp64d/systemd/merged-usr			stable
 loong		default/linux/loong/23.0/la64v100/lp64d						stable
 loong		default/linux/loong/23.0/la64v100/lp64d/llvm					dev
 loong		default/linux/loong/23.0/la64v100/lp64d/llvm/systemd				dev
@@ -407,11 +407,11 @@ ppc		default/linux/powerpc/ppc64/17.0/32bit-userland/developer		exp
 
 # PPC profiles
 # @MAINTAINER: gyakovlev@gentoo.org, ppc@gentoo.org, musl@gentoo.org
-ppc		default/linux/ppc/17.0						exp
-ppc		default/linux/ppc/17.0/desktop					exp
-ppc		default/linux/ppc/17.0/desktop/gnome				exp
-ppc		default/linux/ppc/17.0/desktop/gnome/systemd/merged-usr		exp
-ppc		default/linux/ppc/17.0/systemd/merged-usr			exp
+ppc		default/linux/ppc/17.0						stable
+ppc		default/linux/ppc/17.0/desktop					stable
+ppc		default/linux/ppc/17.0/desktop/gnome				stable
+ppc		default/linux/ppc/17.0/desktop/gnome/systemd/merged-usr		stable
+ppc		default/linux/ppc/17.0/systemd/merged-usr			stable
 ppc		default/linux/ppc/17.0/developer				exp
 ppc		default/linux/ppc/23.0						stable
 ppc		default/linux/ppc/23.0/desktop					stable
@@ -425,11 +425,11 @@ ppc		default/linux/ppc/23.0/split-usr/desktop/gnome			stable
 
 # PPC64 profiles
 # @MAINTAINER: gyakovlev@gentoo.org, ppc64@gentoo.org, musl@gentoo.org
-ppc64		default/linux/ppc64/17.0					exp
-ppc64		default/linux/ppc64/17.0/desktop				exp
-ppc64		default/linux/ppc64/17.0/desktop/gnome				exp
-ppc64		default/linux/ppc64/17.0/desktop/gnome/systemd/merged-usr	exp
-ppc64		default/linux/ppc64/17.0/systemd/merged-usr			exp
+ppc64		default/linux/ppc64/17.0					stable
+ppc64		default/linux/ppc64/17.0/desktop				stable
+ppc64		default/linux/ppc64/17.0/desktop/gnome				stable
+ppc64		default/linux/ppc64/17.0/desktop/gnome/systemd/merged-usr	stable
+ppc64		default/linux/ppc64/17.0/systemd/merged-usr			stable
 ppc64		default/linux/ppc64/17.0/developer				exp
 ppc64		default/linux/ppc64/23.0					stable
 ppc64		default/linux/ppc64/23.0/desktop				stable
@@ -443,14 +443,14 @@ ppc64		default/linux/ppc64/23.0/split-usr/desktop/gnome		stable
 
 # PPC64LE profiles
 # @MAINTAINER: gyakovlev@gentoo.org, ppc64@gentoo.org, musl@gentoo.org
-ppc64		default/linux/ppc64le/17.0					exp
-ppc64		default/linux/ppc64le/17.0/desktop				exp
-ppc64		default/linux/ppc64le/17.0/desktop/gnome			exp
-ppc64		default/linux/ppc64le/17.0/desktop/gnome/systemd/merged-usr	exp
-ppc64		default/linux/ppc64le/17.0/desktop/plasma			exp
-ppc64		default/linux/ppc64le/17.0/desktop/plasma/systemd/merged-usr	exp
-ppc64		default/linux/ppc64le/17.0/desktop/systemd/merged-usr		exp
-ppc64		default/linux/ppc64le/17.0/systemd/merged-usr			exp
+ppc64		default/linux/ppc64le/17.0					stable
+ppc64		default/linux/ppc64le/17.0/desktop				stable
+ppc64		default/linux/ppc64le/17.0/desktop/gnome			stable
+ppc64		default/linux/ppc64le/17.0/desktop/gnome/systemd/merged-usr	stable
+ppc64		default/linux/ppc64le/17.0/desktop/plasma			stable
+ppc64		default/linux/ppc64le/17.0/desktop/plasma/systemd/merged-usr	stable
+ppc64		default/linux/ppc64le/17.0/desktop/systemd/merged-usr		stable
+ppc64		default/linux/ppc64le/17.0/systemd/merged-usr			stable
 ppc64		default/linux/ppc64le/17.0/developer				exp
 ppc64		default/linux/ppc64le/17.0/ieee-long-double			exp
 ppc64		default/linux/ppc64le/23.0					stable
@@ -469,30 +469,30 @@ ppc64		default/linux/ppc64le/23.0/split-usr/desktop/plasma		stable
 
 # RISC-V Profiles
 # @MAINTAINER: riscv@gentoo.org
-riscv		default/linux/riscv/20.0/rv64gc/lp64d					exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop				exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome/systemd		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome/systemd/merged-usr	exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma/systemd		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma/systemd/merged-usr	exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/systemd			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/systemd/merged-usr	exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/systemd				exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/systemd/merged-usr		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64					exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop				exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome/systemd		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome/systemd/merged-usr	exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma/systemd		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma/systemd/merged-usr	exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/systemd			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/systemd/merged-usr		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/systemd				exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/systemd/merged-usr			exp
+riscv		default/linux/riscv/20.0/rv64gc/lp64d					stable
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop				dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome/systemd		dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/gnome/systemd/merged-usr	dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma/systemd		dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/plasma/systemd/merged-usr	dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/systemd			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/desktop/systemd/merged-usr	dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/systemd				stable
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/systemd/merged-usr		stable
+riscv		default/linux/riscv/20.0/rv64gc/lp64					stable
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop				dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome/systemd		dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/gnome/systemd/merged-usr	dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma/systemd		dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/plasma/systemd/merged-usr	dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/systemd			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/desktop/systemd/merged-usr		dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/systemd				stable
+riscv		default/linux/riscv/20.0/rv64gc/lp64/systemd/merged-usr			stable
 riscv		default/linux/riscv/20.0/rv64gc/multilib				exp
 riscv		default/linux/riscv/20.0/rv64gc/multilib/systemd			exp
 riscv		default/linux/riscv/20.0/rv64gc/multilib/systemd/merged-usr		exp
@@ -533,9 +533,9 @@ riscv		default/linux/riscv/23.0/rv32/split-usr/ilp32				exp
 
 # S390 Profiles
 # @MAINTAINER: s390@gentoo.org
-s390		default/linux/s390/17.0						exp
-s390		default/linux/s390/17.0/s390x					exp
-s390		default/linux/s390/17.0/systemd/merged-usr			exp
+s390		default/linux/s390/17.0						stable
+s390		default/linux/s390/17.0/s390x					stable
+s390		default/linux/s390/17.0/systemd/merged-usr			stable
 s390		default/linux/s390/17.0/s390x/systemd/merged-usr		exp
 s390		default/linux/s390/23.0						stable
 s390		default/linux/s390/23.0/systemd					dev
@@ -547,14 +547,14 @@ s390		default/linux/s390/23.0/s390x/systemd				stable
 
 # SPARC Profiles
 # @MAINTAINER: sparc@gentoo.org
-sparc		default/linux/sparc/17.0					exp
-sparc		default/linux/sparc/17.0/desktop				exp
+sparc		default/linux/sparc/17.0					stable
+sparc		default/linux/sparc/17.0/desktop				stable
 sparc		default/linux/sparc/17.0/developer				exp
-sparc		default/linux/sparc/17.0/systemd/merged-usr			exp
-sparc		default/linux/sparc/17.0/64ul					exp
-sparc		default/linux/sparc/17.0/64ul/desktop				exp
+sparc		default/linux/sparc/17.0/systemd/merged-usr			stable
+sparc		default/linux/sparc/17.0/64ul					stable
+sparc		default/linux/sparc/17.0/64ul/desktop				stable
 sparc		default/linux/sparc/17.0/64ul/developer				exp
-sparc		default/linux/sparc/17.0/64ul/systemd/merged-usr		exp
+sparc		default/linux/sparc/17.0/64ul/systemd/merged-usr		stable
 sparc		default/linux/sparc/23.0					stable
 sparc		default/linux/sparc/23.0/desktop				dev
 sparc		default/linux/sparc/23.0/systemd				dev
@@ -569,17 +569,17 @@ sparc		default/linux/sparc/23.0/split-usr/64ul/desktop			stable
 
 # x86 Profiles
 # @MAINTAINER: x86@gentoo.org
-x86		default/linux/x86/17.0						exp
-x86		default/linux/x86/17.0/selinux					exp
-x86		default/linux/x86/17.0/hardened					exp
-x86		default/linux/x86/17.0/hardened/selinux				exp
-x86		default/linux/x86/17.0/desktop					exp
-x86		default/linux/x86/17.0/desktop/gnome				exp
-x86		default/linux/x86/17.0/desktop/gnome/systemd/merged-usr		exp
-x86		default/linux/x86/17.0/desktop/plasma				exp
-x86		default/linux/x86/17.0/desktop/plasma/systemd/merged-usr	exp
+x86		default/linux/x86/17.0						stable
+x86		default/linux/x86/17.0/selinux					stable
+x86		default/linux/x86/17.0/hardened					stable
+x86		default/linux/x86/17.0/hardened/selinux				stable
+x86		default/linux/x86/17.0/desktop					stable
+x86		default/linux/x86/17.0/desktop/gnome				stable
+x86		default/linux/x86/17.0/desktop/gnome/systemd/merged-usr		stable
+x86		default/linux/x86/17.0/desktop/plasma				stable
+x86		default/linux/x86/17.0/desktop/plasma/systemd/merged-usr	stable
 x86		default/linux/x86/17.0/developer				exp
-x86		default/linux/x86/17.0/systemd/merged-usr			exp
+x86		default/linux/x86/17.0/systemd/merged-usr			stable
 x86		default/linux/x86/23.0/i686					stable
 x86		default/linux/x86/23.0/i686/systemd				stable
 x86		default/linux/x86/23.0/i686/hardened				stable
@@ -614,7 +614,7 @@ x86		default/linux/x86/23.0/i486/split-usr/hardened/selinux		dev
 
 # musl profiles
 # @MAINTAINER: musl@gentoo.org
-amd64		default/linux/amd64/17.0/musl					exp
+amd64		default/linux/amd64/17.0/musl					dev
 amd64		default/linux/amd64/17.0/musl/clang				exp
 amd64		default/linux/amd64/17.0/musl/hardened				exp
 amd64		default/linux/amd64/17.0/musl/hardened/selinux			exp
@@ -626,10 +626,10 @@ amd64		default/linux/amd64/23.0/split-usr/musl				dev
 amd64		default/linux/amd64/23.0/split-usr/musl/llvm			exp
 amd64		default/linux/amd64/23.0/split-usr/musl/hardened		exp
 amd64		default/linux/amd64/23.0/split-usr/musl/hardened/selinux	exp
-arm		default/linux/arm/17.0/musl/armv6j				exp
+arm		default/linux/arm/17.0/musl/armv6j				dev
 arm		default/linux/arm/17.0/musl/armv6j/hardened			exp
 arm		default/linux/arm/17.0/musl/armv6j/hardened/selinux		exp
-arm		default/linux/arm/17.0/musl/armv7a				exp
+arm		default/linux/arm/17.0/musl/armv7a				dev
 arm		default/linux/arm/17.0/musl/armv7a/hardened			exp
 arm		default/linux/arm/17.0/musl/armv7a/hardened/selinux		exp
 arm		default/linux/arm/23.0/armv6j_hf/musl				dev
@@ -644,7 +644,7 @@ arm		default/linux/arm/23.0/split-usr/armv6j_hf/musl/hardened/selinux	exp
 arm		default/linux/arm/23.0/split-usr/armv7a_hf/musl			dev
 arm		default/linux/arm/23.0/split-usr/armv7a_hf/musl/hardened		exp
 arm		default/linux/arm/23.0/split-usr/armv7a_hf/musl/hardened/selinux	exp
-arm64		default/linux/arm64/17.0/musl					exp
+arm64		default/linux/arm64/17.0/musl					dev
 arm64		default/linux/arm64/17.0/musl/llvm				exp
 arm64		default/linux/arm64/17.0/musl/hardened				exp
 arm64		default/linux/arm64/17.0/musl/hardened/selinux			exp
@@ -671,26 +671,26 @@ mips		default/linux/mips/23.0/split-usr/mipsel/o32/musl		exp
 mips		default/linux/mips/23.0/split-usr/mipsel/n64/musl		exp
 mips		default/linux/mips/23.0/split-usr/o32/musl			exp
 mips		default/linux/mips/23.0/split-usr/n64/musl			exp
-ppc		default/linux/ppc/17.0/musl					exp
+ppc		default/linux/ppc/17.0/musl					dev
 ppc		default/linux/ppc/17.0/musl/hardened				exp
 ppc		default/linux/ppc/23.0/musl					dev
 ppc		default/linux/ppc/23.0/musl/hardened				exp
 ppc		default/linux/ppc/23.0/split-usr/musl				dev
 ppc		default/linux/ppc/23.0/split-usr/musl/hardened			exp
-ppc64		default/linux/ppc64/17.0/musl					exp
+ppc64		default/linux/ppc64/17.0/musl					dev
 ppc64		default/linux/ppc64/17.0/musl/hardened				exp
 ppc64		default/linux/ppc64/23.0/musl					dev
 ppc64		default/linux/ppc64/23.0/musl/hardened				exp
 ppc64		default/linux/ppc64/23.0/split-usr/musl				dev
 ppc64		default/linux/ppc64/23.0/split-usr/musl/hardened		exp
-ppc64		default/linux/ppc64le/17.0/musl					exp
+ppc64		default/linux/ppc64le/17.0/musl					dev
 ppc64		default/linux/ppc64le/17.0/musl/hardened			exp
 ppc64		default/linux/ppc64le/23.0/musl					dev
 ppc64		default/linux/ppc64le/23.0/musl/hardened			exp
 ppc64		default/linux/ppc64le/23.0/split-usr/musl			dev
 ppc64		default/linux/ppc64le/23.0/split-usr/musl/hardened		exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64d/musl			exp
-riscv		default/linux/riscv/20.0/rv64gc/lp64/musl			exp
+riscv		default/linux/riscv/20.0/rv64gc/lp64d/musl			dev
+riscv		default/linux/riscv/20.0/rv64gc/lp64/musl			dev
 riscv		default/linux/riscv/23.0/rv64/lp64d/musl			dev
 riscv		default/linux/riscv/23.0/rv64/lp64/musl				dev
 riscv		default/linux/riscv/23.0/rv64/split-usr/lp64d/musl		dev
@@ -699,7 +699,7 @@ riscv		default/linux/riscv/23.0/rv32/ilp32d/musl			exp
 riscv		default/linux/riscv/23.0/rv32/ilp32/musl			exp
 riscv		default/linux/riscv/23.0/rv32/split-usr/ilp32d/musl		exp
 riscv		default/linux/riscv/23.0/rv32/split-usr/ilp32/musl		exp
-x86		default/linux/x86/17.0/musl					exp
+x86		default/linux/x86/17.0/musl					dev
 x86		default/linux/x86/17.0/musl/selinux				exp
 x86		default/linux/x86/23.0/i686/musl				dev
 x86		default/linux/x86/23.0/i686/musl/selinux			exp
diff --git a/sdk_container/src/third_party/portage-stable/profiles/releases/17.0/package.mask b/sdk_container/src/third_party/portage-stable/profiles/releases/17.0/package.mask
index 3c95fbece0..3a36d4e863 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/releases/17.0/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/releases/17.0/package.mask
@@ -1,7 +1,8 @@
-# Copyright 2023 Gentoo Authors
+# Copyright 2023-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Andreas K. Hüttel <dilfridge@gentoo.org> (2023-12-07)
 # Does not support split-usr filesystem geometry. Please migrate to
 # a merged-usr profile.
 >=sys-apps/systemd-255
+>=sys-process/systemd-cron-2.3.4-r1
diff --git a/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/make.defaults
index 9680364430..ddff032c12 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/make.defaults
@@ -1,14 +1,11 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # See also 
 # https://wiki.gentoo.org/wiki/Project:Toolchain/23.0_profile_transition
 
-# This just makes sense nowadays, if only for distfiles...
-USE="lzma zstd"
-
 # make sure toolchain has sane defaults <toolchain@gentoo.org>
-USE="${USE} openmp"
+USE="openmp"
 
 # bug 818376 (only on specific arches)
 LDFLAGS="-Wl,-O1 -Wl,--as-needed"
@@ -19,5 +16,5 @@ LDFLAGS="-Wl,-O1 -Wl,--as-needed"
 UNINSTALL_IGNORE="${UNINSTALL_IGNORE} /bin /lib /lib32 /lib64 /libx32 /sbin /usr/sbin"
 UNINSTALL_IGNORE="${UNINSTALL_IGNORE} /usr/lib/modules/*"
 
-# needed for llvm profiles
+# needed for llvm profiles, we may want to solve this in releng.git instead
 BOOTSTRAP_USE="${BOOTSTRAP_USE} zstd"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/package.use b/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/package.use
new file mode 100644
index 0000000000..c7d461f9ed
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/releases/23.0/package.use
@@ -0,0 +1,11 @@
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2024-04-10)
+# We want the toolchain to use zstd compression for LTO objects and
+# debug information
+#
+sys-devel/gcc zstd
+sys-devel/binutils zstd
+sys-devel/llvm zstd
+sys-devel/lld zstd
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2024 b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2024
index 2dd66dabca..1d932e292f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2024
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2024
@@ -1,2 +1,6 @@
 move dev-python/lazy_loader dev-python/lazy-loader
 slotmove dev-lang/clojure 1.11 0
+slotmove dev-java/gson 2.6 0
+slotmove dev-java/icu4j 70 0
+move dev-python/django_polymorphic dev-python/django-polymorphic
+move dev-python/octave_kernel dev-python/octave-kernel
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r1.ebuild
index 8eb01adfb4..d265f5bd1b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/acl/acl-2.3.2-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
 
