Merge pull request #1423 from flatcar/buildbot/weekly-portage-stable-package-updates-2023-11-27

Weekly portage-stable package updates 2023-11-27

changelog/security/2023-12-13-weekly-package-updates.md

@@ -0,0 +1 @@
+- intel-microcode ([CVE-2023-23583](https://nvd.nist.gov/vuln/detail/CVE-2023-23583))

changelog/updates/2023-12-13-weekly-package-updates.md

@@ -0,0 +1,12 @@
+- bpftool ([6.5.7](https://kernelnewbies.org/Linux_6.5#Tracing.2C_perf_and_BPF))
+- c-ares ([1.21.0](https://c-ares.org/changelog.html#1_21_0))
+- intel-microcode ([20231114_p20231114](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20231114))
+- selinux-base ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- selinux-base-policy ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- selinux-container ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- selinux-dbus ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- selinux-sssd ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- selinux-unconfined ([2.20231002](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20231002))
+- whois ([5.5.20](https://github.com/rfc1036/whois/blob/v5.5.20/debian/changelog))
+- xz-utils ([5.4.5](https://github.com/tukaani-project/xz/releases/tag/v5.4.5))
+- zlib ([1.3](https://github.com/madler/zlib/releases/tag/v1.3))

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/0001-Flatcar-modifications.patch