 LICENSE="LGPL-2.1+ GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="nls static-libs"
 
 RDEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
index e9590ef2c9..850befff79 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/attr/attr-2.5.2-r1.ebuild
@@ -12,7 +12,7 @@ else
 	inherit libtool
 
 	SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 fi
 
 DESCRIPTION="Extended attributes tools"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.7.ebuild
index 68d44d2fc6..b84034311c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.7.ebuild
@@ -9,7 +9,7 @@ SRC_URI="https://www.kernel.org/pub/software/network/ethtool/${P}.tar.xz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv sparc x86"
 IUSE="+netlink"
 
 RDEPEND="netlink? ( net-libs/libmnl )"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
index 4947c83e89..f822d86333 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/file/file-5.45-r4.ebuild
@@ -18,7 +18,7 @@ else
 	SRC_URI="ftp://ftp.astron.com/pub/file/${P}.tar.gz"
 	SRC_URI+=" verify-sig? ( ftp://ftp.astron.com/pub/file/${P}.tar.gz.asc )"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-file )"
 fi
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index 2b69febe4c..3fdc9c03c9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -1 +1,2 @@
 DIST iproute2-6.6.0.tar.xz 917964 BLAKE2B 9d20f19c04c2bbde7a3ae53e61e4623b119570c8446f34b93ddadd64677caa432e00ee085498bc277e0842cc2124340c7100925106d0ef2c11dd8002aacac08f SHA512 21c99a3ba8e1d0047933e99b48fb00901eef18899cd5854000ae910d9d84d13aeafa48b32184775531285782909f4d283d0784491691a1f10462dab147de359d
+DIST iproute2-6.8.0.tar.xz 913512 BLAKE2B d30cdff8522627c27c9165f068f42adbec38f15548a8f2cd31276f283880dc402e10c5989e7227e80cdc891bcc4a574b330d634ae550e689758b849c0506c31f SHA512 54e50340a73c8810d69bfd54704b469149731634a97d94da08b5a305592a812131a441e5b646e32b480d61840e2ade29387e54b934effeee8ded4f06e557a5c0
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-configure-nomagic-nolibbsd.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-configure-nomagic-nolibbsd.patch
new file mode 100644
index 0000000000..04ef44ad82
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-configure-nomagic-nolibbsd.patch
@@ -0,0 +1,243 @@
+The hand-rolled configure script, for multiple options (selinux,mnl,elf), sets
+a variable as well as modifying CFLAGS & LDLIBS.
+
+If config.mk is later amended to disable a feature, the CFLAGS/LDLIBS tweaks
+are still in place.
+
+Push the CFLAGS/LDLIBS changes into new conditional Makefile code, so that they
+are only passed when correctly needed.
+
+Prior Gentoo testcase for reproduction:
+USE=minimal ebuild ... compile.
+- Linking with libbsd, libelf, libmnl & libcap based only on presence.
+- Links based on libselinux based only on presence.
+
+Closes: https://bugs.gentoo.org/643722
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+Forward-ported from v4.14.1 to v4.16.0 by Lars Wendler <polynomial-c@gentoo.org>
+Added libcap to v4.17.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.17.0 to v4.20.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.20.0 to v5.11.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v5.11.0 to v5.12.0 by Lars Wendler <polynomial-c@gentoo.org>
+
+Update 2023-09-05: Removed libbsd enforcement from config.include for bug #911727
+by Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- a/config.include
++++ b/config.include
+@@ -0,0 +1,26 @@
++# We can only modify CFLAGS/LDLIBS after all the config options are known.
++ifeq ($(IP_CONFIG_SETNS),y)
++	CFLAGS += $(IP_CONFIG_SETNS_CFLAGS)
++endif
++ifeq ($(HAVE_ELF),y)
++	CFLAGS += $(HAVE_ELF_CFLAGS)
++	LDLIBS += $(HAVE_ELF_LDLIBS)
++endif
++ifeq ($(HAVE_SELINUX),y)
++	CFLAGS += $(HAVE_SELINUX_CFLAGS)
++	LDLIBS += $(HAVE_SELINUX_LDLIBS)
++endif
++ifeq ($(HAVE_MNL),y)
++	CFLAGS += $(HAVE_MNL_CFLAGS)
++	LDLIBS += $(HAVE_MNL_LDLIBS)
++endif
++ifeq ($(HAVE_CAP),y)
++	CFLAGS += $(HAVE_CAP_CFLAGS)
++	LDLIBS += $(HAVE_CAP_LDLIBS)
++endif
++
++# Rules can only be declared after all variables in them are known.
++%.o: %.c
++	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<
++
++# vim: ft=make:
+
+--- a/bridge/Makefile
++++ b/bridge/Makefile
+@@ -2,6 +2,7 @@
+ BROBJ = bridge.o fdb.o monitor.o link.o mdb.o vlan.o vni.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ all: bridge
+ 
+--- a/configure
++++ b/configure
+@@ -154,7 +154,7 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/setnstest $TMPDIR/setnstest.c >/dev/null 2>&1; then
+ 	echo "IP_CONFIG_SETNS:=y" >>$CONFIG
+ 	echo "yes"
+-	echo "CFLAGS += -DHAVE_SETNS" >>$CONFIG
++	echo "IP_CONFIG_SETNS_CFLAGS += -DHAVE_SETNS" >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -221,8 +221,8 @@ check_elf()
+ 	echo "HAVE_ELF:=y" >>$CONFIG
+ 	echo "yes"
+ 
+-	echo 'CFLAGS += -DHAVE_ELF' "$(${PKG_CONFIG} libelf --cflags)" >> $CONFIG
+-	echo 'LDLIBS += ' "$(${PKG_CONFIG} libelf --libs)" >>$CONFIG
++	echo 'HAVE_ELF_CFLAGS += -DHAVE_ELF' "$(${PKG_CONFIG} libelf --cflags)" >> $CONFIG
++	echo 'HAVE_ELF_LDLIBS += ' "$(${PKG_CONFIG} libelf --libs)" >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -340,8 +340,8 @@ check_selinux()
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'LDLIBS +=' "$(${PKG_CONFIG} --libs libselinux)" >>$CONFIG
+-		echo 'CFLAGS += -DHAVE_SELINUX' "$(${PKG_CONFIG} --cflags libselinux)" >>$CONFIG
++		echo 'HAVE_SELINUX_LDLIBS +=' "$(${PKG_CONFIG} --libs libselinux)" >>$CONFIG
++		echo 'HAVE_SELINUX_CFLAGS += -DHAVE_SELINUX' "$(${PKG_CONFIG} --cflags libselinux)" >>$CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -366,8 +366,8 @@ check_mnl()
+ 		echo "HAVE_MNL:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBMNL' "$(${PKG_CONFIG} libmnl --cflags)" >>$CONFIG
+-		echo 'LDLIBS +=' "$(${PKG_CONFIG} libmnl --libs)" >> $CONFIG
++		echo 'HAVE_MNL_CFLAGS += -DHAVE_LIBMNL' "$(${PKG_CONFIG} libmnl --cflags)" >>$CONFIG
++		echo 'HAVE_MNL_LDLIBS +=' "$(${PKG_CONFIG} libmnl --libs)" >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -408,8 +408,8 @@ EOF
+ 	echo "no"
+     else
+ 	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'CFLAGS += -DHAVE_LIBBSD' "$(${PKG_CONFIG} libbsd --cflags)" >>$CONFIG
+-		echo 'LDLIBS +=' "$(${PKG_CONFIG} libbsd --libs)" >> $CONFIG
++		echo 'HAVE_LIBBSD_CFLAGS += -DHAVE_LIBBSD' "$(${PKG_CONFIG} libbsd --cflags)" >>$CONFIG
++		echo 'HAVE_LIBBSD_LDLIBS +=' "$(${PKG_CONFIG} libbsd --libs)" >> $CONFIG
+ 		echo "no"
+ 	else
+ 		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+@@ -425,8 +425,8 @@ check_cap()
+ 		echo "HAVE_CAP:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBCAP' "$(${PKG_CONFIG} libcap --cflags)" >>$CONFIG
+-		echo 'LDLIBS +=' "$(${PKG_CONFIG} libcap --libs)" >> $CONFIG
++		echo 'HAVE_CAP_CFLAGS += -DHAVE_LIBCAP' "$(${PKG_CONFIG} libcap --cflags)" >>$CONFIG
++		echo 'HAVE_CAP_LDLIBS +=' "$(${PKG_CONFIG} libcap --libs)" >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -614,7 +614,3 @@ check_cap
+ 
+ echo -n "color output: "
+ check_color
+-
+-echo >> $CONFIG
+-echo "%.o: %.c" >> $CONFIG
+-echo '	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<' >> $CONFIG
+--- a/dcb/Makefile
++++ b/dcb/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DCBOBJ = dcb.o \
+          dcb_app.o \
+--- a/devlink/Makefile
++++ b/devlink/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DEVLINKOBJ = devlink.o mnlg.o
+ TARGETS += devlink
+--- a/genl/Makefile
++++ b/genl/Makefile
+@@ -2,6 +2,7 @@
+ GENLOBJ=genl.o
+ 
+ include ../config.mk
++include ../config.include
+ SHARED_LIBS ?= y
+ 
+ CFLAGS += -fno-strict-aliasing
+--- a/ip/Makefile
++++ b/ip/Makefile
+@@ -18,6 +18,7 @@ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
+ RTMONOBJ=rtmon.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ALLOBJ=$(IPOBJ) $(RTMONOBJ)
+ SCRIPTS=routel
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -fPIC
+ 
+--- a/misc/Makefile
++++ b/misc/Makefile
+@@ -5,6 +5,7 @@ LNSTATOBJ=lnstat.o lnstat_util.o
+ TARGETS=ss nstat ifstat rtacct lnstat
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ifeq ($(HAVE_BERKELEY_DB),y)
+ 	TARGETS += arpd
+--- a/netem/Makefile
++++ b/netem/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DISTGEN = maketable normal pareto paretonormal
+ DISTDATA = normal.dist pareto.dist paretonormal.dist experimental.dist
+--- a/rdma/Makefile
++++ b/rdma/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -I./include/uapi/
+ 
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -4,6 +4,7 @@ TCOBJ= tc.o tc_qdisc.o tc_class.o tc_filter.o tc_util.o tc_monitor.o \
+        emp_ematch.tab.o emp_ematch.lex.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ SHARED_LIBS ?= y
+ 
+--- a/tipc/Makefile
++++ b/tipc/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TIPCOBJ=bearer.o \
+     cmdl.o link.o \
+--- a/vdpa/Makefile
++++ b/vdpa/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -I./include/uapi/
+ VDPAOBJ = vdpa.o
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-disable-libbsd-fallback.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-disable-libbsd-fallback.patch
new file mode 100644
index 0000000000..0c1eef2274
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.8.0-disable-libbsd-fallback.patch
@@ -0,0 +1,25 @@
+
+Disable the optional libbsd fallback in favor of iproute2's own
+strlcat/strlcpy routines. This prevents automagic linking and
+all sorts of other related problems.
+
+Bug: https://bugs.gentoo.org/911727
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- a/configure
++++ b/configure
+@@ -407,14 +407,8 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
+ 	echo "no"
+     else
+-	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'HAVE_LIBBSD_CFLAGS += -DHAVE_LIBBSD' "$(${PKG_CONFIG} libbsd --cflags)" >>$CONFIG
+-		echo 'HAVE_LIBBSD_LDLIBS +=' "$(${PKG_CONFIG} libbsd --libs)" >> $CONFIG
+-		echo "no"
+-	else
+ 		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+ 		echo "yes"
+-	fi
+     fi
+     rm -f $TMPDIR/strtest.c $TMPDIR/strtest
+ }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.8.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.8.0-r2.ebuild
new file mode 100644
index 0000000000..c5ab1aee14
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.8.0-r2.ebuild
@@ -0,0 +1,213 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs flag-o-matic
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
+	inherit git-r3
+else
+	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="kernel routing and traffic control utilities"
+HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+# Needs root
+RESTRICT="test"
+
+# We could make libmnl optional, but it's tiny, so eh
+RDEPEND="
+	!net-misc/arpd
+	!minimal? ( net-libs/libmnl:= )
+	atm? ( net-dialup/linux-atm )
+	berkdb? ( sys-libs/db:= )
+	bpf? ( dev-libs/libbpf:= )
+	caps? ( sys-libs/libcap )
+	elf? ( virtual/libelf:= )
+	iptables? ( >=net-firewall/iptables-1.4.20:= )
+	nfs? ( net-libs/libtirpc:= )
+	selinux? ( sys-libs/libselinux )
+"
+# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
+DEPEND="
+	${RDEPEND}
+	>=sys-kernel/linux-headers-3.16
+"
+BDEPEND="
+	app-arch/xz-utils
+	>=sys-devel/bison-2.4
+	app-alternatives/lex
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-6.5.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
+)
+
+src_prepare() {
+	default
+
+	# Fix version if necessary
+	local versionfile="include/version.h"
+	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
+		einfo "Fixing version string"
+		sed -i "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
+			${versionfile} || die
+	fi
+
+	# echo -n is not POSIX compliant
+	sed -i 's@echo -n@printf@' configure || die
+
+	sed -i \
+		-e '/^CC :\?=/d' \
+		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
+		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
+		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
+		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
+		Makefile || die
+
+	# Build against system headers
+	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
+	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
+
+	if use minimal ; then
+		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
+	fi
+}
+
+src_configure() {
+	tc-export AR CC PKG_CONFIG
+
+	# This sure is ugly. Should probably move into toolchain-funcs at some point.
+	local setns
+	pushd "${T}" >/dev/null || die
+	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
+	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
+		setns=y
+	else
+		setns=n
+	fi
+
+	echo 'int main(){return 0;}' > test.c || die
+	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
+		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
+	fi
+	popd >/dev/null || die
+
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
+	# run "configure" script first which will create "config.mk"...
+	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
+	edo ./configure --color=auto --libbpf_force $(usex bpf on off)
+
+	# Remove the definitions made by configure and allow them to be overridden
+	# by USE flags below.
+	# We have to do the cheesy only-sed-if-disabled because otherwise
+	# the *_FLAGS etc stuff found by configure will be used but result
+	# in a broken build.
+	if ! use berkdb ; then
+		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
+	fi
+
+	if ! use caps ; then
+		sed -i -e '/HAVE_CAP/d' config.mk || die
+	fi
+
+	if use minimal ; then
+		sed -i -e '/HAVE_MNL/d' config.mk || die
+	fi
+
+	if ! use elf ; then
+		sed -i -e '/HAVE_ELF/d' config.mk || die
+	fi
+
+	if ! use nfs ; then
+		sed -i -e '/HAVE_RPC/d' config.mk || die
+	fi
+
+	if ! use selinux ; then
+		sed -i -e '/HAVE_SELINUX/d' config.mk || die
+	fi
+
+	# ...Now switch on/off requested features via USE flags
+	# this is only useful if the test did not set other things, per bug #643722
+	# Keep in sync with ifs above, or refactor to be unified.
+	cat <<-EOF >> config.mk
+	TC_CONFIG_ATM := $(usex atm y n)
+	TC_CONFIG_XT  := $(usex iptables y n)
+	TC_CONFIG_NO_XT := $(usex iptables n y)
+	# We've locked in recent enough kernel headers, bug #549948
+	TC_CONFIG_IPSET := y
+	HAVE_BERKELEY_DB := $(usex berkdb y n)
+	HAVE_CAP      := $(usex caps y n)
+	HAVE_MNL      := $(usex minimal n y)
+	HAVE_ELF      := $(usex elf y n)
+	HAVE_RPC      := $(usex nfs y n)
+	HAVE_SELINUX  := $(usex selinux y n)
+	IP_CONFIG_SETNS := ${setns}
+	# Use correct iptables dir, bug #144265, bug #293709
+	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
+	EOF
+}
+
+src_compile() {
+	emake V=1 NETNS_RUN_DIR=/run/netns
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	if use minimal ; then
+		into /
+		dosbin tc/tc
+		dobin ip/ip
+		return 0
+	fi
+
+	emake \
+		DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="${EPREFIX}"/$(get_libdir) \
+		SBINDIR="${EPREFIX}"/sbin \
+		CONFDIR="${EPREFIX}"/etc/iproute2 \
+		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		ARPDDIR="${EPREFIX}"/var/lib/arpd \
+		install
+
+	dodir /bin
+	mv "${ED}"/{s,}bin/ip || die # bug #330115
+	mv "${ED}"/{s,}bin/ss || die # bug #547264
+
+	dolib.a lib/libnetlink.a
+	insinto /usr/include
+	doins include/libnetlink.h
+
+	# Collides with net-analyzer/ifstat
+	# https://bugs.gentoo.org/868321
+	mv "${ED}"/sbin/ifstat{,-iproute2} || die
+
+	if use berkdb ; then
+		keepdir /var/lib/arpd
+		# bug #47482, arpd doesn't need to be in /sbin
+		dodir /usr/bin
+		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
+	elif [[ -d "${ED}"/var/lib/arpd ]]; then
+		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index 0d61a15abb..bfc78c186a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit edo toolchain-funcs
+inherit edo toolchain-funcs flag-o-matic
 
 if [[ ${PV} == 9999 ]] ; then
 	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
@@ -18,7 +18,7 @@ HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux split-usr"
 # Needs root
 RESTRICT="test"
 
@@ -49,9 +49,9 @@ BDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-6.5.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-6.5.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
+	"${FILESDIR}"/${PN}-6.8.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
 	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
-	"${FILESDIR}"/${PN}-6.4.0-disable-libbsd-fallback.patch # bug #911727
+	"${FILESDIR}"/${PN}-6.8.0-disable-libbsd-fallback.patch # bug #911727
 )
 
 src_prepare() {
@@ -104,9 +104,14 @@ src_configure() {
 	fi
 	popd >/dev/null || die
 
+	# build system does not pass CFLAGS to LDFLAGS, as is recommended by GCC upstream
+	# https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-flto
+	# https://bugs.gentoo.org/929233
+	append-ldflags ${CFLAGS}
+
 	# run "configure" script first which will create "config.mk"...
 	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	edo ./configure --libbpf_force $(usex bpf on off)
+	edo ./configure --color=auto --libbpf_force $(usex bpf on off)
 
 	# Remove the definitions made by configure and allow them to be overridden
 	# by USE flags below.
@@ -187,7 +192,6 @@ src_install() {
 
 	dodir /bin
 	mv "${ED}"/{s,}bin/ip || die # bug #330115
-	mv "${ED}"/{s,}bin/ss || die # bug #547264
 
 	dolib.a lib/libnetlink.a
 	insinto /usr/include
@@ -197,6 +201,13 @@ src_install() {
 	# https://bugs.gentoo.org/868321
 	mv "${ED}"/sbin/ifstat{,-iproute2} || die
 
+	if use split-usr ; then
+		# Can remove compatibility symlink in a year: 2023-05-28.
+		# bug #547264
+		mv "${ED}"/sbin/ss "${ED}"/bin/ss || die
+		dosym -r /bin/ss /sbin/ss
+	fi
+
 	if use berkdb ; then
 		keepdir /var/lib/arpd
 		# bug #47482, arpd doesn't need to be in /sbin
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-643-LESSOPEN-escape.patch b/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-643-LESSOPEN-escape.patch
new file mode 100644
index 0000000000..f3fe50fcfa
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/files/less-643-LESSOPEN-escape.patch
@@ -0,0 +1,61 @@
+https://openwall.com/lists/oss-security/2024/04/12/5
+https://bugs.gentoo.org/929210
+https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33
+
+Upstream provided this version via email as a backport to 643.
+--- a/filename.c
++++ b/filename.c
+@@ -134,6 +134,15 @@
+ }
+ 
+ /*
++ * Must use quotes rather than escape char for this metachar?
++ */
++static int must_quote(char c)
++{
++	/* {{ Maybe the set of must_quote chars should be configurable? }} */
++	return (c == '\n'); 
++}
++
++/*
+  * Insert a backslash before each metacharacter in a string.
+  */
+ public char * shell_quote(char *s)
+@@ -164,6 +173,9 @@
+ 				 * doesn't support escape chars.  Use quotes.
+ 				 */
+ 				use_quotes = 1;
++			} else if (must_quote(*p))
++			{
++				len += 3; /* open quote + char + close quote */
+ 			} else
+ 			{
+ 				/*
+@@ -193,15 +205,22 @@
+ 	{
+ 		while (*s != '\0')
+ 		{
+-			if (metachar(*s))
++			if (!metachar(*s))
+ 			{
+-				/*
+-				 * Add the escape char.
+-				 */
++				*p++ = *s++;
++			} else if (must_quote(*s))
++			{
++				/* Surround the char with quotes. */
++				*p++ = openquote;
++				*p++ = *s++;
++				*p++ = closequote;
++			} else
++			{
++				/* Insert an escape char before the char. */
+ 				strcpy(p, esc);
+ 				p += esclen;
++				*p++ = *s++;
+ 			}
+-			*p++ = *s++;
+ 		}
+ 		*p = '\0';
+ 	}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/less/less-643-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-643-r2.ebuild
new file mode 100644
index 0000000000..1f7bfd5f8c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/less/less-643-r2.ebuild
@@ -0,0 +1,97 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Releases are usually first a beta then promoted to stable if no
+# issues were found. Upstream explicitly ask "to not generally distribute"
+# the beta versions. It's okay to keyword beta versions if they fix
+# a serious bug, but otherwise try to avoid it.
+
+WANT_AUTOMAKE=none
+WANT_LIBTOOL=none
+inherit autotools flag-o-matic optfeature toolchain-funcs
+
+DESCRIPTION="Excellent text file viewer"
+HOMEPAGE="https://www.greenwoodsoftware.com/less/"
+
+MY_PV=${PV/_beta/-beta}
+MY_P=${PN}-${MY_PV}
+
+if [[ ${PV} == 9999 ]]; then
+	EGIT_REPO_URI="https://github.com/gwsw/less"
+	inherit git-r3
+else
+	SRC_URI="https://www.greenwoodsoftware.com/less/${MY_P}.tar.gz"
+
+	if [[ ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+S="${WORKDIR}"/${MY_P/?beta}
+
+LICENSE="|| ( GPL-3 BSD-2 )"
+SLOT="0"
+IUSE="pcre test"
+# chinese1, utf8-2
+RESTRICT="test !test? ( test )"
+
+DEPEND="
+	>=app-misc/editor-wrapper-3
+	>=sys-libs/ncurses-5.2:=
+	pcre? ( dev-libs/libpcre2 )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="test? ( virtual/pkgconfig )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-643-lesstest-pkg-config.patch
+	"${FILESDIR}"/${PN}-643-LESSOPEN-escape.patch
+)
+
+src_prepare() {
+	default
+	# Per upstream README to prepare live build
+	[[ ${PV} == 9999 ]] && emake -f Makefile.aut distfiles
+	# Upstream uses unpatched autoconf-2.69, which breaks with clang-16.
+	# https://bugs.gentoo.org/870412
+	eautoreconf
+}
+
+src_configure() {
+	append-lfs-flags # bug #896316
+
+	local myeconfargs=(
+		--with-regex=$(usex pcre pcre2 posix)
+		--with-editor="${EPREFIX}"/usr/libexec/editor
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	emake check VERBOSE=1 CC="$(tc-getCC)" PKG_CONFIG="$(tc-getPKG_CONFIG)"
+}
+
+src_install() {
+	default
+
+	keepdir /usr/lib/lessfilter.d
+	keepdir /etc/lessfilter.d
+
+	newbin "${FILESDIR}"/lesspipe-r3.sh lesspipe
+	newenvd "${FILESDIR}"/less.envd 70less
+}
+
+pkg_preinst() {
+	optfeature "Colorized output support" dev-python/pygments
+
+	if has_version "<${CATEGORY}/${PN}-483-r1" ; then
+		elog "The lesspipe.sh symlink has been dropped.  If you are still setting"
+		elog "LESSOPEN to that, you will need to update it to '|lesspipe %s'."
+	fi
+
+	if has_version "<${CATEGORY}/${PN}-643" ; then
+		elog "less now colorizes by default. To disable this, set LESSCOLOR=no."
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4-r1.ebuild
index bee23fd9d0..406fd09692 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/smartmontools/smartmontools-7.4-r1.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit autotools subversion
 else
 	SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
 fi
 
 DESCRIPTION="Tools to monitor storage systems to provide advanced warning of disk degradation"
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
index 3ce3abaad9..c8676b6387 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/util-linux/util-linux-2.39.3-r7.ebuild
@@ -22,7 +22,7 @@ else
 	inherit verify-sig
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos"
 	fi
 