@@ -0,0 +1,501 @@
+From 5293e66fafd5f5cf2872abc03d8b49ed5bc81b9a Mon Sep 17 00:00:00 2001
+From: Krzesimir Nowak <knowak@microsoft.com>
+Date: Mon, 4 Dec 2023 12:17:25 +0100
+Subject: [PATCH] Flatcar modifications
+
+---
+ policy/modules/admin/netutils.te        |  20 ++++
+ policy/modules/kernel/corenetwork.if.in |  26 ++++
+ policy/modules/kernel/corenetwork.te.in |  12 +-
+ policy/modules/kernel/files.if          |  45 +++++++
+ policy/modules/kernel/kernel.te         |  73 ++++++++++++
+ policy/modules/services/container.fc    |   6 +
+ policy/modules/services/container.te    | 150 +++++++++++++++++++++++-
+ policy/modules/system/init.te           |   8 ++
+ policy/modules/system/locallogin.te     |   9 +-
+ policy/modules/system/logging.te        |   9 ++
+ 10 files changed, 355 insertions(+), 3 deletions(-)
+
+diff --git a/refpolicy/policy/modules/admin/netutils.te b/refpolicy/policy/modules/admin/netutils.te
+index 3c43a1d84..429c67220 100644
+--- a/refpolicy/policy/modules/admin/netutils.te
++++ b/refpolicy/policy/modules/admin/netutils.te
+@@ -128,6 +128,16 @@ corenet_raw_sendrecv_generic_if(ping_t)
+ corenet_raw_sendrecv_generic_node(ping_t)
+ corenet_tcp_sendrecv_generic_node(ping_t)
+ corenet_raw_bind_generic_node(ping_t)
++#
++# FLATCAR:
++#
++# This is to fix ping -I with some IP or network interface.
++#
++# Based on https://github.com/fedora-selinux/selinux-policy/pull/403
++#
++# TODO: What AVC does this fix?
++#
++corenet_icmp_bind_generic_node(ping_t)
+ 
+ dev_read_urand(ping_t)
+ 
+@@ -212,6 +222,16 @@ corenet_udp_bind_traceroute_port(traceroute_t)
+ corenet_tcp_connect_all_ports(traceroute_t)
+ corenet_sendrecv_all_client_packets(traceroute_t)
+ corenet_sendrecv_traceroute_server_packets(traceroute_t)
++#
++# FLATCAR:
++#
++# This is to fix ping -I with some IP or network interface.
++#
++# Based on https://github.com/fedora-selinux/selinux-policy/pull/403
++#
++# TODO: What AVC does this fix?
++#
++corenet_icmp_bind_generic_node(traceroute_t)
+ 
+ dev_read_rand(traceroute_t)
+ dev_read_urand(traceroute_t)
+diff --git a/refpolicy/policy/modules/kernel/corenetwork.if.in b/refpolicy/policy/modules/kernel/corenetwork.if.in
+index d1038d742..a675c8e28 100644
+--- a/refpolicy/policy/modules/kernel/corenetwork.if.in
++++ b/refpolicy/policy/modules/kernel/corenetwork.if.in
+@@ -877,6 +877,32 @@ interface(`corenet_sctp_bind_generic_node',`
+ 	allow $1 node_t:sctp_socket node_bind;
+ ')
+ 
++#
++# FLATCAR:
++#
++# This is to fix ping -I with some IP or network interface. Added
++# icmp_socket here.
++#
++# Based on https://github.com/fedora-selinux/selinux-policy/pull/403
++#
++########################################
++## <summary>
++##	Bind ICMP sockets to generic nodes.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++#
++interface(`corenet_icmp_bind_generic_node',`
++	gen_require(`
++		type node_t;
++	')
++
++	allow $1 node_t:icmp_socket node_bind;
++')
++
+ ########################################
+ ## <summary>
+ ##	Bind TCP sockets to generic nodes.
+diff --git a/refpolicy/policy/modules/kernel/corenetwork.te.in b/refpolicy/policy/modules/kernel/corenetwork.te.in
+index 53bf7849c..9edac05e8 100644
+--- a/refpolicy/policy/modules/kernel/corenetwork.te.in
++++ b/refpolicy/policy/modules/kernel/corenetwork.te.in
+@@ -381,7 +381,17 @@ allow corenet_unconfined_type port_type:sctp_socket { name_connect };
+ 
+ # Bind to any network address.
+ allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket sctp_socket } name_bind;
+-allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket sctp_socket } node_bind;
++#
++# FLATCAR:
++#
++# This is to fix ping -I with some IP or network interface. Added
++# icmp_socket here.
++#
++# Based on https://github.com/fedora-selinux/selinux-policy/pull/403
++#
++# TODO: What AVC does this fix?
++#
++allow corenet_unconfined_type node_type:{ icmp_socket tcp_socket udp_socket rawip_socket sctp_socket } node_bind;
+ 
+ # Infiniband
+ corenet_ib_access_all_pkeys(corenet_unconfined_type)
+diff --git a/refpolicy/policy/modules/kernel/files.if b/refpolicy/policy/modules/kernel/files.if
+index 370ac0931..098d0cd6c 100644
+--- a/refpolicy/policy/modules/kernel/files.if
++++ b/refpolicy/policy/modules/kernel/files.if
+@@ -7911,3 +7911,48 @@ interface(`files_relabel_all_pidfiles',`
+ 	relabel_files_pattern($1, pidfile, pidfile)
+ 	relabel_lnk_files_pattern($1, pidfile, pidfile)
+ ')
++
++#
++# FLATCAR:
++#
++# It's a part of our relabeling effort. Not finished, not yet used.
++#
++# Upstream PR: https://github.com/SELinuxProject/refpolicy/pull/515
++#
++# Second part of this change: https://github.com/flatcar/coreos-overlay/blob/f9a9943cb7ebfcb6fa625b06eb808a65572f54ff/sec-policy/selinux-base-policy/files/systemd-relabel.patch
++#
++########################################
++## <summary>
++##	Relabel all files on the filesystem, except
++##	policy_config_t and exceptions.
++## </summary>
++## <param name="domain">
++##	<summary>
++##	Domain allowed access.
++##	</summary>
++## </param>
++## <param name="exception_types" optional="true">
++##	<summary>
++##	The types to be excluded.  Each type or attribute
++##	must be negated by the caller.
++##	</summary>
++## </param>
++## <rolecap/>
++#
++interface(`files_relabel_all_non_policy_files',`
++	gen_require(`
++		attribute file_type;
++		type policy_config_t;
++	')
++
++	allow $1 { file_type -policy_config_t $2 }:dir list_dir_perms;
++	relabel_dirs_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	relabel_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	relabel_lnk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	relabel_fifo_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	relabel_sock_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	# this is only relabelfrom since there should be no
++	# device nodes with file types.
++	relabelfrom_blk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++	relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
++')
+diff --git a/refpolicy/policy/modules/kernel/kernel.te b/refpolicy/policy/modules/kernel/kernel.te
+index 8156ac087..72a07e753 100644
+--- a/refpolicy/policy/modules/kernel/kernel.te
++++ b/refpolicy/policy/modules/kernel/kernel.te
+@@ -369,6 +369,79 @@ files_mounton_default(kernel_t)
+ 
+ mcs_process_set_categories(kernel_t)
+ 
++#
++# FLATCAR:
++#
++# TODO: What AVCs does this fix?
++#
++allow kernel_t self:user_namespace create;
++
++#
++# FLATCAR:
++#
++# Occurs in coreos.tls.fetch-urls tests. Haven't pinpointed the cause yet:
++#
++# avc:  denied  { add_name } for  pid=[0-9]* comm="bash" name="63" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir permissive=0
++#
++# Occurs in kubeadm.v<VERSION>.calico.base and
++# kubeadm.v<VERSION>.calico.cgroupv1.base:
++#
++# avc:  denied  { add_name } for  pid=[0-9]* comm="tee" name="63" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir permissive=0
++#
++allow kernel_t self:dir { add_name };
++
++#
++# FLATCAR:
++#
++# Occurs in coreos.tls.fetch-urls tests. Haven't pinpointed the cause yet:
++#
++# avc:  denied  { create } for  pid=[0-9]* comm="bash" name="63" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:kernel_t:s0 tclass=file permissive=0
++#
++# Occurs in kubeadm.v<VERSION>.calico.base and
++# kubeadm.v<VERSION>.calico.cgroupv1.base:
++#
++# avc:  denied  { create } for  pid=[0-9]* comm="tee" name="63" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:kernel_t:s0 tclass=file permissive=0
++#
++allow kernel_t self:file { create };
++
++#
++# FLATCAR:
++#
++# Occurs in coreos.tls.fetch-urls tests. Haven't pinpointed the cause
++# yet:
++#
++# avc:  denied  { write } for  pid=[0-9]* comm="bash" name="fd" dev="proc" ino=[0-9]* scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir permissive=0
++#
++# This one occurs a lot in kubeadm.v<VERSION>.calico.base and
++# kubeadm.v<VERSION>.calico.cgroupv1.base, is this from mantle's
++# kola/tests/kubeadm/templates.go?
++#
++# avc:  denied  { write } for  pid=[0-9]* comm="tee" name="fd" dev="proc" ino=[0-9]* scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=dir permissive=0
++#
++allow kernel_t self:dir { write };
++
++#
++# FLATCAR:
++#
++# This one happens a lot in kubeadm.v<VERSION>.<CNI>.cgroupv1.base. No
++# idea what is this, but looks like a vestige of cgroupv1 support.
++#
++# avc:  denied  { audit_read } for  pid=[0-9]* comm="systemd" capability=37  scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
++#
++allow kernel_t self:capability2 { audit_read };
++
++#
++# FLATCAR:
++#
++# This one happens a lot in kubeadm.v<VERSION>.<CNI>.cgroupv1.base and
++# kubeadm.v<VERSION>.<CNI>.base for cilium and calico.
++#
++# avc:  denied  { watch_reads } for  pid=[0-9]* comm="systemd" path="/run/mount/utab.lock" dev="tmpfs" ino=[0-9]* scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:mount_runtime_t:s0 tclass=file permissive=0
++#
++optional_policy(`
++	mount_watch_reads_runtime_files(kernel_t)
++')
++
+ mls_process_read_all_levels(kernel_t)
+ mls_process_write_all_levels(kernel_t)
+ mls_file_write_all_levels(kernel_t)
+diff --git a/refpolicy/policy/modules/services/container.fc b/refpolicy/policy/modules/services/container.fc
+index 49e5d59bb..3769ad311 100644
+--- a/refpolicy/policy/modules/services/container.fc
++++ b/refpolicy/policy/modules/services/container.fc
+@@ -38,6 +38,12 @@ HOME_DIR/\.docker(/.*)?		gen_context(system_u:object_r:container_conf_home_t,s0)
+ /etc/cni(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
+ /etc/docker(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
+ /etc/containerd(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
++#
++# FLATCAR:
++#
++# We keep containerd config in /usr/share, so label it as container_config_t too.
++#