 	SRC_URI="https://www.kernel.org/pub/linux/utils/util-linux/v${PV:0:4}/${MY_P}.tar.xz"
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index 41cbe80561..c0538a3e11 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -5,12 +5,16 @@ DIST gcc-11-20240111.tar.xz 76240620 BLAKE2B dcf3b2493ca6ba1a9cd0137186cfbf1b962
 DIST gcc-11-20240208.tar.xz 76276224 BLAKE2B efce83c3ea03093546b73d7731ac1051da7a2b0309612ce5b809ae2756bf7a949c94f951f6a77e789f7669051315e1a4e4c33f2b12a2ec1999ee9f1f39f6b13f SHA512 a0e2b4402ff187d0804e3bc2ed0a228cfce48476c1270d57798b060899f65c7e986945651d36c358f9df5eb4b36db13321e141895329b7382c130a0aca6a8962
 DIST gcc-11-20240328.tar.xz 76268060 BLAKE2B a3ffdd5a2376b1d3984ca39837932e1c6dc047ff6ae72eac0387cf27acdf8f1a1ff7e9584f631de348b6553e929892d8bc443ad6c40132a2636c39a8907c5eec SHA512 6372a99f2a1320c7df6e7984bb780395aaf8319624f311d955d5dbab2ac7bfb8de933c5b945bc3c4ea3b5d7404b8fc2d696825214b6563c1e032094a421b8bd2
 DIST gcc-11-20240404.tar.xz 76246936 BLAKE2B 09eed1bff289e960018b8c9c5d39e43ebcff78d344feba45d7889149e0de0d2727a54a0359471eab9a28cb38d5750b488c62cbffbf937ab7238eab51f3e7d0b7 SHA512 431f0b8d78f2b5e910ca8de8e8f64594f070639c17bc65a074650c217a5262cb9081db7e090bd3396e30ef50e92ed3ada0d163b4cabf04f2ae78fd02dba8c05a
+DIST gcc-11-20240411.tar.xz 76275268 BLAKE2B a24769b7f4b6d111b1fc46f9a99f9f731193a15b9a1a73fc224388721f0e3b6d02022eb0dc44a3d587522ad124bf63ce9ee50b9622ec91b55001c46fbc261776 SHA512 43fef6a426b4b8001c1d8707c34339203e66dcfa580cf289e20cd7abeaf0f8b57068ab1099099c4692a7acce1bc38bb978bcff6c309f30e3430457af5b7fb018
+DIST gcc-11-20240418.tar.xz 76255988 BLAKE2B 363f195d8e23915511e768c303550e6e3a67aa45e3f55945cf763fbbcaea7e28932e5094d2fe4c26f8a920ad3479523c27b8aef14716cb7d26cd7da7a69196fa SHA512 a6072e40ad233759f8f893b5c7962df5cc926cd5322bf1b3986b88013628ac7b08eea23a8f5f5bf75444e26e6106d0ebfab26caa82974805308d17f6b69b36d0
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
 DIST gcc-11.4.0-patches-12.tar.xz 13824 BLAKE2B e4df9e0dc9512882022aaf325ebf65c540169454c91dd31f913c6f57f6eb291c79ae919671b53db1549799d4a70c09298bf45ed82ad05eb1f961443cc958369d SHA512 87fed0c3f8e28c9f702443db58350bb615110b27ebe334b5de2ea60678e2548c56cd75cffade210d69634e2ac0a9311f5100ddb45d97645aa76d5688bc421a61
 DIST gcc-12-20240112.tar.xz 79832228 BLAKE2B deec7123b8ffc42ddace51e1f3e8e08d5485f7000c0d4b7273b6311912ec0e7e2cb41124297af8c54456bb369a76fa2ef51aff552d8d680ec41dd2b144b08e55 SHA512 2c0a676ad35e6edee915c042a1751ac0263fae9b7af4d324deb49d6603dc73d3ec768832184879543e6ffb1595da5c56d9117288547adab7f243646dcbfc64ac
 DIST gcc-12-20240209.tar.xz 79824868 BLAKE2B 1ae5a646da470f06648c4766c77475ceb287c5f6647d5102f1aef6590f973233d5e7f83b5e0241488d49dba59dd605c211938379e68a393a2dccb3834103ae4b SHA512 9f9a04f4477f41bb2a5662aedef2af75b039de50c2dc99310e504e6080cb7aae06a1255337ea2e563975cb108ddc6766adbbaf4e3d5d5712801d7ba9a5209dbd
 DIST gcc-12-20240329.tar.xz 79862704 BLAKE2B 2ac09aeed2718acfcbb8d0d71e51f21cab9b186c73860cfabcf95a7ed4c37eb461fb26f86ee7319c614c21208c0fdf841b660d314eacd8314e8f323edd37f7cf SHA512 56d67cac2744c7fcb28eda9a29ba200d418a9e44fecc37b29747c2abac479e366b591ad6f7f92ce64b09dd3d0261af8ef28673beee1280618e043cf66f3b76ac
 DIST gcc-12-20240405.tar.xz 79849308 BLAKE2B d94046fead6cacd3e3b869f1db42843a2487d845ded332ad0fd55a7f290a4c3df72258dc1b74e4db3d7f7357e6b55444cde4b8863f2ce6f8691fd92bd49927fb SHA512 93ed2174ac3cdd8d5e885c6f4f546f9d0557e93bc9583a02d5d159c666fe6a82f30b6ed074f5f1e36f6f82855c41be527fb3d053498059ee4a6194575b00ed0d
+DIST gcc-12-20240412.tar.xz 79856320 BLAKE2B b83d64584a2c5bade96b7964349e4b760d5b40a4d10256799130d329f5748d2741a5122105f094f161f95eb8ade64109276aec723a518a42d695b41c8f08d61e SHA512 2a8a3ae4779f1cc897846b9d5e2eeb94ea8ece72d061c0f2436e854bb26eef33eb51c66bee6c0c363be04023e5c5ce3e3a88c9aaa7ae9faaa9322fd18dfbfae3
+DIST gcc-12-20240419.tar.xz 79851084 BLAKE2B fff60c92dc6a2c10c413d837ab9a02959efd24896f1e174a3a15c4d1676abd72b68aa4c88ea3be16b521ecbb0e93afefe6df27b0099809b16426cea0c6ccef07 SHA512 09aefc61f8dea440ca2ffc7e448173c013769415e8bcc86695566d3fe7905b6943bca740f76035383399aef3086822de674265e0b881c504e458f8c6fb4b2b80
 DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
 DIST gcc-12.3.0-patches-2.tar.xz 14236 BLAKE2B 06c43662c9abb0fa3cf90d5e2273c69aecb9158e6cf6f23c04754ed5d686be2616e81e2502eb16f4298ddd50518ca7677e13249da9e9b091162d3931ff65e4fe SHA512 b0d4b85dbf1a54aaaa1997203b872e3106906b4ad49cde57e1428bc22b2f8e2d73b8cb10ae0d0b792aebaf664594da4d1dea04c44ddc34e59047410766db04d1
 DIST gcc-12.3.0-patches-3.tar.xz 14852 BLAKE2B 7a5f1f43063b15f424099afd72096212fbbbc5151ff01f2de15dfb6e7cf274981c8cfaedba9ef61576c9096fb172fc550a7deb5cd7d9366fd249fd5dd3951f76 SHA512 aa89e4c2ae02f4fb42229ad5167f2eaa3a8fae51118645bf07199fe2124b9c83948590662b053d08002ef709fa870ea88315fd4ccbe4441a74e9cb62edcb82fb
@@ -18,6 +22,8 @@ DIST gcc-13-20240113.tar.xz 84356052 BLAKE2B 1fbfffc9f2afe443158e3f26182c8bdc3f3
 DIST gcc-13-20240210.tar.xz 84354416 BLAKE2B 5807623d3f7dd751b6dfe164cfd50d57b2f93485c23c3c2228a4a846a9a94cdad52a5e6f2806e5e7ee2a7b5526386ebdb339c44c7ea023d69f8652088a1b114d SHA512 14a01ced7ac2bfd9fc93de4e3819b4d0823fbe129d3f1faabeb707e9e3e2613b4173321b58b3648a7250e3b7ff5d94edfee60e6c38682f31a1f7b57b1c01433f
 DIST gcc-13-20240330.tar.xz 84407332 BLAKE2B 28b40915bf8e9ecf71b50d06fcdf69c01e87d3635f0c6b6159e003a0876453ada062cc538204604885e1350d226417fe9d7cbdb5e39146f9fde0d524ad34ff07 SHA512 4c4c4be522feb9ebe1bc868db59f0828de1154f80afad6c32bc2c7cf45df3797cb5e6dce2b35a297194ea87f81e34439f4d87bd88cabf0a29ce686e1b29e7a08
 DIST gcc-13-20240406.tar.xz 84392728 BLAKE2B 42a560b01677350c480bde2a7436a8be4d2259100dd6f2f9e7c5555adb3d13ee1f51bfae058ceb0cc2ca4d527b302b5250f26b3d6b26fa9c7a2f5715aa003a3f SHA512 e5ec524df7e9498a23ccfa42e28c5ce284fecdbb4771980328257d8251a11740c4cd3970d6bbe13052907b257d8e89b176d183c895168cf524dda12582d05d86
+DIST gcc-13-20240413.tar.xz 84405692 BLAKE2B 4df749357ed33afdb0255b4dc02ae568ce12e461c07a535f3736c2dcd9f779391846097aeb99ed70f5f45dbc029244a0c994b84f1de1086cce3da23bba719984 SHA512 934857721e1a92ea709e1ff6f64dbb8a47df4c614935ec298ded0a19bb92342e50bb8ab7eccd6e3ab46ca00e86ed34b499d4b06379a689bf48bf4201f3956006
+DIST gcc-13-20240420.tar.xz 84407856 BLAKE2B 188b92454735223a4da7af2b5b57bb52c6362778550aa6ddbc445d3a2e0700494db2f743da59961ceccb756791f01c23f76c83224daeaccfb561cd1d2e6ece7c SHA512 6be1fbb1cddebbccf38da4424af56e173d0c4a53e63ed3a9d86398f23053747a231287ce7bdeb5666ceeb4f3385dee228cc05fba19beaf4d7b2c9cbe1f14a489
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
 DIST gcc-13.2.0-patches-12.tar.xz 47404 BLAKE2B ed018bcd7429d1c7aace746cbfc4e59dae409fc0a35231320c1b44c96fff0d912eba5c72109c2deb883f5368159df02148b2d4373396b34da882164c61fe4387 SHA512 b7872a03870bce7b633e4af4329b24fe8f3d50d6d9173f63549f606ce062787748af7f79e7ec4afeb768968d6e8462a849bd1b94316ea6bb284551f99e811617
 DIST gcc-13.2.0-patches-14.tar.xz 46928 BLAKE2B fce23bc5315f35b04a4976550c4b44578944a1b17e40c7553351eeb8a1ef0f3a2538da5a5e1ae6f37b784ff11bbd8a44b8f6eec542be63e34d984dee69e1cd81 SHA512 d7d52bb2915fd89c06b0134bede8db939cadbb1f2dcddf923bee2c3f9f577ff9e5e986b60420d892539edf82867a0d1bd635807814bc618b06a2b37cdaca893a
@@ -26,6 +32,8 @@ DIST gcc-14-20240317.tar.xz 87764960 BLAKE2B 5cd957c3bf5e2fbb134b716a7ed14c0ace6
 DIST gcc-14-20240324.tar.xz 87808876 BLAKE2B 546b69f4562cfee6a3d5d8700e2a9bd0da001e3dde04825754ec5298144243ea4c975d0bf0366711fc9680f263732afb40c083fe9268f578b89e7d006b8d4955 SHA512 16b00690bf541784a109bc2382bbdf8ba6b72b416b130905d020182708ae687cbeca28197ab16539032ce9db3ad0e062e4231f9ef4c2d2452b14ed2b0ff3596e
 DIST gcc-14-20240331.tar.xz 87841560 BLAKE2B 7a3c0beb8234c38e4ad5d27369e848c178053a595bb6a4d2f5e2c848c5ddcd8a89b7674190d6964d5b3fd49709fb3f9be22e651a21543384f0210355bfca79fc SHA512 c7883d3ecb65e46783d8ce5efa87b53600aa84736a9af026b51ed5fdd827cae20729d4cb5cba70d3322ae7ca72c2d5a6944e5dee4174226bfc3c6398777d6377
 DIST gcc-14-20240407.tar.xz 87887372 BLAKE2B 76f9994af354fdd262420d80c6780dbf447a2ef64f09702523c31056d662227571d70cffab067ba82bcf4dee02a81a072382cb579a15af6f0b5edd4c1e51c1af SHA512 02d1ff0ee65ab7b0159d3d22a30ffd9055f3e7bf5f598663d5b711092dedd96bc67b511da37cbc785987d2f3460e2e38653c8fe6c7c3d34970fa1055db33cc0c
+DIST gcc-14-20240414.tar.xz 87980364 BLAKE2B 9b8d4ff7127d5f5cf805d6caa6956acaf24be3d628cbbd82d6bf926e40c8ed0088bf2bf386072ca3ea93ee4d945e4270c1977a5cf96ae4ff24ae32ce768fffa5 SHA512 552d0c49e3903cc42b46f44f1cedd5f1135997cebcd9e1d28c01474ef4365b1136cccb490923923c7633dfe94d744c8882fda1bb286a7dcb2cc26a90d4c3e99f
+DIST gcc-14-20240421.tar.xz 87982608 BLAKE2B e977ee966d7256e996064d0cb3a01ccbece49c6609e8c2bff54650a6d1965e72faf6ed0fe06f50e223f4edea83b44d4f2664d8141d7a8ba371485c9b4877c38e SHA512 f211ae16cc7c64ad097d33c6f092fb64c8c547efd0bf2975f536b457cf0314c7613d39fa82cf04c4a62facf47c4cd214f73a3f2347dd8f73b6d95a5836614f98
 DIST gcc-14.0.0-musl-patches-1.tar.xz 3576 BLAKE2B 692baee8a7709905d53aeb150d73a3721c4ba47ee5f397cfb1b5be905cf003ca02b60c94ee294d90ac39645cd5cdf186c7a3aa950c47d8cf680c128ed705b807 SHA512 0592ab98a7142e404623a6511c67dff61e9ade32c3fb2c0e75b456306e0af3799ad13252b50b3d2fdd31e5815d7f0b16b0ad63ab8386fe4d78729fc9c182d617
 DIST gcc-14.0.0-patches-25.tar.xz 12352 BLAKE2B c006fa3c2454ef4db073f718d54cab33d2832d233199469b1755f23bb168fd725eaec7ad60fb89e4e9965ad2870c35a232edd07ea2a781ca1f0d67964ad4c2e6 SHA512 1ab587c2e9873dd93356dfff30f02916811392b4c878e16f5b2129f833a974f96245deb6db346dde01e07e4ab162bb83be7c5ba1e1edd32efc0404a422268c52
 DIST gcc-14.0.0-patches-26.tar.xz 12360 BLAKE2B a2fdd6ff1774bc94f96bc4f7da4092c373936c93e04b94e75701227ab55d530523fee6b561773d05080e51748cc7716868d8b108f51a06e37a2c26a1d7f39b33 SHA512 1275e6345417ee196e74c46845d05508c8662d71e2432fbfbf7f1eb9c220657b4ee8e3b0ca02b7b4c7e14df164f254380c65af91cadc3bda4cd7afbe6af5ea8b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.1_pre20240303-uninit.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.1_pre20240303-uninit.patch
deleted file mode 100644
index 5ad41c4581..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.1_pre20240303-uninit.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=901e7bdab70e2275723ac31dacbbce0b6f68f4f4
-
-From 901e7bdab70e2275723ac31dacbbce0b6f68f4f4 Mon Sep 17 00:00:00 2001
-From: Jakub Jelinek <jakub@redhat.com>
-Date: Mon, 4 Mar 2024 19:23:02 +0100
-Subject: [PATCH] combine: Fix recent WORD_REGISTER_OPERATIONS check [PR113010]
-
-On Mon, Mar 04, 2024 at 05:18:39PM +0100, Rainer Orth wrote:
-> unfortunately, the patch broke Solaris/SPARC bootstrap
-> (sparc-sun-solaris2.11):
->
-> .../gcc/combine.cc: In function 'rtx_code simplify_comparison(rtx_code, rtx_def**, rtx_def**)':
-> .../gcc/combine.cc:12101:25: error: '*(unsigned int*)((char*)&inner_mode + offsetof(scalar_int_mode, scalar_int_mode::m_mode))' may be used uninitialized [-Werror=maybe-uninitialized]
-> 12101 |   scalar_int_mode mode, inner_mode, tmode;
->       |                         ^~~~~~~~~~
-
-I don't see how it could ever work properly, inner_mode in that spot is
-just uninitialized.
-
-I think we shouldn't worry about paradoxical subregs of non-scalar_int_mode
-REGs/MEMs and for the scalar_int_mode ones should initialize inner_mode
-before we use it.
-Another option would be to use
-maybe_lt (GET_MODE_PRECISION (GET_MODE (SUBREG_REG (op0))), BITS_PER_WORD)
-and
-load_extend_op (GET_MODE (SUBREG_REG (op0))) == ZERO_EXTEND,
-or set machine_mode smode = GET_MODE (SUBREG_REG (op0)); and use it in
-those two spots.
-
-2024-03-04  Jakub Jelinek  <jakub@redhat.com>
-
-	PR rtl-optimization/113010
-	* combine.cc (simplify_comparison): Guard the
-	WORD_REGISTER_OPERATIONS check on scalar_int_mode of SUBREG_REG
-	and initialize inner_mode.
---- a/gcc/combine.cc
-+++ b/gcc/combine.cc
-@@ -12554,6 +12554,8 @@ simplify_comparison (enum rtx_code code, rtx *pop0, rtx *pop1)
- 	  if (paradoxical_subreg_p (op0))
- 	    {
- 	      if (WORD_REGISTER_OPERATIONS
-+		  && is_a <scalar_int_mode> (GET_MODE (SUBREG_REG (op0)),
-+					     &inner_mode)
- 		  && GET_MODE_PRECISION (inner_mode) < BITS_PER_WORD
- 		  /* On WORD_REGISTER_OPERATIONS targets the bits
- 		     beyond sub_mode aren't considered undefined,
--- 
-2.39.3
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240411.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240411.ebuild
new file mode 100644
index 0000000000..5ab7ed2dbc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240411.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="11.4.0"
+PATCH_VER="12"
+MUSL_VER="2"
+MUSL_GCC_VER="11.4.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240418.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240418.ebuild
new file mode 100644
index 0000000000..5ab7ed2dbc
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20240418.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="11.4.0"
+PATCH_VER="12"
+MUSL_VER="2"
+MUSL_GCC_VER="11.4.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240412.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240412.ebuild
new file mode 100644
index 0000000000..2c4b89e724
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240412.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="12.3.0"
+PATCH_VER="3"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240419.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240419.ebuild
new file mode 100644
index 0000000000..2c4b89e724
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20240419.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="12.3.0"
+PATCH_VER="3"
+MUSL_VER="1"
+MUSL_GCC_VER="12.3.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+	        MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240413.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240413.ebuild
new file mode 100644
index 0000000000..2a22fc220b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240413.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="13.2.0"
+PATCH_VER="15"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240420.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240420.ebuild
new file mode 100644
index 0000000000..2a22fc220b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20240420.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="13.2.0"
+PATCH_VER="15"
+MUSL_VER="2"
+MUSL_GCC_VER="13.2.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240414.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240414.ebuild
new file mode 100644
index 0000000000..00b7365feb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240414.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="14.0.0"
+PATCH_VER="26"
+MUSL_VER="1"
+MUSL_GCC_VER="14.0.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240421.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240421.ebuild
new file mode 100644
index 0000000000..00b7365feb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.1_pre20240421.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+TOOLCHAIN_PATCH_DEV="sam"
+PATCH_GCC_VER="14.0.0"
+PATCH_VER="26"
+MUSL_VER="1"
+MUSL_GCC_VER="14.0.0"
+PYTHON_COMPAT=( python3_{10..11} )
+
+if [[ ${PV} == *.9999 ]] ; then
+	MY_PV_2=$(ver_cut 2)
+	MY_PV_3=1
+	if [[ ${MY_PV_2} == 0 ]] ; then
+		MY_PV_2=0
+		MY_PV_3=0
+	else
+		MY_PV_2=$((${MY_PV_2} - 1))
+	fi
+
+	# e.g. 12.2.9999 -> 12.1.1
+	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
+elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
+	# Cheesy hack for RCs
+	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
+	MY_P=${PN}-${MY_PV}
+	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
+	TOOLCHAIN_SET_S=no
+	S="${WORKDIR}"/${MY_P}
+fi
+
+inherit toolchain
+
+if tc_is_live ; then
+	# Needs to be after inherit (for now?), bug #830908
+	EGIT_BRANCH=master
+elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
+	# Don't keyword live ebuilds
+	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	:;
+fi
+
+if [[ ${CATEGORY} != cross-* ]] ; then
+	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
+	# If GCC is enabling CET by default, we need glibc to be built with support for it.
+	# bug #830454
+	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
+	DEPEND="${RDEPEND}"
+	BDEPEND="amd64? ( >=${CATEGORY}/binutils-2.30[cet(-)?] )"
+fi
+
+src_prepare() {
+	local p upstreamed_patches=(
+		# add them here
+	)
+	for p in "${upstreamed_patches[@]}"; do
+		rm -v "${WORKDIR}/patch/${p}" || die
+	done
+
+	toolchain_src_prepare
+
+	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
+	eapply_user
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.16.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.16.2.ebuild
index 10840ae807..2997ce0cf2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.16.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/fuse/fuse-3.16.2.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 inherit flag-o-matic meson-multilib udev python-any-r1
 
 DESCRIPTION="An interface for filesystems implemented in userspace"
@@ -14,13 +14,15 @@ LICENSE="GPL-2 LGPL-2.1"
 SLOT="3"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="+suid test"
-RESTRICT="!test? ( test ) test? ( userpriv )"
+RESTRICT="test"
+PROPERTIES="test_privileged"
 
 BDEPEND="
 	virtual/pkgconfig
 	test? (
 		${PYTHON_DEPS}
 		$(python_gen_any_dep 'dev-python/pytest[${PYTHON_USEDEP}]')
+		$(python_gen_any_dep 'dev-python/looseversion[${PYTHON_USEDEP}]')
 	)
 "
 RDEPEND=">=sys-fs/fuse-common-3.3.0-r1"
@@ -28,7 +30,8 @@ RDEPEND=">=sys-fs/fuse-common-3.3.0-r1"
 DOCS=( AUTHORS ChangeLog.rst README.md doc/README.NFS doc/kernel.txt )
 
 python_check_deps() {
-	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]"
+	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/looseversion[${PYTHON_USEDEP}]"
 }
 
 pkg_setup() {
@@ -50,11 +53,13 @@ multilib_src_configure() {
 }
 
 src_test() {
-	if has sandbox ${FEATURES}; then
-		ewarn "Sandbox enabled, skipping tests"
-	else
-		multilib-minimal_src_test
-	fi
+	# For tests to pass:
+	# sandbox must be disabled.
+	# Write access to /dev/cuse* and /dev/fuse is required.
+	# root must be a member of the portage group; CAP_DAC_OVERRIDE is dropped.
+	# TMPDIR must be short for unix socket paths.
+	local -x TMPDIR=/tmp
+	multilib-minimal_src_test
 }
 
 multilib_src_test() {
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/udisks/udisks-2.10.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/udisks/udisks-2.10.1.ebuild
index 550f365c02..8054bb7ac7 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/udisks/udisks-2.10.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/udisks/udisks-2.10.1.ebuild
@@ -10,7 +10,7 @@ SRC_URI="https://github.com/storaged-project/udisks/releases/download/${P}/${P}.
 
 LICENSE="LGPL-2+ GPL-2+"
 SLOT="2"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~ia64 ~loong ~mips ~ppc ppc64 ~riscv x86"
 IUSE="acl +daemon debug elogind +introspection lvm nls selinux systemd"
 