++/usr/share/containerd(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
+ 
+ /run/containers(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
+ /run/libpod(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
+diff --git a/refpolicy/policy/modules/services/container.te b/refpolicy/policy/modules/services/container.te
+index a5ad4686d..ceaeb2dfc 100644
+--- a/refpolicy/policy/modules/services/container.te
++++ b/refpolicy/policy/modules/services/container.te
+@@ -58,6 +58,52 @@ gen_tunable(container_use_dri, false)
+ ## </desc>
+ gen_tunable(container_use_ecryptfs, false)
+ 
++# FLATCAR:
++#
++# Turned to be true by default to address following AVCs:
++#
++# This one comes from cl.internet (DockerPing?):
++#
++# For ping inside docker container.
++#
++# Boolean container_use_host_all_caps also allows this. Maybe this
++# should be turned on by default then?
++#
++# avc:  denied  { net_raw } for  pid=[0-9]* comm="ping" capability=13  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# This one comes from docker.base:
++#
++# avc:  denied  { setuid } for  pid=[0-9]* comm="ping" capability=7  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# This one happens in kubeadm.v<VERSION>.<CNI>.base for cilium and calico
++#
++# avc:  denied  { chown } for  pid=[0-9]* comm="nginx" capability=0  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# Boolean container_use_host_all_caps also allows this. Maybe this
++# should be turned on by default then?
++#
++# This one happens in kubeadm.v<VERSION>.<CNI>.base for cilium and calico
++#
++# avc:  denied  { dac_override } for  pid=[0-9]* comm="rpcbind" capability=1  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# This comes from the same place:
++#
++# avc:  denied  { dac_override } for  pid=[0-9]* comm="systemd-tmpfile" capability=1  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# Boolean container_use_host_all_caps also allows this. Maybe this
++# should be turned on by default then?
++#
++# This one happens in kubeadm.v<VERSION>.<CNI>.base for cilium and calico
++#
++# avc:  denied  { dac_read_search } for  pid=[0-9]* comm="rpcbind" capability=2  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# This comes from the same place:
++#
++# avc:  denied  { dac_read_search } for  pid=[0-9]* comm="systemd-tmpfile" capability=2  scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tclass=capability permissive=0
++#
++# Boolean container_use_host_all_caps also allows this. Maybe this
++# should be turned on by default then?
++#
+ ## <desc>
+ ##	<p>
+ ##	Allow containers to use all capabilities in a
+@@ -65,7 +111,7 @@ gen_tunable(container_use_ecryptfs, false)
+ ##	directly on the host.
+ ##	</p>
+ ## </desc>
+-gen_tunable(container_use_host_all_caps, false)
++gen_tunable(container_use_host_all_caps, true)
+ 
+ ## <desc>
+ ##	<p>
+@@ -1088,3 +1134,105 @@ optional_policy(`
+        unconfined_domain_noaudit(spc_user_t)
+        domain_ptrace_all_domains(spc_user_t)
+ ')
++
++#
++# FLATCAR:
++#
++# The rules below were added long time ago.
++#
++# TODO: Would be nice to document what they were trying to fix. And
++# maybe document what AVCs they were trying to address? I suspect that
++# a lot of them are not necessary now or won't be necessary when whole
++# image will be labeled.
++#
++
++allow container_domain self:socket_class_set { accept ioctl read getattr lock write append getopt setopt };
++allow container_domain init_t:unix_stream_socket { accept ioctl read getattr lock write append getopt shutdown };
++
++# required for sharing /run for the etcd-wrapper
++files_mounton_runtime_dirs(container_engine_domain)
++
++# this is a hack while the system is not labelled. we need to authorize transition from kernel_t
++require {
++	type kernel_t;
++	type tmpfs_t;
++	type var_lib_t;
++	type unconfined_t;
++}
++allow kernel_t container_t:process transition;
++allow initrc_t container_t:process transition;
++allow kernel_t container_t:process2 nnp_transition;
++allow kernel_t unconfined_t:process transition;
++fs_manage_tmpfs_chr_files(container_t)
++fs_manage_tmpfs_dirs(container_t)
++fs_manage_tmpfs_files(container_t)
++fs_manage_tmpfs_sockets(container_t)
++fs_manage_tmpfs_symlinks(container_t)
++fs_remount_tmpfs(container_t)
++kernel_read_messages(container_t)
++kernel_sigchld(container_t)
++kernel_use_fds(container_t)
++allow container_t self:process getcap;
++files_read_var_lib_files(container_t)
++files_read_var_lib_symlinks(container_t)
++term_use_generic_ptys(container_t)
++term_setattr_generic_ptys(container_t)
++allow container_t tmpfs_t:chr_file { read write open };
++allow container_t container_file_t:chr_file { manage_file_perms };
++allow container_t self:process getpgid;
++allow container_t container_file_t:file { entrypoint mounton };
++allow container_t var_lib_t:file { entrypoint execute execute_no_trans };
++allow container_t kernel_t:fifo_file { getattr ioctl read write open append };
++allow container_t initrc_t:fifo_file { getattr ioctl read write open append };
++filetrans_pattern(kernel_t, etc_t, container_file_t, dir, "cni")
++
++# this is required by flanneld
++allow container_t kernel_t:system { module_request };
++
++# required by flanneld to write into /run/flannel/subnet.env
++filetrans_pattern(kernel_t, var_run_t, container_file_t, dir, "flannel")
++
++# required for cilium
++allow kernel_t spc_t:process transition;
++# required for using cilium cgroup v1
++allow kernel_t self:perf_event { open cpu kernel read };
++allow unconfined_t container_file_t:file { entrypoint };
++
++#
++# These ones come from kubeadm.v<VERSION>.<CNI>.base for cilium and calico:
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-apiserver" path="/etc/kubernetes/pki/apiserver.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-apiserver" path="/etc/kubernetes/pki/ca.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-apiserver" path="/etc/kubernetes/pki/front-proxy-ca.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-apiserver" path="/etc/kubernetes/pki/front-proxy-client.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-controller" path="/etc/kubernetes/pki/ca.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-controller" path="/etc/kubernetes/pki/front-proxy-ca.crt" dev="overlay" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=0
++#
++allow container_t etc_t:file watch;
++
++#
++# This one comes from kubeadm.v<VERSION>.<CNI>.base for cilium and calico:
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-controller" path="/opt/libexec/kubernetes/kubelet-plugins/volume/exec" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
++#
++# This one comes from kubeadm.v<VERSION>.calico.base:
++#
++# avc:  denied  { watch } for  pid=[0-9]* comm="kube-controller" path="/opt/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:usr_t:s0 tclass=dir permissive=0
++#
++allow container_t usr_t:dir { watch };
++
++#
++# These ones come from kubeadm.v<VERSION>.calico.base:
++#
++# avc:  denied  { execute } for  pid=[0-9]* comm="kube-controller" name="uds" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { execute_no_trans } for  pid=[0-9]* comm="kube-controller" path="/opt/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds/uds" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=0
++#
++# avc:  denied  { map } for  pid=[0-9]* comm="uds" path="/opt/libexec/kubernetes/kubelet-plugins/volume/exec/nodeagent~uds/uds" dev="vda9" ino=[0-9]* scontext=system_u:system_r:container_t:s0:c[0-9]*,c[0-9]* tcontext=system_u:object_r:usr_t:s0 tclass=file permissive=0
++#
++allow container_t usr_t:file { execute execute_no_trans map };
+diff --git a/refpolicy/policy/modules/system/init.te b/refpolicy/policy/modules/system/init.te
+index c83d88b74..b55afabc0 100644
+--- a/refpolicy/policy/modules/system/init.te
++++ b/refpolicy/policy/modules/system/init.te
+@@ -1658,3 +1658,11 @@ optional_policy(`
+ 	userdom_dontaudit_rw_all_users_stream_sockets(systemprocess)
+ 	userdom_dontaudit_write_user_tmp_files(systemprocess)
+ ')
++
++#
++# FLATCAR:
++#
++# TODO: What AVC does this fix?
++#
++require { type unconfined_t; }
++allow init_t unconfined_t:file exec_file_perms;
+diff --git a/refpolicy/policy/modules/system/locallogin.te b/refpolicy/policy/modules/system/locallogin.te
+index 4dc9981bc..ee68ba624 100644
+--- a/refpolicy/policy/modules/system/locallogin.te
++++ b/refpolicy/policy/modules/system/locallogin.te
+@@ -34,7 +34,14 @@ role system_r types sulogin_t;
+ 
+ allow local_login_t self:capability { chown dac_read_search dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config };
+ dontaudit local_login_t self:capability net_admin;
+-allow local_login_t self:process { getcap setcap setexec setrlimit setsched };
++#
++# FLATCAR:
++#
++# Added setpgid here.
++#
++# TODO: What AVC does this fix?
++#
++allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched };
+ allow local_login_t self:fd use;
+ allow local_login_t self:fifo_file rw_fifo_file_perms;
+ allow local_login_t self:sock_file read_sock_file_perms;
+diff --git a/refpolicy/policy/modules/system/logging.te b/refpolicy/policy/modules/system/logging.te
+index a7b6173d8..343ef1abc 100644
+--- a/refpolicy/policy/modules/system/logging.te
++++ b/refpolicy/policy/modules/system/logging.te
+@@ -507,6 +507,15 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t)
+ 
+ ifdef(`init_systemd',`
+ 	# for systemd-journal
++
++	#
++	# FLATCAR:
++	#
++	# TODO: What AVC does this fix?
++	#
++	require { type kernel_t; }
++	allow syslogd_t kernel_t:netlink_audit_socket getattr;
++
+ 	allow syslogd_t self:capability audit_control;
+ 	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
+ 	allow syslogd_t self:capability2 audit_read;
+-- 
+2.34.1
+

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/flatcar-selinux-patches/README.md

@@ -0,0 +1,17 @@
+The following steps were needed to make these patches:
+
+- Clone the refpolicy repo:
+  - https://github.com/SELinuxProject/refpolicy.git
+- Checkout the appropriate tag:
+  - For example `RELEASE_2_20231002`.
+- Apply the Gentoo patch:
+  - See the sec-policy/selinux-base ebuild in portage-stable for the
+    patch tarball URL.
+- Apply our changes.
+- Generate the patch:
+  - Since sec-policy/selinux- packages set their source directory to
+    work directory (in Gentooese: `S=${WORKDIR}/`), the user patches
+    are applied from the parent directory of the refpolicy sources. In
+    order to generate proper patches, do `git format-patch
+    --src-prefix=a/refpolicy/ --dst-prefix=b/refpolicy/
+    <SINCE_COMMIT>`

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base-policy

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base-policy/init.patch

@@ -1,11 +0,0 @@
-diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
-index dbd39cf8f..563559ca7 100644
---- a/refpolicy/policy/modules/system/init.te
-+++ b/refpolicy/policy/modules/system/init.te
-@@ -1503,3 +1503,6 @@ optional_policy(`
- 	userdom_dontaudit_rw_all_users_stream_sockets(systemprocess)
- 	userdom_dontaudit_write_user_tmp_files(systemprocess)
- ')
-+
-+require { type unconfined_t; }
-+allow init_t unconfined_t:file exec_file_perms;

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base-policy/locallogin.patch

@@ -1,13 +0,0 @@
-diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
-index 109980e79..d5c4a5d95 100644
---- a/refpolicy/policy/modules/system/locallogin.te
-+++ b/refpolicy/policy/modules/system/locallogin.te
-@@ -34,7 +34,7 @@ role system_r types sulogin_t;
-
- allow local_login_t self:capability { chown dac_read_search dac_override fowner fsetid kill setgid setuid sys_nice sys_resource sys_tty_config };
- dontaudit local_login_t self:capability net_admin;
--allow local_login_t self:process { getcap setcap setexec setrlimit setsched };
-+allow local_login_t self:process { setpgid getcap setcap setexec setrlimit setsched };
- allow local_login_t self:fd use;
- allow local_login_t self:fifo_file rw_fifo_file_perms;
- allow local_login_t self:sock_file read_sock_file_perms;

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base-policy/logging.patch

@@ -1,18 +0,0 @@
-diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index abd61e6bd..fb5d69366 100644
---- a/refpolicy/policy/modules/system/logging.te
-+++ b/refpolicy/policy/modules/system/logging.te
-@@ -525,11 +525,13 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t)
- 
- ifdef(`init_systemd',`
- 	# for systemd-journal
-+	require { type kernel_t; }
- 	allow syslogd_t self:capability audit_control;
- 	allow syslogd_t self:netlink_audit_socket connected_socket_perms;
- 	allow syslogd_t self:capability2 audit_read;
- 	allow syslogd_t self:capability { chown setgid setuid sys_ptrace };
- 	allow syslogd_t self:netlink_audit_socket { getattr getopt read setopt write nlmsg_write };
-+	allow syslogd_t kernel_t:netlink_audit_socket getattr;
- 
- 	# remove /run/log/journal when switching to permanent storage
- 	allow syslogd_t var_log_t:dir rmdir;

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base-policy/ping.patch

@@ -1,19 +0,0 @@
-diff -u -r refpolicy/policy/modules/admin/netutils.te refpolicy/policy/modules/admin/netutils.te
---- a/refpolicy/policy/modules/admin/netutils.te	2022-01-12 14:28:26.850809330 -0000
-+++ b/refpolicy/policy/modules/admin/netutils.te	2022-01-12 14:29:50.323880882 -0000
-@@ -117,6 +117,7 @@
- corenet_raw_sendrecv_generic_node(ping_t)
- corenet_tcp_sendrecv_generic_node(ping_t)
- corenet_raw_bind_generic_node(ping_t)
-+corenet_icmp_bind_generic_node(ping_t)
-
- dev_read_urand(ping_t)
-
-@@ -189,6 +190,7 @@
- corenet_tcp_connect_all_ports(traceroute_t)
- corenet_sendrecv_all_client_packets(traceroute_t)
- corenet_sendrecv_traceroute_server_packets(traceroute_t)
-+corenet_icmp_bind_generic_node(traceroute_t)
-
- dev_read_rand(traceroute_t)
- dev_read_urand(traceroute_t)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base/0001-policy-modules-kernel-all-more-actions-for-kernel.patch

@@ -1,16 +0,0 @@
-diff --git refpolicy/policy/modules/kernel/kernel.te refpolicy/policy/modules/kernel/kernel.te
-index 56dbd5af5..b5cf0e3c0 100644
---- a/refpolicy/policy/modules/kernel/kernel.te
-+++ b/refpolicy/policy/modules/kernel/kernel.te
-@@ -363,6 +363,11 @@ files_list_home(kernel_t)
- files_read_usr_files(kernel_t)
- 
- mcs_process_set_categories(kernel_t)
-+mcs_killall(kernel_t)
-+mcs_file_read_all(kernel_t)
-+mcs_file_write_all(kernel_t)
-+mcs_ptrace_all(kernel_t)
-+allow kernel_t self:user_namespace create;
- 
- mls_process_read_all_levels(kernel_t)
- mls_process_write_all_levels(kernel_t)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base/files-relabel.patch

@@ -1,44 +0,0 @@
-diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if
-index 495cbe2f4..a5605f866 100644
---- a/refpolicy/policy/modules/kernel/files.if
-+++ b/refpolicy/policy/modules/kernel/files.if
-@@ -7892,3 +7892,39 @@ interface(`files_unconfined',`
-
- 	typeattribute $1 files_unconfined_type;
- ')
-+
-+########################################
-+## <summary>
-+##	Relabel all files on the filesystem, except
-+##	policy_config_t and exceptions.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+## <param name="exception_types" optional="true">
-+##	<summary>
-+##	The types to be excluded.  Each type or attribute
-+##	must be negated by the caller.
-+##	</summary>
-+## </param>
-+## <rolecap/>
-+#
-+interface(`files_relabel_all_non_policy_files',`
-+	gen_require(`
-+		attribute file_type;
-+		type policy_config_t;
-+	')
-+
-+	allow $1 { file_type -policy_config_t $2 }:dir list_dir_perms;
-+	relabel_dirs_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	relabel_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	relabel_lnk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	relabel_fifo_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	relabel_sock_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	# this is only relabelfrom since there should be no
-+	# device nodes with file types.
-+	relabelfrom_blk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+	relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 })
-+')