 REQUIRED_USE="
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
index c3982fdd55..5371f002e5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/Manifest
@@ -1,2 +1,3 @@
 DIST xfsprogs-6.4.0.tar.xz 1344720 BLAKE2B 566a80a1fa90520c6cc2b20c8e8cde41eb83a48f0b6d4a978f9e5d43960e99b54cab3e0c2cd4147a3d8f4944e50876063fc571441c8239d6deaaa01604843a6b SHA512 831e7747640bc2964b182226d8bb6f637610b123aeec9b3cb97a5de5d5b65bde30c6b40ad2e78de6a5214e823dd75de3a2bdfddd8ab1638f5c7340a760c91b3f
 DIST xfsprogs-6.6.0.tar.xz 1351792 BLAKE2B a479126ed19389c057af28ac3564893826a6d27859984cfadb28b17663759d8f19b1796031d43f294bf8001f5ddda8854b6b0d90d0229092bd31fbdf6e5d1554 SHA512 89b4436a958075ac77cc2b5b5f0618164d47f7d6fbc2271a7927c886fba7bf67284e1825c1ecc259969235222b4d084a40c354edb6d83c21029d737108aa38da
+DIST xfsprogs-6.7.0.tar.xz 1349748 BLAKE2B e16db682cafbd35266e9130a64943c19304174ebd501e30aa32fb8f0d1904286ccdef62c0820480541c7272575d770eea7e73e7dc83c0b452eb5fb2a3a7085ca SHA512 4f543e4c5c4e88e4f9ce16b82ca1151330f687469368fe7470b68e8bb21d1d3c7280eb2e691d3bdf24ae3d4fa2ee5764dc34637198bca0d4ffa65eea2f10ac74
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-6.7.0-fix-porting-to-6.7.patch b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-6.7.0-fix-porting-to-6.7.patch
new file mode 100644
index 0000000000..fcc30d170a
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/files/xfsprogs-6.7.0-fix-porting-to-6.7.patch
@@ -0,0 +1,157 @@
+https://lore.kernel.org/linux-xfs/171142126323.2211955.1239989461209318080.stgit@frogsfrogsfrogs/
+
+From mboxrd@z Thu Jan  1 00:00:00 1970
+Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80EBA128387
+	for <linux-xfs@vger.kernel.org>; Tue, 26 Mar 2024 02:59:42 +0000 (UTC)
+Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
+ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
+	t=1711421982; cv=none; b=BWaXePO42YIrz9dUA7DXc3SL5MWIoC+liDfJkd/1AM/cv7gR6JRGHa5e5W3sXZFsI6S6pH/fKSEijUigTR0kiRGPFWbeCiDWEGQdq6y4AChFbZMTfQSg4Jei7pONholMK08CyBQ/K4UutICyqbos2cdxAGKKjNPTIOtdQdkiHdc=
+ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
+	s=arc-20240116; t=1711421982; c=relaxed/simple;
+	bh=qfMP8tvVLZAoDkRmqI3ZwhMEx6csbe2+Xclngz+n+GI=;
+	h=Date:Subject:From:To:Cc:Message-ID:In-Reply-To:References:
+	 MIME-Version:Content-Type; b=O5h4CVWF9TsE/Yho55MGUjmR7zhvoPO0EhXK59BWm/HSUFB3D7vD+ozThDlpENzz0iLrKzdR6aPYBS78cRpOzAszO4ZnMf0HPbFlLmlsIHK/ha5XFPO2qrmLgOGUkKKZepgXIROIA9knDYpxuvlWHnOptPf9birJvyR0gztAEyw=
+ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dkgsPgmY; arc=none smtp.client-ip=10.30.226.201
+Authentication-Results: smtp.subspace.kernel.org;
+	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dkgsPgmY"
+Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A482C433C7;
+	Tue, 26 Mar 2024 02:59:42 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
+	s=k20201202; t=1711421982;
+	bh=qfMP8tvVLZAoDkRmqI3ZwhMEx6csbe2+Xclngz+n+GI=;
+	h=Date:Subject:From:To:Cc:In-Reply-To:References:From;
+	b=dkgsPgmYjqxxC1yEflpaDSaicJ6J1MpL6wH2GNkbwb7jHMXma/nM8+TuJ7ITuHQGY
+	 WXTMKAQFvTq29s+IWJaQZtuCfgH6cDQ3JTkRcjvg/OgSTo0X+aqxadBBnAjO4AP5/P
+	 hX4gszw3hlZ8oDjMvW9Wl6nLyDmR82rshZOTF4hZfQ8mkbU3Vzcsg2QiPQQzzKgfon
+	 3c/GxXIQ7V2jg37MBrPpNRYPvqBXWn1X/EkR0wuFiUtw9fTJ6Wyt0Vr6/vemAf2U+S
+	 gwHkISopsTOE3k8cCYYf7LXqmtU3PLOOqWBDol6TkWe6OgIOMSljoytIkFq1up/zhz
+	 LHrtnfD5yRlLg==
+Date: Mon, 25 Mar 2024 19:59:41 -0700
+Subject: [PATCH 01/13] libxfs: fix incorrect porting to 6.7
+From: "Darrick J. Wong" <djwong@kernel.org>
+To: cem@kernel.org, djwong@kernel.org
+Cc: Christoph Hellwig <hch@lst.de>, Bill O'Donnell <bodonnel@redhat.com>,
+ linux-xfs@vger.kernel.org
+Message-ID: <171142126323.2211955.1239989461209318080.stgit@frogsfrogsfrogs>
+In-Reply-To: <171142126291.2211955.14829143192552278353.stgit@frogsfrogsfrogs>
+References: <171142126291.2211955.14829143192552278353.stgit@frogsfrogsfrogs>
+User-Agent: StGit/0.19
+Precedence: bulk
+X-Mailing-List: linux-xfs@vger.kernel.org
+List-Id: <linux-xfs.vger.kernel.org>
+List-Subscribe: <mailto:linux-xfs+subscribe@vger.kernel.org>
+List-Unsubscribe: <mailto:linux-xfs+unsubscribe@vger.kernel.org>
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+From: Darrick J. Wong <djwong@kernel.org>
+
+Userspace libxfs is supposed to match the kernel libxfs except for the
+preprocessor include directives.  Fix a few discrepancies that came up
+for whatever reason.
+
+To fix the build errors resulting from CONFIG_XFS_RT not being defined,
+add it to libxfs.h and alter the Makefile to track xfs_rtbitmap.h.
+
+Signed-off-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Bill O'Donnell <bodonnel@redhat.com>
+---
+ db/check.c            |    1 -
+ include/libxfs.h      |    4 ++++
+ libxfs/Makefile       |    1 +
+ libxfs/xfs_rtbitmap.c |    2 +-
+ libxfs/xfs_rtbitmap.h |    3 ---
+ repair/rt.c           |    1 -
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+
+diff --git a/db/check.c b/db/check.c
+index 9d5576c333b2..a47a5d9cb5b4 100644
+--- a/db/check.c
++++ b/db/check.c
+@@ -20,7 +20,6 @@
+ #include "init.h"
+ #include "malloc.h"
+ #include "dir2.h"
+-#include "xfs_rtbitmap.h"
+ 
+ typedef enum {
+ 	IS_USER_QUOTA, IS_PROJECT_QUOTA, IS_GROUP_QUOTA,
+diff --git a/include/libxfs.h b/include/libxfs.h
+index 9cec394ca407..aeec2bc76126 100644
+--- a/include/libxfs.h
++++ b/include/libxfs.h
+@@ -7,6 +7,9 @@
+ #ifndef __LIBXFS_H__
+ #define __LIBXFS_H__
+ 
++/* For userspace XFS_RT is always defined */
++#define CONFIG_XFS_RT
++
+ #include "libxfs_api_defs.h"
+ #include "platform_defs.h"
+ #include "xfs.h"
+@@ -80,6 +83,7 @@ struct iomap;
+ #include "xfs_refcount_btree.h"
+ #include "xfs_refcount.h"
+ #include "xfs_btree_staging.h"
++#include "xfs_rtbitmap.h"
+ 
+ #ifndef ARRAY_SIZE
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+diff --git a/libxfs/Makefile b/libxfs/Makefile
+index 010ee68e2292..6f688c0ad25a 100644
+--- a/libxfs/Makefile
++++ b/libxfs/Makefile
+@@ -50,6 +50,7 @@ HFILES = \
+ 	xfs_refcount_btree.h \
+ 	xfs_rmap.h \
+ 	xfs_rmap_btree.h \
++	xfs_rtbitmap.h \
+ 	xfs_sb.h \
+ 	xfs_shared.h \
+ 	xfs_trans_resv.h \
+diff --git a/libxfs/xfs_rtbitmap.c b/libxfs/xfs_rtbitmap.c
+index 8f313339e97f..fb083499070c 100644
+--- a/libxfs/xfs_rtbitmap.c
++++ b/libxfs/xfs_rtbitmap.c
+@@ -931,7 +931,7 @@ xfs_rtcheck_alloc_range(
+  */
+ int
+ xfs_rtfree_extent(
+-	xfs_trans_t		*tp,	/* transaction pointer */
++	struct xfs_trans	*tp,	/* transaction pointer */
+ 	xfs_rtxnum_t		start,	/* starting rtext number to free */
+ 	xfs_rtxlen_t		len)	/* length of extent freed */
+ {
+diff --git a/libxfs/xfs_rtbitmap.h b/libxfs/xfs_rtbitmap.h
+index db2f8c924b05..c0637057d69c 100644
+--- a/libxfs/xfs_rtbitmap.h
++++ b/libxfs/xfs_rtbitmap.h
+@@ -6,9 +6,6 @@
+ #ifndef __XFS_RTBITMAP_H__
+ #define	__XFS_RTBITMAP_H__
+ 
+-/* For userspace XFS_RT is always defined */
+-#define CONFIG_XFS_RT
+-
+ struct xfs_rtalloc_args {
+ 	struct xfs_mount	*mp;
+ 	struct xfs_trans	*tp;
+diff --git a/repair/rt.c b/repair/rt.c
+index abe58b569c0c..9f3bc8d53ec6 100644
+--- a/repair/rt.c
++++ b/repair/rt.c
+@@ -13,7 +13,6 @@
+ #include "protos.h"
+ #include "err_protos.h"
+ #include "rt.h"
+-#include "xfs_rtbitmap.h"
+ 
+ #define xfs_highbit64 libxfs_highbit64	/* for XFS_RTBLOCKLOG macro */
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.7.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.7.0.ebuild
new file mode 100644
index 0000000000..c412012a15
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/xfsprogs/xfsprogs-6.7.0.ebuild
@@ -0,0 +1,100 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic systemd udev usr-ldscript toolchain-funcs
+
+DESCRIPTION="XFS filesystem utilities"
+HOMEPAGE="https://xfs.wiki.kernel.org/ https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/"
+SRC_URI="https://www.kernel.org/pub/linux/utils/fs/xfs/${PN}/${P}.tar.xz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="icu libedit nls selinux"
+
+RDEPEND="
+	dev-libs/inih
+	dev-libs/userspace-rcu:=
+	>=sys-apps/util-linux-2.17.2
+	icu? ( dev-libs/icu:= )
+	libedit? ( dev-libs/libedit )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="nls? ( sys-devel/gettext )"
+RDEPEND+=" selinux? ( sec-policy/selinux-xfs )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.3.0-libdir.patch
+	"${FILESDIR}"/${PN}-6.7.0-fix-porting-to-6.7.patch
+)
+
+src_prepare() {
+	default
+
+	# Fix doc dir
+	sed -i \
+		-e "/^PKG_DOC_DIR/s:@pkg_name@:${PF}:" \
+		include/builddefs.in || die
+
+	# Don't install compressed docs
+	sed 's@\(CHANGES\)\.gz[[:space:]]@\1 @' -i doc/Makefile || die
+}
+
+src_configure() {
+	# include/builddefs.in will add FCFLAGS to CFLAGS which will
+	# unnecessarily clutter CFLAGS (and fortran isn't used)
+	unset FCFLAGS
+
+	# If set in user env, this breaks configure
+	unset PLATFORM
+
+	export DEBUG=-DNDEBUG
+
+	# Package is honoring CFLAGS; No need to use OPTIMIZER anymore.
+	# However, we have to provide an empty value to avoid default
+	# flags.
+	export OPTIMIZER=" "
+
+	# Avoid automagic on libdevmapper (bug #709694)
+	export ac_cv_search_dm_task_create=no
+
+	# bug 903611
+	use elibc_musl && append-flags -D_LARGEFILE64_SOURCE
+
+	# Build fails with -O3 (bug #712698)
+	replace-flags -O3 -O2
+
+	# Upstream does NOT support --disable-static anymore,
+	# https://www.spinics.net/lists/linux-xfs/msg30185.html
+	# https://www.spinics.net/lists/linux-xfs/msg30272.html
+	local myconf=(
+		--enable-static
+		--with-crond-dir="${EPREFIX}/etc/cron.d"
+		--with-systemd-unit-dir="$(systemd_get_systemunitdir)"
+		--with-udev-rule-dir="$(get_udevdir)"
+		$(use_enable icu libicu)
+		$(use_enable nls gettext)
+		$(use_enable libedit editline)
+	)
+
+	if tc-is-lto ; then
+		myconf+=( --enable-lto )
+	else
+		myconf+=( --disable-lto )
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake V=1
+}
+
+src_install() {
+	emake DIST_ROOT="${ED}" HAVE_ZIPPED_MANPAGES=false install
+	emake DIST_ROOT="${ED}" HAVE_ZIPPED_MANPAGES=false install-dev
+
+	gen_usr_ldscript -a handle
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
index ff8e25103f..08b7fcf23d 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/Manifest
@@ -4,3 +4,4 @@ DIST ldb-2.5.3.tar.gz 1736354 BLAKE2B dcd4d33f7a0ce3583bc96762b274d195c20e868337
 DIST ldb-2.6.2.tar.gz 1738908 BLAKE2B 44998efdff46486f94deb115225119cb3f6f23e15192672a5ac59c27e06c074fbcf2e1dba7d89d5ce273748cf08bc2261a10f7818cc2d02c4b25fd5403b158a9 SHA512 091111b8cf6cd93d662737890dacb64439e930b287d29299d2fc2cb18709f61d1e8a8c17d44f7224d8370dda6dc89af91e4ce8959816903ad5363388d8e37d8f
 DIST ldb-2.7.2.tar.gz 1737849 BLAKE2B 0aa70d8a4827448e41874db97130f18d17683c800b8f03f9940b4852e24fd6092052f6e70aae845c587939b9be16c80d7a920f6b874a746f923c4513b73d2afc SHA512 beb2cd83a8f128713e0b43ec6e80d0f87ab0883c6c8f0cefbbf5bf49e29dfa327b245b78467d1906917cb5f3f11e01cb76cc6bcca58a47c5deac4f05c2e9dfbd
 DIST ldb-2.8.0.tar.gz 1747616 BLAKE2B 19fd4cc0893ca36e7aa65eb605b050e3faeb7add6c00a2dfd8415334c58b7dc644ffaad41c24fe358b39292aaa581e3231e6b8161b03c073e903cdae16050ac5 SHA512 b6f289af3137e02a8e3ee0588bc300d1756b8980558e0b3a3a9eee4449100ccd42ed873187dbdb334e7e7834a8bff8478cd4f20588d4ca834d9ea14c0ee2c2f9
+DIST ldb-2.9.0.tar.gz 1757213 BLAKE2B 6d24ced193a64e723da65f26a055b97e5c5645b0ce17263073db997e9310509c788e7739136b70d099d171d1d0cbbe43bb43ea50746d876d74a1be06fa2fc36f SHA512 b5cfbbcb2c35d6830bf1a7c85e1d4363728ae474504441add54c4c8569316b26aedbf6fb9f561ec4f187eb5a847ac76af07396e38d00e6f7632b63e02d7b64a1
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/files/ldb-2.9.0-optional_packages.patch b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/files/ldb-2.9.0-optional_packages.patch
new file mode 100644
index 0000000000..791f49c8de
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/files/ldb-2.9.0-optional_packages.patch
@@ -0,0 +1,41 @@
+diff -ur ldb-2.9.0/wscript ldb-2.9.0.new/wscript
+--- ldb-2.9.0/wscript	2024-01-29 10:20:28.452400700 -0600
++++ ldb-2.9.0.new/wscript	2024-04-17 10:49:58.934921251 -0500
+@@ -34,6 +34,10 @@
+     opt.RECURSE('lib/tevent')
+     opt.RECURSE('lib/replace')
+     opt.load('python') # options for disabling pyc or pyo compilation
++    if opt.IN_LAUNCH_DIR():
++        opt.add_option('--disable-ldap',
++        help=("disable ldap support"),
++        action="store_true", dest='disable_ldap', default=False)
+ 
+     opt.add_option('--without-ldb-lmdb',
+                    help='disable new LMDB backend for LDB',
+@@ -41,6 +45,10 @@
+ 
+ 
+ def configure(conf):
++    conf.env.standalone_ldb = conf.IN_LAUNCH_DIR()
++
++    conf.env.disable_ldap = getattr(Options.options, 'disable_ldap', False)
++
+     conf.RECURSE('lib/tdb')
+     conf.RECURSE('lib/tevent')
+ 
+@@ -145,9 +153,12 @@
+     if conf.env.standalone_ldb:
+         conf.CHECK_XSLTPROC_MANPAGES()
+ 
+-        # we need this for the ldap backend
+-        if conf.CHECK_FUNCS_IN('ber_flush ldap_open ldap_initialize', 'lber ldap', headers='lber.h ldap.h'):
+-            conf.env.ENABLE_LDAP_BACKEND = True
++        if not conf.env.disable_ldap:
++           # we need this for the ldap backend
++            if conf.CHECK_FUNCS_IN('ber_flush ldap_open ldap_initialize', 'lber ldap', headers='lber.h ldap.h'):
++                conf.env.ENABLE_LDAP_BACKEND = True
++        else:
++            conf.env.ENABLE_LDAP_BACKEND = False
+ 
+         # we don't want any libraries or modules to rely on runtime
+         # resolution of symbols
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.0.ebuild
new file mode 100644
index 0000000000..c0dac63c71
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ldb/ldb-2.9.0.ebuild
@@ -0,0 +1,173 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit python-single-r1 waf-utils multilib-minimal
+
+DESCRIPTION="LDAP-like embedded database"
+HOMEPAGE="https://ldb.samba.org"
+SRC_URI="https://samba.org/ftp/pub/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0/${PV}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="doc ldap +lmdb python test"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}
+	test? ( lmdb )"
+
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.2"
+TDB_VERSION="1.4.10"
+TEVENT_VERSION="0.16.1"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	dev-libs/popt[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tdb-${TDB_VERSION}[${MULTILIB_USEDEP}]
+	>=sys-libs/tevent-${TEVENT_VERSION}[${MULTILIB_USEDEP}]
+	ldap? ( net-nds/openldap:= )
+	lmdb? ( >=dev-db/lmdb-0.9.16:=[${MULTILIB_USEDEP}] )
+	python? (
+		${PYTHON_DEPS}
+		sys-libs/talloc[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tdb[python,${PYTHON_SINGLE_USEDEP}]
+		sys-libs/tevent[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	virtual/libcrypt
+	test? ( >=dev-util/cmocka-1.1.3[${MULTILIB_USEDEP}] )
+"
+BDEPEND="${PYTHON_DEPS}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+MULTILIB_WRAPPED_HEADERS=( /usr/include/pyldb.h )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.9.0-optional_packages.patch
+	"${FILESDIR}"/${PN}-1.1.31-fix_PKGCONFIGDIR-when-python-disabled.patch
+	"${FILESDIR}"/${PN}-2.4.2-skip-32bit-time_t-tests.patch
+	"${FILESDIR}"/${PN}-2.5.2-skip-waf-tevent-check.patch
+)
+
+pkg_setup() {
+	# Package fails to build with distcc
+	export DISTCC_DISABLE=1
+	export PYTHONHASHSEED=1
+
+	# waf requires a python interpreter
+	python-single-r1_pkg_setup
+}
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+
+	actual_tdb_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tdb/wscript || die)
+	if [[ ${actual_tdb_version} != ${TDB_VERSION} ]] ; then
+		eerror "Source tdb version: ${TDB_VERSION}"
+		eerror "Ebuild tdb version: ${actual_tdb_version}"
+		die "Ebuild needs to fix TDB_VERSION!"
+	fi
+
+	actual_tevent_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/tevent/wscript || die)
+	if [[ ${actual_tevent_version} != ${TEVENT_VERSION} ]] ; then
+		eerror "Source tevent version: ${TEVENT_VERSION}"
+		eerror "Ebuild tevent version: ${actual_tevent_version}"
+		die "Ebuild needs to fix TEVENT_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test && ! use python ; then
+		# We want to be able to run tests w/o Python as it makes
+		# automated testing much easier (as USE=python isn't default-enabled).
+		truncate -s0 tests/python/{repack,index,api,crash}.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	local myconf=(
+		$(usex ldap '' --disable-ldap)
+		$(usex lmdb '' --without-ldb-lmdb)
+		--disable-rpath
+		--disable-rpath-install
+		--with-modulesdir="${EPREFIX}"/usr/$(get_libdir)/samba
+		--bundled-libraries="${bundled_libs}"
+		--builtin-libraries=NONE
+	)
+
+	if ! use python || ! multilib_is_native_abi; then
+		myconf+=( --disable-python )
+	fi
+
+	waf-utils_src_configure "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+	multilib_is_native_abi && use doc && doxygen Doxyfile
+}
+
+multilib_src_test() {
+	if multilib_is_native_abi; then
+		WAF_MAKE=1 \
+		PATH=buildtools/bin:../../../buildtools/bin:${PATH}:"${BUILD_DIR}"/bin/shared/private/ \
+		LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:"${BUILD_DIR}"/bin/shared/private/:"${BUILD_DIR}"/bin/shared \
+		waf test || die
+	fi
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	if multilib_is_native_abi && use doc; then
+		doman  apidocs/man/man3/*.3
+		docinto html
+		dodoc -r apidocs/html/.
+	fi
+
+	# bug #726454
+	use python && python_optimize
+}
+
+pkg_postinst() {
+	if has_version sys-auth/sssd; then
+		ewarn "You have sssd installed. It is known to break after ldb upgrades,"
+		ewarn "so please try to rebuild it before reporting bugs."
+		ewarn "See https://bugs.gentoo.org/404281"
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
index 5ff351026d..dbce37fe8a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libblockdev/libblockdev-3.1.1.ebuild
@@ -17,7 +17,7 @@ if [[ "${PV}" == *9999 ]] ; then
 else
 	MY_PV="${PV}-1"
 	SRC_URI="https://github.com/storaged-project/${PN}/releases/download/${MY_PV}/${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 fi
 LICENSE="LGPL-2+"
 SLOT="0/3"	# subslot is SOVERSION
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest
index 2ecd76d3fa..4140907f66 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/Manifest
@@ -1,2 +1,3 @@
+DIST libseccomp-2.5.5-loongarch-r1.patch 119822 BLAKE2B 4aa75c1ac87b2ca25cf6be38dfd760879c7255ca8e6cf86be3ac6e354f76cdaf3c8e2f59b646254414ffb0f1ffe6b7c50478f4db895a6ce632db8782c9807e91 SHA512 f7cd768d672a25448b2a3ceda27db52e0d62b5d9ab3eeb906226b6ebc19332c89332e0b870aaf82d4ffcfd642c2deb6029a30ae9a6bd702ebad9fdd40622b582
 DIST libseccomp-2.5.5-loongarch64-20231204.patch.xz 41236 BLAKE2B 7831b28c275771bb675b4b5045e657d96c254e69cee7188a19f4812bc83343e0041772c20be1e7392ec88387726b49f34aa670a906b922dba531a0d35e548b1e SHA512 7870e536d834360dfec446493815b675a305f6bec1b79d0caae6fb546d2f694e77ce52e547bbcdb22cda272272bf3d5a427960b4aa76fb987d06ab035298007d
 DIST libseccomp-2.5.5.tar.gz 642445 BLAKE2B d770cee1f3e02fbbcd9f25655b360ab38160ad800e2829a67f2b9da62b095a90be99ac851a67344cf95bd6810a6268da4655dc1d37d996e58239c4999eb41998 SHA512 f630e7a7e53a21b7ccb4d3e7b37616b89aeceba916677c8e3032830411d77a14c2d74dcf594cd193b1acc11f52595072e28316dc44300e54083d5d7b314a38da
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-arch-syscall-check.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-arch-syscall-check.patch
new file mode 100644
index 0000000000..238098ad4c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/files/libseccomp-2.5.5-arch-syscall-check.patch
@@ -0,0 +1,45 @@
+From 744c9a897b74ad66d065791593e25a05e4b6f6a1 Mon Sep 17 00:00:00 2001
+From: Michal Privoznik <mprivozn@redhat.com>
+Date: Tue, 1 Nov 2022 11:59:51 +0100
+Subject: [PATCH] src: Make arch-syscall-check work in VPATH build
+
+The aim of arch-syscall-check test is to check for syscalls
+missing implementation. It does so by comparing two files:
+
+  1) src/syscalls.csv
+  2) include/seccomp-syscalls.h
+
+However, due to use of relative paths these files are not found
+when doing a VPATH build. But, we can re-use an idea from GNU
+coreutils and get an absolute path to the source dir. All that's
+needed then is to prefix those two paths with the source dir
+path.
+
+Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Acked-by: Tom Hromatka <tom.hromatka@oracle.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+---
+ src/arch-syscall-check | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/arch-syscall-check b/src/arch-syscall-check
+index ae67daa..9c7fd41 100755
+--- a/src/arch-syscall-check
++++ b/src/arch-syscall-check
+@@ -22,8 +22,11 @@
+ # along with this library; if not, see <http://www.gnu.org/licenses>.
+ #
+ 
+-SYSCALL_CSV="./syscalls.csv"
+-SYSCALL_HDR="../include/seccomp-syscalls.h"
++# Based on an idea from GNU coreutils
++abs_topsrcdir="$(unset CDPATH; cd $(dirname $0)/.. && pwd)"
++
++SYSCALL_CSV="$abs_topsrcdir/src/syscalls.csv"
++SYSCALL_HDR="$abs_topsrcdir/include/seccomp-syscalls.h"
+ 
+ function check_snr() {
+ 	(export LC_ALL=C; diff \
+-- 
+2.44.0
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r1.ebuild
index db6a08dfb2..ecedd688b5 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-2.5.5-r1.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit distutils-r1 multilib-minimal
 