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base/icmp-bind.patch

@@ -1,40 +0,0 @@
-diff -u -r refpolicy/policy/modules/kernel/corenetwork.if.in refpolicy2/policy/modules/kernel/corenetwork.if.in
---- a/refpolicy/policy/modules/kernel/corenetwork.if.in	2022-01-12 16:59:47.572670384 -0000
-+++ b/refpolicy2/policy/modules/kernel/corenetwork.if.in	2022-01-12 17:01:54.974858982 -0000
-@@ -879,6 +879,24 @@
-
- ########################################
- ## <summary>
-+##	Bind ICMP sockets to generic nodes.
-+## </summary>
-+## <param name="domain">
-+##	<summary>
-+##	Domain allowed access.
-+##	</summary>
-+## </param>
-+#
-+interface(`corenet_icmp_bind_generic_node',`
-+	gen_require(`
-+		type node_t;
-+	')
-+
-+	allow $1 node_t:icmp_socket node_bind;
-+')
-+
-+########################################
-+## <summary>
- ##	Bind TCP sockets to generic nodes.
- ## </summary>
- ## <desc>
-diff -u -r refpolicy/policy/modules/kernel/corenetwork.te.in refpolicy2/policy/modules/kernel/corenetwork.te.in
---- a/refpolicy/policy/modules/kernel/corenetwork.te.in	2022-01-12 16:59:47.573670362 -0000
-+++ b/refpolicy2/policy/modules/kernel/corenetwork.te.in	2022-01-12 17:03:12.754142616 -0000
-@@ -373,7 +373,7 @@
-
- # Bind to any network address.
- allow corenet_unconfined_type port_type:{ tcp_socket udp_socket rawip_socket sctp_socket } name_bind;
--allow corenet_unconfined_type node_type:{ tcp_socket udp_socket rawip_socket sctp_socket } node_bind;
-+allow corenet_unconfined_type node_type:{ icmp_socket tcp_socket udp_socket rawip_socket sctp_socket } node_bind;
-
- # Infiniband
- corenet_ib_access_all_pkeys(corenet_unconfined_type)

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-container

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-container/container.patch

@@ -1,77 +0,0 @@
-diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc
-index 056aa6023..e4bcada03 100644
---- a/refpolicy/policy/modules/services/container.fc
-+++ b/refpolicy/policy/modules/services/container.fc
-@@ -113,3 +113,5 @@ HOME_DIR/\.docker(/.*)?		gen_context(system_u:object_r:container_conf_home_t,s0)
- /var/log/kube-controller-manager(/.*)?		gen_context(system_u:object_r:container_log_t,s0)
- /var/log/kube-proxy(/.*)?		gen_context(system_u:object_r:container_log_t,s0)
- /var/log/kube-scheduler(/.*)?		gen_context(system_u:object_r:container_log_t,s0)
-+
-+/usr/share/containerd(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
-diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
-index 5de421fc3..4a6c2760e 100644
---- a/refpolicy/policy/modules/services/container.te
-+++ b/refpolicy/policy/modules/services/container.te
-@@ -1007,3 +1007,62 @@ optional_policy(`
-        unconfined_domain_noaudit(spc_user_t)
-        domain_ptrace_all_domains(spc_user_t)
- ')
-+
-+allow container_domain self:socket_class_set { accept ioctl read getattr lock write append getopt setopt };
-+allow container_domain init_t:unix_stream_socket { accept ioctl read getattr lock write append getopt shutdown };
-+
-+# required for sharing /run for the etcd-wrapper
-+files_mounton_runtime_dirs(container_engine_domain)
-+
-+# this is a hack while the system is not labelled. we need to authorize transition from kernel_t
-+require {
-+	type kernel_t;
-+	type tmpfs_t;
-+	type var_lib_t;
-+	type unconfined_t;
-+}
-+allow kernel_t container_t:process transition;
-+allow initrc_t container_t:process transition;
-+allow kernel_t container_t:process2 nnp_transition;
-+allow kernel_t unconfined_t:process transition;
-+fs_manage_tmpfs_chr_files(container_t)
-+fs_manage_tmpfs_dirs(container_t)
-+fs_manage_tmpfs_files(container_t)
-+fs_manage_tmpfs_sockets(container_t)
-+fs_manage_tmpfs_symlinks(container_t)
-+fs_remount_tmpfs(container_t)
-+kernel_read_messages(container_t)
-+kernel_sigchld(container_t)
-+kernel_use_fds(container_t)
-+allow container_t self:process getcap;
-+files_read_var_lib_files(container_t)
-+files_read_var_lib_symlinks(container_t)
-+term_use_generic_ptys(container_t)
-+term_setattr_generic_ptys(container_t)
-+allow container_t tmpfs_t:chr_file { read write open };
-+allow container_t container_file_t:chr_file { manage_file_perms };
-+allow container_t self:capability sys_chroot;
-+allow container_t self:process getpgid;
-+allow container_t container_file_t:file { entrypoint mounton };
-+allow container_t var_lib_t:file { entrypoint execute execute_no_trans };
-+allow container_t kernel_t:fifo_file { getattr ioctl read write open append };
-+allow container_t initrc_t:fifo_file { getattr ioctl read write open append };
-+filetrans_pattern(kernel_t, etc_t, container_file_t, dir, "cni");
-+
-+# this is required by flanneld
-+allow container_t kernel_t:system { module_request };
-+
-+# required by flanneld to write into /run/flannel/subnet.env
-+filetrans_pattern(kernel_t, var_run_t, container_file_t, dir, "flannel");
-+
-+# required for cilium
-+allow kernel_t spc_t:process transition;
-+# required for cilium, can be upstreamed
-+# Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { open } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
-+# Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { kernel } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
-+# Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { cpu } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
-+# Jun 20 08:01:43 localhost audit[3480]: AVC avc:  denied  { read } for  pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1
-+allow spc_t self:perf_event { open cpu kernel read };
-+# required for using cilium cgroup v1
-+allow kernel_t self:perf_event { open cpu kernel read };
-+allow unconfined_t container_file_t:file { entrypoint };

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-dbus

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-sssd

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-unconfined

@@ -0,0 +1 @@
+flatcar-selinux-patches

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -56,7 +56,7 @@
 =dev-libs/libgcrypt-1.10.2 ~arm64
 =dev-libs/libsodium-1.0.19-r1 ~arm64
 =dev-libs/libunistring-1.1-r1 ~arm64
-=dev-util/bpftool-6.3 ~arm64
+=dev-util/bpftool-6.5.7 ~arm64
 =net-firewall/conntrack-tools-1.4.6-r1 ~arm64
 
 # Required for addressing CVE-2023-0361.
@@ -71,25 +71,16 @@
 
 # Keep versions on both arches in sync.
 =net-nds/openldap-2.6.4-r1 ~amd64
-=sec-policy/selinux-base-2.20200818-r3 ~arm64
-=sec-policy/selinux-base-policy-2.20200818-r3 ~arm64
-=sec-policy/selinux-unconfined-2.20200818-r2 ~arm64
-=sec-policy/selinux-virt-2.20200818-r2 ~arm64
-=sys-apps/checkpolicy-3.1 ~arm64
 =sys-apps/kexec-tools-2.0.24 ~arm64
-=sys-apps/policycoreutils-3.1-r4 ~arm64
-=sys-apps/semodule-utils-3.1 ~arm64
-=sys-apps/smartmontools-7.4 ~arm64
 =sys-block/thin-provisioning-tools-1.0.6 ~amd64
 
 # Enable ipvsadm for arm64.
 =sys-cluster/ipvsadm-1.31-r1 ~arm64
 
 # Keep versions on both arches in sync.
+=sys-devel/binutils-2.40-r9 ~arm64
 =sys-firmware/edk2-aarch64-18.02 **
-=sys-libs/libselinux-3.1-r3 ~arm64
+=sys-libs/binutils-libs-2.40-r7 ~arm64
-=sys-libs/libsemanage-3.1-r2 ~arm64
-=sys-libs/libsepol-3.1 ~arm64
 
 # Needed to fix CVE-2023-29491.
 =sys-libs/ncurses-6.4_p20230527 ~amd64 ~arm64
@@ -99,7 +90,7 @@
 =sys-libs/readline-8.2_p1 ~amd64 ~arm64
 