@@ -16,11 +16,15 @@ HOMEPAGE="https://github.com/seccomp/libseccomp"
 if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/seccomp/libseccomp.git"
 	PRERELEASE="2.6.0"
+	AUTOTOOLS_AUTO_DEPEND=yes
 	inherit autotools git-r3
 else
+	AUTOTOOLS_AUTO_DEPEND=no
+	inherit autotools
 	SRC_URI="https://github.com/seccomp/libseccomp/releases/download/v${PV}/${P}.tar.gz
-		experimental-loong? ( https://dev.gentoo.org/~xen0n/distfiles/${PN}-2.5.5-loongarch64-20231204.patch.xz )"
-	KEYWORDS="-* ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux"
+		experimental-loong? ( https://github.com/matoro/libseccomp/compare/v${PV}..loongarch-r1.patch
+			-> ${P}-loongarch-r1.patch )"
+	KEYWORDS="-* amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
 fi
 
 LICENSE="LGPL-2.1"
@@ -39,6 +43,7 @@ RDEPEND="${DEPEND}"
 BDEPEND="
 	${DEPEND}
 	dev-util/gperf
+	experimental-loong? ( ${AUTOTOOLS_DEPEND} )
 	python? (
 		${DISTUTILS_DEPS}
 		dev-python/cython[${PYTHON_USEDEP}]
@@ -49,15 +54,20 @@ PATCHES=(
 	"${FILESDIR}"/libseccomp-python-shared.patch
 	"${FILESDIR}"/libseccomp-2.5.3-skip-valgrind.patch
 	"${FILESDIR}"/libseccomp-2.5.5-which-hunt.patch
+	"${FILESDIR}"/libseccomp-2.5.5-arch-syscall-check.patch
 )
 
 src_prepare() {
 	if use experimental-loong; then
-		PATCHES+=( "${WORKDIR}/${PN}-2.5.5-loongarch64-20231204.patch" )
+		PATCHES+=( "${DISTDIR}/${P}-loongarch-r1.patch" )
 	fi
 
 	default
 
+	if [[ ${PV} == *9999 ]] ; then
+		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die
+	fi
+
 	if use experimental-loong; then
 		# touch generated files to avoid activating maintainer mode
 		# remove when loong-fix-build.patch is no longer necessary
@@ -65,9 +75,8 @@ src_prepare() {
 		find . -name Makefile.in -exec touch {} + || die
 	fi
 
-	if [[ ${PV} == *9999 ]] ; then
-		sed -i -e "s/0.0.0/${PRERELEASE}/" configure.ac || die
-
+	if [[ ${PV} == *9999 ]] || use experimental-loong; then
+		rm -f "include/seccomp.h" || die
 		eautoreconf
 	fi
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild
index 45cf592639..ac4df44838 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libseccomp/libseccomp-9999.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 
 inherit distutils-r1 multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
index 797ed94d9f..7b5177af91 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/Manifest
@@ -132,8 +132,13 @@ DIST ncurses-6.4-20240323.patch.gz 143301 BLAKE2B f51c229985025950ebe0b35e1e9cb1
 DIST ncurses-6.4-20240323.patch.gz.asc 729 BLAKE2B 380eaa8b0f3faa3e2ff21a3847c6f2ba59019adec68391134bb68bdecfd13cb56589ad4ec062dd391ae3d7bd96a306d85e78ef0827300de594723d188272e7c4 SHA512 380675d04ad1db69a039001b109bea6e7ef3f9fa0059ebe8b17ad12d0b59b20dd18b90abedb63f95db2ed6ad770de77aacc85c24d70bb883b1851c72c5dada88
 DIST ncurses-6.4-20240330.patch.gz 63526 BLAKE2B 593823a358017e5f98e897ebd6e1a2f945b0329c51a76b0ea65458751d2486dc51a71c1d0fdfbc1741167c47ed0b8aedc52b1a923c4788f23293d7e7729885c7 SHA512 666c8f7a37bc2b93b9b0ff76f2a5fe412f1d5c0c9260b64a26665e7c3ba74a9f05ae3883a512425d901ab943948509792759297ea85b9642cd02b7b64455326e
 DIST ncurses-6.4-20240330.patch.gz.asc 729 BLAKE2B 159c110254d81b1c83d7cdb3250fce7ac12d1b4773e6c1a4a347bc7a5d96893504b1a7066d6a8997c3db467ba7d3705e043714000142fd2ebac6e9a008a62ae8 SHA512 1a0dcc56e79da6e0d615bd0a6571869e42aa6e31233e6cb01fe85c8816c82858c23e93a47650e1a4fd8cee2461e4900f7b78a4f9aa3149a0aec6cda704f9c163
+DIST ncurses-6.4-20240413.patch.gz 113122 BLAKE2B d8e5d011a8ab61dd30624c51d7917ecc66f388c8b0edcba25f35179031a16b5a41379d8c5f2c40a2b6af5e485b25ca8a3cb1c97301450b00c14e2640187f0054 SHA512 45c14df0fc4229667ae173cd4eb37fad2a3dbcb8906763a4d472fad7b563dbe72dbc0bc12e6070e6e7f2e64fc2f3a254bffe5d1e904dce9f5636fccdd2761750
+DIST ncurses-6.4-20240413.patch.gz.asc 729 BLAKE2B 3786f815cddf3f6ebbf89da47e3151c01d50f26c2fa713cb982c61b7190ca25a807b6f7264688a296d5d252c78f4737372f2c6f26d7713bc448c5228676e922f SHA512 c172fe7f308a01474d04b06919b43710abcdb9fe3961396cbc7731f619093ed18bc7deb9bb62075e3bd0bb88d345059c9bf485a4f9ef614dc1109d4549c95a34
+DIST ncurses-6.4-20240414.patch.gz 3007 BLAKE2B a4db0635df3b2669ae1ba0057c21f717db2512aa51545ea5157dbaf33c3db334cf8315ecd60a4c8a6406e6e7ba417e23f00f575af72c56b18046e3c4a34dab87 SHA512 348ffdbeb2b7350493957562a0af1a217590dd35cd9f8f27ff46adfb969018224e170b63581f5b3ad268293441db59878898bd23d1d1a4add77fc681344df526
+DIST ncurses-6.4-20240414.patch.gz.asc 729 BLAKE2B 8d579b2724245756947200a3e704c1ae534ba64e6986ad009a5ca9d33145fff82ddae9003a7c6ffe5b64b68f813661440afcac0a1321e5b80113d3ec94e1ea5a SHA512 0976a253d11fb10d52fee1cd2ad38e80b0b531f89efe94a62b9a0e2d69206bd1574140785776c7f6bd19775f6ca446c582da31cd9f51a8b0f12039d1e9695600
 DIST ncurses-6.4.tar.gz 3612591 BLAKE2B 47fd9c2d27f44fa9942552881a471e5067465dbace40bf68b28998dded0556127a1d8662b96de4de4fd76c1c8b98bdae796036553ab4b05ca9f160839d841ba3 SHA512 1c2efff87a82a57e57b0c60023c87bae93f6718114c8f9dc010d4c21119a2f7576d0225dab5f0a227c2cfc6fb6bdbd62728e407f35fce5bf351bb50cf9e0fd34
 DIST ncurses-6.4.tar.gz.sig 438 BLAKE2B e6a78b8d0cbce1577205b49b0260394094632cefd95294813c7e4e51a2908e8599a9f24b3b648e42ba16c015fb9424b2a82236f58aac3bf96f5400a50482e44e SHA512 f2a7859725b4d5d62f68006338d56598ac6b38a1448983108906e192f0ec922be287cc89bcc79c1ae49ebc80c967af3dd077427f35ae579b00d445c882414fed
 DIST ncurses-6.4_p20230408-patches.tar.xz 80472 BLAKE2B 0ba8156ebd4f1691fec7bc1b800ef39ce6a4210573c027dd437919cdcd7c995830116da06c69f31c65923845a4d5c88e974673fac38acce5813f7d6cdc646e3e SHA512 32960e2cc4cd9dc60c38b49f46c5ce2c02179479abb66ca29f63cd06475ae8e26299a78b5f06762d114aefbbca3ba6fbebe7093a58106eeaa40cf500d21633a4
 DIST ncurses-6.4_p20230527-patches.tar.xz 63080 BLAKE2B 9db4ac28c8936d3a9c6f3ca5cb8a4c92aa79ee4ce49789bcfc9c031a0454bf6f55a0544bc4a3dbb5c243ed9b2d0792afb98622a6a14b11675b7988100a650eb5 SHA512 3eacda173e8a177cd201ca3fef65311ac92e7e5af4039dc8a5792beae7db1d37efd06f5a55c249eebb771d1245995ff3a206a45794936b6b4299151666dbeade
 DIST ncurses-6.4_p20240330-patches.tar.xz 63796 BLAKE2B 3e6618ba0b37268d10a16cf26c2810e55c17ded97079af3753e34f2d12575f979a2e55cfd308abf783e35e39d4a848b89f435b4886d3633007ccb522b8dc2e51 SHA512 1bbf1978f9287f68bf6a8596f06d4d0523564bf3d2f6b3bd9746081a2fa0c76e36862beca62a4157d51cac0df61e456ddb6cacfae10b92344fe80cd752f72c38
+DIST ncurses-6.4_p20240413-patches.tar.xz 63760 BLAKE2B 6a91d453cca3705ca54b3a6f2ef00250d655168c1697726db4b581a1597cbc143479b8794e176d5e4154c794f99ea33c3fe1eb26605789930fc82649a2da3c93 SHA512 59239503a9400e054641428528799aa9c13b12669b31f32b2ff18cb60882698801e04dcdf75ece8357c7a4c3b899a729aa973090ec12a20de72cb80a916878b8
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
new file mode 100644
index 0000000000..3d26b09367
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/ncurses/ncurses-6.4_p20240414.ebuild
@@ -0,0 +1,488 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# sys-libs/ncurses-compat can be bumped with sys-libs/ncurses as upstream
+# provide a configure option for the ABI version.
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/thomasdickey.asc
+inherit flag-o-matic toolchain-funcs multilib multilib-minimal preserve-libs usr-ldscript verify-sig
+
+MY_PV="${PV:0:3}"
+MY_P="${PN}-${MY_PV}"
+DESCRIPTION="Console display library"
+HOMEPAGE="https://www.gnu.org/software/ncurses/ https://invisible-island.net/ncurses/"
+# Keep invisible-mirror.net here as some users reported 403 forbidden with invisible-island.net
+SRC_URI="
+	mirror://gnu/ncurses/${MY_P}.tar.gz
+	https://invisible-island.net/archives/${PN}/${MY_P}.tar.gz
+	https://invisible-mirror.net/archives/${PN}/${MY_P}.tar.gz
+	verify-sig? ( mirror://gnu/ncurses/${MY_P}.tar.gz.sig )
+"
+
+GENTOO_PATCH_DEV=sam
+GENTOO_PATCH_PV=6.4_p20240413
+GENTOO_PATCH_NAME=${PN}-${GENTOO_PATCH_PV}-patches
+
+# Populated below in a loop. Do not add patches manually here.
+UPSTREAM_PATCHES=()
+
+if [[ ${PV} == *_p* ]] ; then
+	# Sometimes, after releases, there's no megapatch available yet.
+	#
+	# From upstream README at e.g. https://invisible-island.net/archives/ncurses/6.3/:
+	#
+	#	"At times (generally to mark a relatively stable point), I create a rollup
+	#	patch, which consists of all changes from the release through the current date."
+	#
+	# Also, from https://lists.gnu.org/archive/html/bug-ncurses/2019-08/msg00039.html,
+	# the patches are considered to be acceptable to use after some testing. They
+	# are both for development but also bug fixes.
+	#
+	# This array should contain a list of all the snapshots since the last
+	# release if there's no megapatch available yet.
+	PATCH_DATES=(
+		20230107
+		20230114
+		20230121
+		20230128
+		20230211
+		20230218
+		20230225
+		20230311
+		20230401
+		20230408
+		20230415
+		20230418
+		20230423
+		20230424
+		20230429
+		20230506
+		20230514
+		20230520
+		20230527
+		20230603
+		20230610
+		20230615
+		20230617
+		20230624
+		20230625
+		20230701
+		20230708
+		20230715
+		20230722
+		20230729
+		20230805
+		20230812
+		20230819
+		20230826
+		20230902
+		20230909
+		20230917
+		20230918
+		20230923
+		20231001
+		20231007
+		20231014
+		20231016
+		20231021
+		20231028
+		20231104
+		20231111
+		20231118
+		20231121
+		20231125
+		20231202
+		20231209
+		20231217
+		20231223
+		20231230
+		20240106
+		20240113
+		20240120
+		20240127
+		20240203
+		20240210
+		20240217
+		20240224
+		20240302
+		20240309
+		20240323
+		20240330
+		20240413
+
+		# Latest patch is just _pN = $(ver_cut 4)
+		$(ver_cut 4)
+	)
+
+	if [[ -z ${PATCH_DATES[@]} ]] ; then
+		SRC_URI+=" https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz"
+		SRC_URI+=" verify-sig? ( https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P/_p/-}.patch.sh.gz.asc"
+
+		# If we have a rollup patch, use that instead of the individual ones.
+		UPSTREAM_PATCHES+=( patch.sh )
+	else
+		# We use a mirror as well because we've had reports of 403 forbidden for some users.
+		upstream_url_base="https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+		upstream_m_url_base="https://invisible-mirror.net/archives/${PN}/${PV/_p*}/${MY_P}-"
+
+		# Prefix each date with the upstream location (https://invisible-island.net/archives/${PN}/${PV/_p*}/${MY_P})
+		mangled_patches=( "${PATCH_DATES[@]/#/${upstream_url_base}}" )
+		# Suffix each with .patch.gz
+		mangled_patches=( "${mangled_patches[@]/%/.patch.gz}" )
+		mangled_patches_sig=( "${mangled_patches[@]/%/.asc}" )
+		# Repeat for .patch.gz.asc for verify-sig
+		SRC_URI+=" ${mangled_patches[@]}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]} )"
+
+		# For all of the URLs, chuck in invisible-island.net too:
+		SRC_URI+=" ${mangled_patches[@]/${upstream_url_base}/${upstream_m_url_base}}"
+		SRC_URI+=" verify-sig? ( ${mangled_patches_sig[@]/${upstream_url_base}/${upstream_m_url_base}} )"
+
+		UPSTREAM_PATCHES=( "${PATCH_DATES[@]/%/.patch}" )
+
+		unset upstream_url_base upstream_m_url_base mangled_patches mangled_patches_sig
+	fi
+fi
+
+SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${GENTOO_PATCH_NAME}.tar.xz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="MIT"
+# The subslot reflects the SONAME.
+SLOT="0/6"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="ada +cxx debug doc gpm minimal profile split-usr +stack-realign static-libs test tinfo trace"
+RESTRICT="!test? ( test )"
+
+DEPEND="gpm? ( sys-libs/gpm[${MULTILIB_USEDEP}] )"
+# Block the older ncurses that installed all files w/SLOT=5, bug #557472
+RDEPEND="
+	${DEPEND}
+	!<=sys-libs/ncurses-5.9-r4:5
+	!<sys-libs/slang-2.3.2_pre23
+	!<x11-terms/rxvt-unicode-9.06-r3
+	!<x11-terms/st-0.6-r1
+"
+BDEPEND="verify-sig? ( sec-keys/openpgp-keys-thomasdickey )"
+
+PATCHES=(
+	"${UPSTREAM_PATCHES[@]/#/${WORKDIR}/${MY_P}-}"
+
+	# When rebasing Gentoo's patchset, please use git from a clean
+	# src_prepare with upstream patches already applied. git am --reject
+	# the existing patchset and rebase as required. This makes it easier
+	# to manage future rebasing & adding new patches.
+	#
+	# For the same reasons, please include the original configure.in changes,
+	# NOT just the generated results!
+	"${WORKDIR}"/${GENTOO_PATCH_NAME}
+)
+
+src_unpack() {
+	# Avoid trying to verify our own patchset tarball, there's no point
+	if use verify-sig ; then
+		local file
+		for file in ${A} ; do
+			if [[ ${file} == ${MY_P}.tar.gz ]] ; then
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.sig
+			else
+				[[ ${file} == @(*${GENTOO_PATCH_NAME}.tar.xz|*.asc|*.sig) ]] && continue
+
+				verify-sig_verify_detached "${DISTDIR}"/${file} "${DISTDIR}"/${file}.asc
+			fi
+		done
+	fi
+
+	default
+}
+
+src_configure() {
+	# bug #115036
+	unset TERMINFO
+
+	tc-export_build_env BUILD_{CC,CXX,CPP}
+
+	# bug #214642
+	BUILD_CPPFLAGS+=" -D_GNU_SOURCE"
+
+	# Build the various variants of ncurses -- narrow, wide, and threaded. #510440
+	# Order matters here -- we want unicode/thread versions to come last so that the
+	# binaries in /usr/bin support both wide and narrow.
+	# The naming is also important as we use these directly with filenames and when
+	# checking configure flags.
+	NCURSES_TARGETS=(
+		ncurses
+		ncursesw
+		ncursest
+		ncursestw
+	)
+
+	# When installing ncurses, we have to use a compatible version of tic.
+	# This comes up when cross-compiling, doing multilib builds, upgrading,
+	# or installing for the first time.  Build a local copy of tic whenever
+	# the host version isn't available. bug #249363, bug #557598
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		local lbuildflags="-static"
+
+		# some toolchains don't quite support static linking
+		local dbuildflags="-Wl,-rpath,${WORKDIR}/lib"
+		case ${CHOST} in
+			*-darwin*)  dbuildflags=     ;;
+			*-solaris*) dbuildflags="-Wl,-R,${WORKDIR}/lib" ;;
+		esac
+		echo "int main() {}" | \
+			$(tc-getCC) -o x -x c - ${lbuildflags} -pipe >& /dev/null \
+			|| lbuildflags="${dbuildflags}"
+
+		# We can't re-use the multilib BUILD_DIR because we run outside of it.
+		BUILD_DIR="${WORKDIR}" \
+		CC=${BUILD_CC} \
+		CXX=${BUILD_CXX} \
+		CPP=${BUILD_CPP} \
+		CHOST=${CBUILD} \
+		CFLAGS=${BUILD_CFLAGS} \
+		CXXFLAGS=${BUILD_CXXFLAGS} \
+		CPPFLAGS=${BUILD_CPPFLAGS} \
+		LDFLAGS="${BUILD_LDFLAGS} ${lbuildflags}" \
+		do_configure cross --without-shared --with-normal --with-progs --without-ada
+	fi
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${ABI} == x86 ]] ; then
+		# For compatibility with older binaries at slight performance cost.
+		# bug #616402
+		use stack-realign && append-flags -mstackrealign
+	fi
+
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_configure "${t}"
+	done
+}
+
+do_configure() {
+	local target=$1
+	shift
+
+	mkdir "${BUILD_DIR}/${target}" || die
+	cd "${BUILD_DIR}/${target}" || die
+
+	local conf=(
+		# We need the basic terminfo files in /etc, bug #37026.  We will
+		# add '--with-terminfo-dirs' and then populate /etc/terminfo in
+		# src_install() ...
+		--with-terminfo-dirs="${EPREFIX}/etc/terminfo:${EPREFIX}/usr/share/terminfo"
+
+		# Enable installation of .pc files.
+		--enable-pc-files
+		# This path is used to control where the .pc files are installed.
+		--with-pkg-config-libdir="${EPREFIX}/usr/$(get_libdir)/pkgconfig"
+
+		# Now the rest of the various standard flags.
+		--with-shared
+		# (Originally disabled until bug #245417 is sorted out, but now
+		# just keeping it off for good, given nobody needed it until now
+		# (2022) and we're trying to phase out bdb.)
+		--without-hashed-db
+		$(use_with ada)
+		$(use_with cxx)
+		$(use_with cxx cxx-binding)
+		--with-cxx-shared
+		$(use_with debug)
+		$(use_with profile)
+		# The configure script uses ldd to parse the linked output which
+		# is flaky for cross-compiling/multilib/ldd versions/etc...
+		$(use_with gpm gpm libgpm.so.1)
+		--disable-term-driver
+		--disable-termcap
+		--enable-symlinks
+		--with-manpage-format=normal
+		--enable-const
+		--enable-colorfgbg
+		--enable-hard-tabs
+		--enable-echo
+		$(use_enable !ada warnings)
+		$(use_with debug assertions)
+		$(use_enable !debug leaks)
+		$(use_with debug expanded)
+		$(use_with !debug macros)
+		$(multilib_native_with progs)
+		$(use_with test tests)
+		$(use_with trace)
+		$(use_with tinfo termlib)
+		--disable-stripping
+		--disable-pkg-ldflags
+	)
+
+	if [[ ${target} == ncurses*w ]] ; then
+		conf+=( --enable-widec )
+	else
+		conf+=( --disable-widec )
+	fi
+	if [[ ${target} == ncursest* ]] ; then
+		conf+=( --with-{pthread,reentrant} )
+	else
+		conf+=(
+			--without-{pthread,reentrant}
+
+			# XXX: Revisit on next ABI break (>6) (bug #928873)
+			--disable-opaque-curses
+			--disable-opaque-form
+			--disable-opaque-menu
+			--disable-opaque-panel
+		)
+	fi
+
+	# Make sure each variant goes in a unique location.
+	if [[ ${target} == "ncurses" ]] ; then
+		# "ncurses" variant goes into "${EPREFIX}"/usr/include
+		# It is needed on Prefix because the configure script appends
+		# "ncurses" to "${prefix}/include" if "${prefix}" is not /usr.
+		conf+=( --enable-overwrite )
+	else
+		conf+=( --includedir="${EPREFIX}"/usr/include/${target} )
+	fi
+	# See comments in src_configure.
+	if [[ ${target} != "cross" ]] ; then
+		local cross_path="${WORKDIR}/cross"
+		[[ -d ${cross_path} ]] && export TIC_PATH="${cross_path}/progs/tic"
+	fi
+
+	ECONF_SOURCE="${S}" econf "${conf[@]}" "$@"
+}
+
+src_compile() {
+	# See comments in src_configure.
+	if ! has_version -b "~sys-libs/${P}:0" ; then
+		BUILD_DIR="${WORKDIR}" do_compile cross -C progs tic$(get_exeext)
+	fi
+
+	multilib-minimal_src_compile
+}
+
+multilib_src_compile() {
+	local t
+	for t in "${NCURSES_TARGETS[@]}" ; do
+		do_compile "${t}"
+	done
+}
+
+do_compile() {
+	local target=$1
+	shift
+
+	cd "${BUILD_DIR}/${target}" || die
+
+	# A little hack to fix parallel builds ... they break when
+	# generating sources so if we generate the sources first (in
+	# non-parallel), we can then build the rest of the package
+	# in parallel.  This is not really a perf hit since the source
+	# generation is quite small.
+	emake -j1 sources
+
+	# For some reason, sources depends on pc-files which depends on
+	# compiled libraries which depends on sources which ...
+	# Manually delete the pc-files file so the install step will
+	# create the .pc files we want.
+	rm -f misc/pc-files || die
+	emake "$@"
+}
+
+multilib_src_install() {
+	local target
+	for target in "${NCURSES_TARGETS[@]}" ; do
+		emake -C "${BUILD_DIR}/${target}" DESTDIR="${D}" install
+	done
+
+	# Move main libraries into /.
+	if multilib_is_native_abi ; then
+		gen_usr_ldscript -a \
+			"${NCURSES_TARGETS[@]}" \
+			$(usex tinfo 'tinfow tinfo' '')
+	fi
+
+	# Don't delete '*.dll.a', needed for linking, bug #631468
+	if ! use static-libs; then
+		find "${ED}"/usr/ -name '*.a' ! -name '*.dll.a' -delete || die
+	fi
+
+	# Build fails to create this ...
+	# -FIXME-
+	# Ugly hackaround for riscv having two parts libdir (bug #689240)
+	# Replace this hack with an official solution once we have one...
+	# -FIXME-
+	dosym $(sed 's@[^/]\+@..@g' <<< $(get_libdir))/share/terminfo \
+		/usr/$(get_libdir)/terminfo
+
+	# Remove obsolete libcurses symlink that is created by the build
+	# system. Technically, this could be also achieved
+	# via --disable-overwrite but it also moves headers implicitly,
+	# and we do not want to do this yet.
+	# bug #836696
+	rm "${ED}"/usr/$(get_libdir)/libcurses* || die
+}
+
+multilib_src_install_all() {
+	local terms=(
+		# Dumb/simple values that show up when using the in-kernel VT.
+		ansi console dumb linux
+		vt{52,100,102,200,220}
+		# [u]rxvt users used to be pretty common.  Probably should drop this
+		# since upstream is dead and people are moving away from it.
+		rxvt{,-unicode}{,-256color}
+		# xterm users are common, as is terminals re-using/spoofing it.
+		xterm xterm-{,256}color
+		# screen is common (and reused by tmux).
+		screen{,-256color}
+		screen.xterm-256color
+	)
+	if use split-usr ; then
+		local x
+		# We need the basic terminfo files in /etc for embedded/recovery, bug #37026
+		einfo "Installing basic terminfo files in /etc..."
+		for x in "${terms[@]}"; do
+			local termfile=$(find "${ED}"/usr/share/terminfo/ -name "${x}" 2>/dev/null)
+			local basedir=$(basename "$(dirname "${termfile}")")
+
+			if [[ -n ${termfile} ]] ; then
+				dodir "/etc/terminfo/${basedir}"
+				mv "${termfile}" "${ED}/etc/terminfo/${basedir}/" || die
+				dosym "../../../../etc/terminfo/${basedir}/${x}" \
+					"/usr/share/terminfo/${basedir}/${x}"
+			fi
+		done
+
+		echo "CONFIG_PROTECT_MASK=\"/etc/terminfo\"" | newenvd - 50ncurses
+
+		use minimal && rm -r "${ED}"/usr/share/terminfo*
+		# Because ncurses5-config --terminfo returns the directory we keep it
+		# bug #245374
+		keepdir /usr/share/terminfo
+	elif use minimal ; then
+		# Keep only the basic terminfo files
+		find "${ED}"/usr/share/terminfo/ \
+			\( -type f -o -type l \) ${terms[*]/#/! -name } -delete , \
+			-type d -empty -delete || die
+	fi
+
+	cd "${S}" || die
+	dodoc ANNOUNCE MANIFEST NEWS README* TO-DO doc/*.doc
+	if use doc ; then
+		docinto html
+		dodoc -r doc/html/
+	fi
+}
+
+pkg_preinst() {
+	preserve_old_lib /$(get_libdir)/libncurses.so.5
+	preserve_old_lib /$(get_libdir)/libncursesw.so.5
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /$(get_libdir)/libncurses.so.5
+	preserve_old_lib_notify /$(get_libdir)/libncursesw.so.5
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
index afbb7fec10..5a3da1defe 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/Manifest
@@ -1,3 +1,3 @@
-DIST talloc-2.3.4.tar.gz 674196 BLAKE2B 1fac0a45a4ba16c7741e6d810e1a1e56352c04f266b99de62770177c1218a8c8253be2d5d1793aae67ce61e6a1159cbcd4888a49702822e6817b86eb7a1fea31 SHA512 c46488deda99753fd79566d42cae88899b71196513a127813be2cb855e7f36b77132f0552297ee4153ba4d8f177cea3bb0dc93340caabf321c026657744684d9
 DIST talloc-2.4.0.tar.gz 676054 BLAKE2B 71b3f21fa7cd114579e1dc064aadda447c0d196beaa27a5919acebdce668f6b768dd7c293c056ae4c096f31d8e931255ee2b71728c4b7b0bbb7818169380e9ca SHA512 810d92a614d0b9e0ac6fe403c1643c4dda435f79c4627d3c3be228f94b4b2ee8e528efbbed07f7d1a16043d6e55bdf4f10826f31fb8ca1c649c4126ea09a3aff
 DIST talloc-2.4.1.tar.gz 679160 BLAKE2B a7913b25930c77da53c17c2e0d71386402b1059f93c751084037c5068a035bd543c2d7e24a2d8dc989bb4eea13fa1a3c7a362e4d6c14af0b2030fbfb2f513801 SHA512 4de3b66d7cd1ff3f53e28e86bf9e89528635465c67868e1262aab6946106c228b2c184e988561361c3194fb260d83e016477254c9dbea7abff40c4dc0d31c76c
+DIST talloc-2.4.2.tar.gz 679750 BLAKE2B 1f836d6b11e096e399ad7b99ad4abd3c140e75ee307695659c35b89eca600de247e5432bce523a299334f20ca2dad4c726b783a94c546b67fe25b2b7199b2915 SHA512 fb91665ffbe0cce96b1359940ff3ed21330c81c5331140788a26aa94f82b50492176e6000ff54b31d1a434bb1cb53a6a2c7894153545252a1fd91bda7c05a213
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.0.ebuild
index b261d2c9ac..72b9421fc0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.0.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils python-single-r1 multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild
index adea9688ba..47470a52c6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.1.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils python-single-r1 multilib-minimal
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.3.4.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
similarity index 78%
rename from sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.3.4.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
index dc1416135c..47470a52c6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.3.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/talloc/talloc-2.4.2.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils python-single-r1 multilib-minimal
 