 # Needed to fix CVE-2023-4016.
-=sys-process/procps-4.0.4 ~amd64 ~arm64
+=sys-process/procps-4.0.4 ~amd64
 
 # Accept unstable host Rust compilers.
 =virtual/rust-1.73.0 ~amd64 ~arm64

sdk_container/src/third_party/portage-stable/app-alternatives/gzip/gzip-1.ebuild

@@ -11,7 +11,7 @@ ALTERNATIVES=(
 inherit app-alternatives
 
 DESCRIPTION="gzip symlinks"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="split-usr"
 
 RDEPEND="

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.4.5.ebuild

@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"

sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest

@@ -2,3 +2,5 @@ DIST docker-cli-24.0.5-man.tar.xz 82496 BLAKE2B f3295b684dbf8d251ba13a19b9bad9b8
 DIST docker-cli-24.0.5.tar.gz 6243993 BLAKE2B a7ce84ecf329bc74e48f3a6e1b12a9e310a8f27ac68918ffeb40ab9c4eab8b79e753265b48220fcd3ab40b4136de5ebd44607831f642664eaf732111bd8f41b1 SHA512 765c67634d91d248b156d3e407398b98b7a0a89507bbac0310d4a68b95aa1a05e3af43c8b90bc10166748749d8cc36670619fc9efca110beefbdcd4385dc96be
 DIST docker-cli-24.0.6-man.tar.xz 82600 BLAKE2B 9e39bf200d252a0d91b0b6f17680a4c1b34e55cc9f357a59f124138cef39c5ff10fb104c51efe3010bca9a4f72447764ced1c02e3bb3924051fa6f1f01a8f6fa SHA512 5e972647961899e438b765f53afff570b9f0c1742c7c72a3a424887719c3a6afbd467d15884d44ac64b752c984261967f304afa5c168466fe6f611967d18a578
 DIST docker-cli-24.0.6.tar.gz 6244014 BLAKE2B c5f2082e44a568d3f6ee2ff5df9e9b727808f0b70d7d0c6c18b9769c1c4d0f49d371cbd08c95e748d441dc0ef011b66446527b0eeb33368ee59b85496185ba12 SHA512 55c56ae08eb314cce5f4c93544c6748586eadb3abe502d39d4d297e14d274af37346b38695a20a91dcfe51d3d35a77ddd7aa69d170b525e5e6ba345161869cd8
+DIST docker-cli-24.0.7-man.tar.xz 82228 BLAKE2B 7fbf114a724157243c78de9ae03b5d0b1237c5b506cd44edd7a28ffc13609a36b7acf66a25e1eff9f60966e48346d97e70f946cca9301f27fd0355db53a1994d SHA512 af2075e3c731c7e0da4941f4baf35e798f87d1e1f3fa09e85b27a4bcadfd767074af2acaff1fd919d8af2a89ed6d49daefcc0811342d1757886db7a28d1252f2
+DIST docker-cli-24.0.7.tar.gz 6451010 BLAKE2B de047f55ce388c09ec33492f470daf87c6f2d1651b0cd839634183494fba4065506661d2d15aac0dc076d005426411f4099ba8e8d95ea2c7247bb114a00f4eef SHA512 b4811e4ecaf1f17e5a53ee4fb34affab79545d87a1662b0f915efb28108989128f8bbf165c4aed111fcb0c851f7ec7d9137eb0f31447d698b058ff4200dba18d

sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-24.0.7.ebuild

@@ -0,0 +1,70 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+GIT_COMMIT=afdd53b4e3
+EGO_PN="github.com/docker/cli"
+MY_PV=${PV/_/-}
+inherit bash-completion-r1  golang-vcs-snapshot
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="hardened selinux"
+
+RDEPEND="!<app-containers/docker-20.10.1
+	selinux? ( sec-policy/selinux-docker )"
+BDEPEND="
+	>=dev-lang/go-1.16.6"
+
+RESTRICT="installsources strip test"
+
+S="${WORKDIR}/${P}/src/${EGO_PN}"
+
+src_unpack() {
+	golang-vcs-snapshot_src_unpack
+	set -- ${A}
+	unpack ${2}
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	export GOPATH="${WORKDIR}/${P}"
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
+	export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/*
+	bashcomp_alias docker dockerd
+	insinto /usr/share/fish/vendor_completions.d/
+	doins contrib/completion/fish/docker.fish
+	insinto /usr/share/zsh/site-functions
+	doins contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}

sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest

@@ -1,2 +1,3 @@
 DIST docker-24.0.5.tar.gz 14456089 BLAKE2B be13a4256787152cb35ddb96d80e97a5e5b587094f1c61d18158737a037c4e81b88c186098ba7416eb7778022ece07bc31ee55af13d3e3da8e0bbd5452ad027f SHA512 cde2e47e7658b153399ee29154ec21eebf54b292185e07d43b968895dcfdfead95e4507fefb713859a4540f21d8007116d3ebeaa1fb7ba305fb2a0449ba1bee6
 DIST docker-24.0.6.tar.gz 14462378 BLAKE2B bced8e687abac59254a9969df46f323a835627a724889e5966bea08df8766b4291914442001d1b573280c45ac4d357a673e98e8fba2b8d116a1dbd65424ccf78 SHA512 d9bf0ba756b1ebe69a44819d7c6aa5d66dad8db5bcc41233e2bfce8131334a2fe1af3972de7f602b7911231288d29aaea797b7a05b335c2d7214a613b27c4b63
+DIST docker-24.0.7.tar.gz 14658649 BLAKE2B 73bad494640ef8cad2b9b991f94414d8bec4dd88b120b0f8238f74d01269c445270f45410ac2c78af074356c3ba60a7c550ab28f5da5924bdc6d8b99e85a1360 SHA512 08f22fcbce163c3ba8eb21302fd38ff04fd3f27067f5715a3c527ba2efe67f694fac80bfe6d6b5e22d06d98917e1685a9d3d9b58991f221354f637f4a8bdc526

sdk_container/src/third_party/portage-stable/app-containers/docker/docker-24.0.7.ebuild

@@ -0,0 +1,331 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+EGO_PN=github.com/docker/docker
+MY_PV=${PV/_/-}
+inherit linux-info systemd udev golang-vcs-snapshot
+GIT_COMMIT=311b9ff0aa93aa55880e1e5f8871c4fb69583426
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init device-mapper overlay seccomp selinux"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	device-mapper? ( >=sys-fs/lvm2-2.02.89[thin] )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	dev-libs/libltdl
+	>=app-containers/containerd-1.7.3[apparmor?,btrfs?,device-mapper?,seccomp?]
+	>=app-containers/runc-1.1.9[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	>=dev-lang/go-1.16.12
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+S="${WORKDIR}/${P}/src/${EGO_PN}"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+PATCHES=(
+	"${FILESDIR}/0001-Openrc-Depend-on-containerd-init-script.patch"
+)
+
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	if use device-mapper; then
+		CONFIG_CHECK+="
+			~BLK_DEV_DM ~DM_THIN_PROVISIONING
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export GOPATH="${WORKDIR}/${P}"
+	export VERSION=${PV}
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	export CGO_CFLAGS="-I${ESYSROOT}/usr/include"
+	export CGO_LDFLAGS="-L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs device-mapper overlay; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if use device-mapper; then
+		elog " Devicemapper storage driver has been deprecated"
+		elog " It will be removed in a future release"
+		elog
+	fi
+
+	if use overlay; then
+		elog " Overlay storage driver/USEflag has been deprecated"
+		elog " in favor of overlay2 (enabled unconditionally)"
+		elog
+	fi
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+}
+
+pkg_postrm() {
+	udev_reload
+}

sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r3.ebuild

@@ -27,7 +27,7 @@ DEPEND="
 		dev-qt/qtcore:5
 		dev-qt/qtgui:5
 		dev-qt/qtwidgets:5
-		wayland? ( kde-frameworks/kwayland:5 )
+		wayland? ( kde-plasma/kwayland:5 )
 		X? (
 			dev-qt/qtx11extras:5
 			x11-libs/libX11

sdk_container/src/third_party/portage-stable/app-crypt/pinentry/pinentry-1.2.1-r4.ebuild