@@ -13,11 +13,11 @@ SRC_URI="https://www.samba.org/ftp/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3 LGPL-3+ LGPL-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
-IUSE="compat +python"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+IUSE="compat +python test valgrind"
 
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-RESTRICT="test"
+RESTRICT="!test? ( test )"
 
 RDEPEND="
 	!elibc_SunOS? (
@@ -27,8 +27,13 @@ RDEPEND="
 	)
 	python? ( ${PYTHON_DEPS} )
 "
-DEPEND="${RDEPEND}"
-BDEPEND="${PYTHON_DEPS}
+# Valgrind is automagic here but it's a build-only dep so it's not so bad.
+DEPEND="
+	${RDEPEND}
+	valgrind? ( dev-debug/valgrind )
+"
+BDEPEND="
+	${PYTHON_DEPS}
 	dev-libs/libxslt
 	sys-devel/gettext
 "
@@ -41,10 +46,9 @@ MULTILIB_WRAPPED_HEADERS=(
 )
 
 pkg_setup() {
-	# try to turn off distcc and ccache for people that have a problem with it
+	# Try to turn off distcc and ccache for people that have a problem with it
 	export DISTCC_DISABLE=1
 	export CCACHE_DISABLE=1
-	export PYTHONHASHSEED=1
 
 	python-single-r1_pkg_setup
 }
@@ -59,16 +63,26 @@ src_prepare() {
 		sed -i "s/name = bld.pyembed_libname('pytalloc-util')/name = 'pytalloc-util'/" wscript || die
 	fi
 
-	# what would you expect of waf? i won't even waste time trying.
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 test_pytalloc.py || die
+	fi
+
+	# WAF
 	multilib_copy_sources
 }
 
 multilib_src_configure() {
 	local extra_opts=(
-		$(usex compat --enable-talloc-compat1 '')
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+
+		$(usev compat --enable-talloc-compat1)
 		$(multilib_native_usex python '' --disable-python)
 		$([[ ${CHOST} == *-solaris* ]] && echo '--disable-symbol-versions')
 	)
+
 	waf-utils_src_configure "${extra_opts[@]}"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
index e452caa9ba..7ff18268d2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/Manifest
@@ -1,3 +1,3 @@
-DIST tdb-1.4.7.tar.gz 741714 BLAKE2B ec2f991bbaa61d46f16b7a68a4e47a2f690cda261dd0e9fd9708e51ad64eefeb54ac8b1102cde6935916f840d3c89d7a2903f58175cceb78ea4ef889e82ddbc6 SHA512 2b5b20c299b60545943f106d854b6e0d4a559e16f08a7ed62fe57ee962bebc888c2e663bd5fef907aace05b316826fe8fbbf3f323b6d3427531e59ffe47d48e4
+DIST tdb-1.4.10.tar.gz 747139 BLAKE2B e271f824acc8c691a6e88f5e5f73d0673a132134d025e84461520108b94cd7a5db587a0012ad1172270d29042f29336aab6ca59a735d611d6529f81ec3c195e9 SHA512 b5147d811617d90a025d1070abf16c42744b3fc3cac1042fbff03b1e635af2eaf9c957a7bffdb3f56b4a0c775b44f8027def9f23deb1b3ede817b95bbece2ce9
 DIST tdb-1.4.8.tar.gz 742791 BLAKE2B dc2705cb16ee59f4d5bf25602032b25fd5338caa890db19939996a40cd19c4c999f9a74786d5754dbbd1de54d818541cf56844beeb33008aaee507d5dfcdba85 SHA512 763beebe923aa04303cbb91ce5970e6bbd13546888cff75ea9ab025afff3ef88fee539ae173fc2fb7ec661b6c337b0c2da361ce3d318f51ef6627bdb3fe6ca63
 DIST tdb-1.4.9.tar.gz 746608 BLAKE2B 2cdcf636b9ef5445d48ca2aab79d4ffd137a8409b6d7b1fcdbcd28797d4bbe617f768a5ef92a14c4ae6dddfc37576f5d411cf4d67edeb4319f46a1a15ffd94ee SHA512 6b0109075826b8630f6b5a7e7ade2fcff95c5d05338340af78219422610947c520707b3e484ff13fbd40bbfffe13977976e8ddcb1be7b13e13ac78b4e3ec06c2
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/files/tdb-1.4.7-configure-clang16.patch b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/files/tdb-1.4.7-configure-clang16.patch
deleted file mode 100644
index 9d3e485da5..0000000000
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/files/tdb-1.4.7-configure-clang16.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-https://bugs.gentoo.org/870043
-https://gitlab.com/samba-team/samba/-/merge_requests/2807
-https://src.fedoraproject.org/rpms/libtdb/blob/rawhide/f/libtdb-waf18-c99.patch
-
-Avoid calling lib_func without a prototype.
-
-This commit mirrors the change in commit f4c0a750d4adebcf2342a44e85f04526c34
-("WAF: Fix detection of linker features")
-to buildtools/wafsamba/samba_conftests.py.  It fixes the check for rpath
-support with compilers in strict C99 mode.
-
-Submitted upstream: <https://gitlab.com/samba-team/samba/-/merge_requests/2807>
-
---- a/buildtools/wafsamba/samba_waf18.py
-+++ b/buildtools/wafsamba/samba_waf18.py
-@@ -209,7 +209,8 @@ def CHECK_LIBRARY_SUPPORT(conf, rpath=False, version_script=False, msg=None):
-         lib_node.parent.mkdir()
-         lib_node.write('int lib_func(void) { return 42; }\n', 'w')
-         main_node = bld.srcnode.make_node('main.c')
--        main_node.write('int main(void) {return !(lib_func() == 42);}', 'w')
-+        main_node.write('int lib_func(void);\n'
-+                        'int main(void) {return !(lib_func() == 42);}', 'w')
-         linkflags = []
-         if version_script:
-             script = bld.srcnode.make_node('ldscript')
-
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.7-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
similarity index 67%
rename from sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.7-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
index 55c2e98449..aaa8bb18ce 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.7-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.10.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils multilib-minimal python-single-r1
 
@@ -13,10 +13,11 @@ SRC_URI="https://samba.org/ftp/tdb/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="python"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="python test"
+
 REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-RESTRICT="test"
+RESTRICT="!test? ( test )"
 
 RDEPEND="
 	dev-libs/libbsd[${MULTILIB_USEDEP}]
@@ -33,23 +34,28 @@ BDEPEND="
 
 WAF_BINARY="${S}/buildtools/bin/waf"
 
-PATCHES=(
-	"${FILESDIR}"/${PN}-1.4.7-configure-clang16.patch
-)
-
-pkg_setup() {
-	python-single-r1_pkg_setup
-	export PYTHONHASHSEED=1
-}
-
 src_prepare() {
 	default
+
 	python_fix_shebang .
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		truncate -s0 python/tests/simple.py || die
+	fi
+
 	multilib_copy_sources
 }
 
 multilib_src_configure() {
-	local extra_opts=()
+	#MAKEOPTS+=" -j1"
+
+	local extra_opts=(
+		--libdir="${EPREFIX}/usr/$(get_libdir)"
+		--disable-dependency-tracking
+		--disable-warnings-as-errors
+	)
+
 	if ! multilib_is_native_abi || ! use python ; then
 		extra_opts+=( --disable-python )
 	fi
@@ -58,8 +64,6 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	# need to avoid parallel building, this looks like the sanest way with waf-utils/multiprocessing eclasses
-	unset MAKEOPTS
 	waf-utils_src_compile
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.8.ebuild
index 367f845e97..7215d9d77b 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.8.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.8.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_COMPAT=( python3_{9..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils multilib-minimal python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild
index 5b6c8e1e54..aaa8bb18ce 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tdb/tdb-1.4.9.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_COMPAT=( python3_{10..12} )
 PYTHON_REQ_USE="threads(+)"
 inherit waf-utils multilib-minimal python-single-r1
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
index e0b9daa2d1..1e65bee7c0 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/Manifest
@@ -3,3 +3,4 @@ DIST tevent-0.13.0.tar.gz 880601 BLAKE2B 4e2a2c055bac28cecae1a95b7ddab349ed780f4
 DIST tevent-0.14.0.tar.gz 878142 BLAKE2B 8c1c2b4cb683a3ca2630181904566c3cf9d0151c7e280f86e0ce24febfc5d0a1e85757e3ad9d635205bbcbe3e0d0a060dedb3207fb4e91ea76f36246f0a2704a SHA512 5e9525b2f8f8014d1147244dcccd6cf5ac49e383c49b19480ac1256dc7ccf60705960e87b8f63348fca3f4f496861f3d307ee5e0fde8189d93a596c5e689f2b1
 DIST tevent-0.14.1.tar.gz 881979 BLAKE2B 272b7d0029061dfd172a39135d806b937ee6f5bb9eb4c9c8d68a6e5cb3d9eca01582f7ddf5a15d7f033d3322c7fd4d6e87d697f76e4d44565c8e757398a5f0f8 SHA512 0bcc87c10f84e947edad8f8c31f3923253c599b7a69a1db1c21ab292e02937ccb8bad9f0f70e27420ead687aaed1a9b3830b6daa903b8a9bd48cc035a6e5f4ec
 DIST tevent-0.15.0.tar.gz 884634 BLAKE2B 071906dc0cc199a9b550e74ca7fcd3555e54a1c48a9be2c107c498ccf2157521336c3ec63fd776e3551064e9baf1ebcf9c7ff5eb0f04375b7d714056331476aa SHA512 470cc4489255a4f122ba1d680669589ba375d4081ff46631dd56f5104202d175bfb13356820eb9108a6b768b3837b2f5d26cc7b0acc3071c4787fb070df3cbab
+DIST tevent-0.16.1.tar.gz 890010 BLAKE2B 34639cf0e63193eebdb9c3f845390685d66916c6a687f22fbe25dbe175d3279752dfea1e3567fdb2eed3bea17108b9b226039cb1218c0536fc1eb7f4e0a025ab SHA512 cda001d91728b2f28dd081e9c5f6d8ede345dcd9ce1dca04394860cd83090c15aa8dfef1c53b73e120bd17f0d95551fa9301eb4927963314556d016fe5420a39
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
new file mode 100644
index 0000000000..30eeb780af
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/tevent/tevent-0.16.1.ebuild
@@ -0,0 +1,103 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="threads(+)"
+inherit waf-utils multilib-minimal python-single-r1
+
+DESCRIPTION="Samba tevent library"
+HOMEPAGE="https://tevent.samba.org/"
+SRC_URI="https://samba.org/ftp/tevent/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+IUSE="python test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+RESTRICT="!test? ( test )"
+
+TALLOC_VERSION="2.4.2"
+
+RDEPEND="
+	dev-libs/libbsd[${MULTILIB_USEDEP}]
+	>=sys-libs/talloc-${TALLOC_VERSION}[${MULTILIB_USEDEP}]
+	python? (
+		${PYTHON_DEPS}
+		>=sys-libs/talloc-${TALLOC_VERSION}[python,${PYTHON_SINGLE_USEDEP}]
+	)
+"
+DEPEND="
+	${RDEPEND}
+	elibc_glibc? (
+		net-libs/libtirpc[${MULTILIB_USEDEP}]
+		net-libs/rpcsvc-proto
+	)
+	test? ( >=dev-util/cmocka-1.1.3 )
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/pkgconfig
+"
+
+WAF_BINARY="${S}/buildtools/bin/waf"
+
+check_samba_dep_versions() {
+	actual_talloc_version=$(sed -En '/^VERSION =/{s/[^0-9.]//gp}' lib/talloc/wscript || die)
+	if [[ ${actual_talloc_version} != ${TALLOC_VERSION} ]] ; then
+		eerror "Source talloc version: ${TALLOC_VERSION}"
+		eerror "Ebuild talloc version: ${actual_talloc_version}"
+		die "Ebuild needs to fix TALLOC_VERSION!"
+	fi
+}
+
+src_prepare() {
+	default
+
+	check_samba_dep_versions
+
+	if use test ; then
+		# TODO: Fix python tests to run w/ USE=python.
+		# (depsite the name. bindings.py is just for Python tests.)
+		truncate -s0 bindings.py || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# When specifying libs for samba build you must append NONE to the end to
+	# stop it automatically including things
+	local bundled_libs="NONE"
+
+	# We "use" bundled cmocka when we're not running tests as we're
+	# not using it anyway. Means we avoid making users install it for
+	# no reason. bug #802531
+	if ! use test ; then
+		bundled_libs="cmocka,${bundled_libs}"
+	fi
+
+	waf-utils_src_configure \
+		--libdir="${EPREFIX}/usr/$(get_libdir)" \
+		--disable-dependency-tracking \
+		--disable-warnings-as-errors \
+		--bundled-libraries="${bundled_libs}" \
+		--builtin-libraries=NONE \
+		$(multilib_native_usex python '' '--disable-python')
+}
+
+multilib_src_compile() {
+	waf-utils_src_compile
+}
+
+multilib_src_install() {
+	waf-utils_src_install
+
+	multilib_is_native_abi && use python && python_domodule tevent.py
+}
+
+multilib_src_install_all() {
+	insinto /usr/include
+	doins tevent_internal.h
+}
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
index 1b038bda02..df56577906 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/Manifest
@@ -1,2 +1 @@
-DIST pixman-0.43.2.tar.xz 637976 BLAKE2B 82734efb7cede5b1aeff3a865bfa2a81ff3176be50edc10deb1b5541f160b2dfd21303c1eccba53c0df83f471f3489084479a423dc2f818019af97d4b41dad68 SHA512 1a1d21b86b3c6784c4c2606b7069723b4dbb747eac9fce95bca86516787840379ffd49abc42d11e7143e85c32c85496f33c2562c7a910ca6f963599affdc3224
 DIST pixman-0.43.4.tar.xz 636900 BLAKE2B c31e5700bfadcd72f522af50509a4a6cd7bbf90c918c75b108e50246f1c76e858125138902a222040ada192710ec788deb43eb65085416f3eff88e3ed970933e SHA512 b40fb05bd58dc78f4e4e9b19c86991ab0611b708657c9a7fb42bfe82d57820a0fde01a34b00a0848a41da6c3fb90c2213942a70f435a0e9467631695d3bc7e36
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.2.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.2.ebuild
deleted file mode 100644
index c20efe3bbb..0000000000
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.2.ebuild
+++ /dev/null
@@ -1,68 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-EGIT_REPO_URI="https://gitlab.freedesktop.org/pixman/pixman.git"
-
-if [[ ${PV} = 9999* ]]; then
-	GIT_ECLASS="git-r3"
-fi
-
-inherit ${GIT_ECLASS} flag-o-matic meson-multilib multiprocessing toolchain-funcs
-
-DESCRIPTION="Low-level pixel manipulation routines"
-HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
-if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-IUSE="cpu_flags_ppc_altivec cpu_flags_arm_iwmmxt cpu_flags_arm_iwmmxt2 cpu_flags_arm_neon loongson2f cpu_flags_x86_mmxext cpu_flags_x86_sse2 cpu_flags_x86_ssse3 static-libs test"
-RESTRICT="!test? ( test )"
-
-pkg_pretend() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-pkg_setup() {
-	[[ ${MERGE_TYPE} != binary ]] && use test && tc-check-openmp
-}
-
-multilib_src_configure() {
-	if ( use arm || use arm64 ) && tc-is-clang ; then
-		# See bug #768138 and https://gitlab.freedesktop.org/pixman/pixman/-/issues/46
-		append-cflags $(test-flags-CC -fno-integrated-as)
-	fi
-
-	local emesonargs=(
-		$(meson_feature cpu_flags_arm_iwmmxt iwmmxt)
-		$(meson_use     cpu_flags_arm_iwmmxt2 iwmmxt2)
-		$(meson_feature cpu_flags_x86_mmxext mmx)
-		$(meson_feature cpu_flags_x86_sse2 sse2)
-		$(meson_feature cpu_flags_x86_ssse3 ssse3)
-		$(meson_feature cpu_flags_ppc_altivec vmx)
-		$(meson_feature loongson2f loongson-mmi)
-		$(meson_feature test openmp) # only used in unit tests
-		$(meson_feature test tests)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Ddemos=disabled
-		-Dgtk=disabled
-		-Dlibpng=disabled
-	)
-
-	if [[ ${ABI} == arm64 ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon a64-neon))
-	elif [[ ${ABI} == arm ]]; then
-		emesonargs+=($(meson_feature cpu_flags_arm_neon neon))
-	fi
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export OMP_NUM_THREADS=$(makeopts_jobs)
-	meson_src_test -t 100
-}
diff --git a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild
index 563b532ba3..c20efe3bbb 100644
--- a/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/x11-libs/pixman/pixman-0.43.4.ebuild
@@ -14,7 +14,7 @@ inherit ${GIT_ECLASS} flag-o-matic meson-multilib multiprocessing toolchain-func
 DESCRIPTION="Low-level pixel manipulation routines"
 HOMEPAGE="http://www.pixman.org/ https://gitlab.freedesktop.org/pixman/pixman/"
 if [[ ${PV} != 9999* ]]; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	SRC_URI="https://www.x.org/releases/individual/lib/${P}.tar.xz"
 fi