@@ -0,0 +1,108 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools qmake-utils verify-sig
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/aegypten2/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="caps efl emacs gtk keyring ncurses qt5 wayland X"
+
+DEPEND="
+	>=dev-libs/libassuan-2.1
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	efl? ( dev-libs/efl[X] )
+	keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:= )
+	qt5? (
+		dev-qt/qtcore:5
+		dev-qt/qtgui:5
+		dev-qt/qtwidgets:5
+		wayland? ( kde-plasma/kwayland:5 )
+		X? (
+			dev-qt/qtx11extras:5
+			x11-libs/libX11
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	gtk? ( app-crypt/gcr:0[gtk] )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+PDEPEND="emacs? ( app-emacs/pinentry )"
+IDEPEND=">=app-eselect/eselect-pinentry-0.7.2"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+	"${FILESDIR}/${PN}-1.2.1-automagic-capslock.patch" # bug #819939, bug #837719
+)
+
+src_prepare() {
+	default
+
+	unset FLTK_CONFIG
+
+	eautoreconf
+}
+
+src_configure() {
+	export PATH="$(qt5_get_bindir):${PATH}"
+	export QTLIB="$(qt5_get_libdir)"
+
+	local myeconfargs=(
+		$(use_enable efl pinentry-efl)
+		$(use_enable emacs pinentry-emacs)
+		$(use_enable keyring libsecret)
+		$(use_enable gtk pinentry-gnome3)
+		$(use_enable ncurses fallback-curses)
+		$(use_enable ncurses pinentry-curses)
+		$(use_enable qt5 pinentry-qt)
+		$(use_enable wayland kf5-wayland)
+		$(use_enable X qtx11extras)
+		$(use_with X x)
+
+		--enable-pinentry-tty
+		--disable-pinentry-fltk
+		--disable-pinentry-gtk2
+
+		MOC="$(qt5_get_bindir)"/moc
+		GPG_ERROR_CONFIG="${ESYSROOT}"/usr/bin/${CHOST}-gpg-error-config
+		LIBASSUAN_CONFIG="${ESYSROOT}"/usr/bin/libassuan-config
+
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/bin/pinentry || die
+
+	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt5
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}

sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest

@@ -3,4 +3,6 @@ DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e
 DIST vim-9.0.1627.tar.gz 17048824 BLAKE2B 3fa583cf676c2388641b1240ed4b90c2e42cd9f50ea44a943cce86bba4bf278adf54837bb5c4530471fd57cfcd08cd39be78b17a5e907435a02dc5874ff7f571 SHA512 d2fb863e03d4ad773fcba8917f3cd1e373f661aa8b8a20bd3e416a73788997d31c6dd106a1bf59d72475bb577bbe6d52eb079fff9c7152d96bb6e5c9aa6e2f3b
 DIST vim-9.0.1678.tar.gz 17069551 BLAKE2B e83cea77513eb0d8b3ed02bd508333fb97357d2d7a91a90c5a9376b03b444a0b65b6ce04b14e191e33445132845af71193ab140ea615bb03a2c24a904b726cb4 SHA512 c5ffb7ca56ff4eee70f06599dd84db2eb28ddadac229d4f7faf01174805923636a4ce61486bdf5a47910c929613dc9b9290dfc9288006222b4bc4ac891548bb8
 DIST vim-9.0.1777.tar.gz 17177555 BLAKE2B ad6d785f4c6b112199bd2f34e0b7f6070615fba8dce25354a7ded40ff8536388e7b7120c1f2fad790c8dc7134d74649697b6e95777e79dcf1e208ead81b229d6 SHA512 702781b6a9cf540d22aa0bc1e25a4fb785ff2b22e9c6a59643e87fd6f7b3e5444adbee1816bfaa0b45b9655bb56dc2d13904230840a0ecea56f5453034d81a2e
+DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d576665a183927051eddd53d019a5ca413c74dc10aff09917ee3120bd2e2ba441219d7238994f0d5ba14fc9c31180199 SHA512 ec27e4056460948ff86bc48a21de239a84b53757a8283144ec121654096796d970ad832234d6591a132bcd38bc12dc507cc7795a11cd383d20f08b4d9bcb051f
+DIST vim-9.0.2092.tar.gz 17359377 BLAKE2B eeb50de7e4876ce0e2a1e8b241ea2c7c472898495ef5517fa115e01f29ef8922fb7ef970f2c1a3ffe65a8274e2c59bd5a939f397048c6b486683c29c01484d1e SHA512 1c3e78ee1bb507858e0d30a8a1e646c16dd6d8d666ea587e91d1c90e490aef46387d6dfadc01e80f9aa807f7b109e4072efa8d8115fcd2a81dd62cabc30a8001
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.2092.ebuild

@@ -0,0 +1,231 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim and app-editors/gvim
+
+VIM_VERSION="9.0"
+VIM_PATCHES_VERSION="9.0.2092"
+inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
+		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+S="${WORKDIR}/vim-${PV}"
+
+DESCRIPTION="vim and gvim shared files"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="nls acl minimal"
+
+# ncurses is only needed by ./configure, so no subslot operator required
+DEPEND=">=sys-libs/ncurses-5.2-r2:0"
+BDEPEND="sys-devel/autoconf"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898406):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i \
+		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "sed failed"
+
+	# See bug #77841. We remove this file after the tarball extraction.
+	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
+	# everyone since previous flag filtering bugs have turned out to affect
+	# multiple archs...
+	replace-flags -O3 -O2
+
+	# Fix bug #18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+
+	# Remove src/auto/configure file.
+	rm -v src/auto/configure || die "rm configure failed"
+}
+
+src_configure() {
+	# Fix bug #37354: Disallow -funroll-all-loops on amd64
+	# Bug 57859 suggests that we want to do this for all archs
+	filter-flags -funroll-all-loops
+
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug 24447). The hvc
+	# things are for ppc64, see bug 86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	# Let Portage do the stripping. Some people like that.
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	local myconf=(
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
+		--enable-gui=no
+		--without-x
+		--disable-darwin
+		--disable-perlinterp
+		--disable-pythoninterp
+		--disable-rubyinterp
+		--disable-gpm
+		--disable-selinux
+		$(use_enable nls)
+		$(use_enable acl)
+	)
+
+	# Keep Gentoo Prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake -j1 -C src auto/osdef.h objects
+	emake tools
+}
+
+src_test() { :; }
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	dodir /usr/{bin,share/{man/man1,vim}}
+	emake -C src \
+		installruntime \
+		installmanlinks \
+		installmacros \
+		installtutor \
+		installtutorbin \
+		installtools \
+		install-languages \
+		DESTDIR="${D}" \
+		BINDIR="${EPREFIX}"/usr/bin \
+		MANDIR="${EPREFIX}"/usr/share/man \
+		DATADIR="${EPREFIX}"/usr/share
+
+	keepdir ${vimfiles}/keymap
+
+	# default vimrc is installed by vim-core since it applies to
+	# both vim and gvim
+	insinto /etc/vim/
+	newins "${FILESDIR}"/vimrc-r6 vimrc
+	eprefixify "${ED}"/etc/vim/vimrc
+
+	if use minimal; then
+		# To save space, install only a subset of the files.
+		# Helps minimalize the livecd, bug 65144.
+		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
+		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
+		rm -v "${ED}"/usr/bin/vimtutor || die
+
+		for f in "${ED}${vimfiles}"/colors/*.vim; do
+			if [[ ${f} != */@(default).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+
+		for f in "${ED}${vimfiles}"/syntax/*.vim; do
+			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
+				printf '%s\0' "${f}"
+			fi
+		done | xargs -0 rm -f || die
+	fi
+
+	newbashcomp "${FILESDIR}"/xxd-completion xxd
+
+	# install gvim icon since both vim/gvim desktop files reference it
+	doicon -s scalable "${FILESDIR}"/gvim.svg
+}
+
+pkg_postinst() {
+	# update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# update icon cache
+	xdg_icon_cache_update
+}

sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest

@@ -3,4 +3,6 @@ DIST vim-9.0.1503.tar.gz 17010118 BLAKE2B 4f74d52a3fcf7875031378f86fc3411c64c92e
 DIST vim-9.0.1627.tar.gz 17048824 BLAKE2B 3fa583cf676c2388641b1240ed4b90c2e42cd9f50ea44a943cce86bba4bf278adf54837bb5c4530471fd57cfcd08cd39be78b17a5e907435a02dc5874ff7f571 SHA512 d2fb863e03d4ad773fcba8917f3cd1e373f661aa8b8a20bd3e416a73788997d31c6dd106a1bf59d72475bb577bbe6d52eb079fff9c7152d96bb6e5c9aa6e2f3b
 DIST vim-9.0.1678.tar.gz 17069551 BLAKE2B e83cea77513eb0d8b3ed02bd508333fb97357d2d7a91a90c5a9376b03b444a0b65b6ce04b14e191e33445132845af71193ab140ea615bb03a2c24a904b726cb4 SHA512 c5ffb7ca56ff4eee70f06599dd84db2eb28ddadac229d4f7faf01174805923636a4ce61486bdf5a47910c929613dc9b9290dfc9288006222b4bc4ac891548bb8
 DIST vim-9.0.1777.tar.gz 17177555 BLAKE2B ad6d785f4c6b112199bd2f34e0b7f6070615fba8dce25354a7ded40ff8536388e7b7120c1f2fad790c8dc7134d74649697b6e95777e79dcf1e208ead81b229d6 SHA512 702781b6a9cf540d22aa0bc1e25a4fb785ff2b22e9c6a59643e87fd6f7b3e5444adbee1816bfaa0b45b9655bb56dc2d13904230840a0ecea56f5453034d81a2e
+DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d576665a183927051eddd53d019a5ca413c74dc10aff09917ee3120bd2e2ba441219d7238994f0d5ba14fc9c31180199 SHA512 ec27e4056460948ff86bc48a21de239a84b53757a8283144ec121654096796d970ad832234d6591a132bcd38bc12dc507cc7795a11cd383d20f08b4d9bcb051f
+DIST vim-9.0.2092.tar.gz 17359377 BLAKE2B eeb50de7e4876ce0e2a1e8b241ea2c7c472898495ef5517fa115e01f29ef8922fb7ef970f2c1a3ffe65a8274e2c59bd5a939f397048c6b486683c29c01484d1e SHA512 1c3e78ee1bb507858e0d30a8a1e646c16dd6d8d666ea587e91d1c90e490aef46387d6dfadc01e80f9aa807f7b109e4072efa8d8115fcd2a81dd62cabc30a8001
 DIST vim-patches-vim-9.0.1000-patches.tar.bz2 3245 BLAKE2B 3bf3d0e314cc3f96d5d9675de196a62c4c8a72645d56ef94b80768571c99cba5cc556442e3bd2dfa8818460fd851fe7bd1ae15999af7225fb271b81c43105843 SHA512 2883441a2001bf7ce89a7f0862f780b71cc0164c8fcb8dbdf7040e1bcbcf408d138d3d77f308aa54c762e9975fa5ec89cfceeabbf721344dfc938870a363667a

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.2092.ebuild

@@ -0,0 +1,370 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Please bump with app-editors/vim-core and app-editors/gvim
+
+VIM_VERSION="9.0"
+VIM_PATCHES_VERSION="9.0.2092"
+
+LUA_COMPAT=( lua5-{1..4} luajit )
+PYTHON_COMPAT=( python3_{9..11} )
+PYTHON_REQ_USE="threads(+)"
+USE_RUBY="ruby27 ruby30 ruby31"
+
+inherit vim-doc flag-o-matic bash-completion-r1 lua-single python-single-r1 ruby-single toolchain-funcs desktop xdg-utils
+
+if [[ ${PV} == 9999* ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/vim/vim.git"
+else
+	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
+		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="Vim, an improved vi-style text editor"
+HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+
+LICENSE="vim"
+SLOT="0"
+IUSE="X acl crypt cscope debug gpm lua minimal nls perl python racket ruby selinux sound tcl terminal vim-pager"
+REQUIRED_USE="
+	lua? ( ${LUA_REQUIRED_USE} )
+	python? ( ${PYTHON_REQUIRED_USE} )
+	vim-pager? ( !minimal )
+"
+
+RDEPEND="
+	>=app-eselect/eselect-vi-1.1
+	>=sys-libs/ncurses-5.2-r2:0=
+	nls? ( virtual/libintl )
+	acl? ( kernel_linux? ( sys-apps/acl ) )
+	crypt? ( dev-libs/libsodium:= )
+	cscope? ( dev-util/cscope )
+	gpm? ( >=sys-libs/gpm-1.19.3 )
+	lua? ( ${LUA_DEPS}
+		$(lua_gen_impl_dep 'deprecated' lua5-1)
+	)
+	~app-editors/vim-core-${PV}
+	vim-pager? ( app-editors/vim-core[-minimal] )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	racket? ( dev-scheme/racket )
+	ruby? ( ${RUBY_DEPS} )
+	selinux? ( sys-libs/libselinux )
+	sound? ( media-libs/libcanberra )
+	tcl? ( dev-lang/tcl:0= )
+	X? ( x11-libs/libXt )
+"
+DEPEND="${RDEPEND}"
+# configure runs the Lua interpreter
+BDEPEND="
+	sys-devel/autoconf
+	lua? ( ${LUA_DEPS} )
+	nls? ( sys-devel/gettext )
+"
+PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
+
+if [[ ${PV} != 9999* ]]; then
+	# Gentoo patches to fix runtime issues, cross-compile errors, etc
+	PATCHES=(
+		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
+	)
+fi
+
+# platform-specific checks (bug #898452):
+# - acl()     -- Solaris
+# - statacl() -- AIX
+QA_CONFIG_IMPL_DECL_SKIP=(
+	'acl'
+	'statacl'
+)
+
+pkg_setup() {
+	# people with broken alphabets run into trouble. bug #82186.
+	unset LANG LC_ALL
+	export LC_COLLATE="C"
+
+	use lua && lua-single_pkg_setup
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Fixup a script to use awk instead of nawk
+	sed -i -e \
+		'1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
+		"${S}"/runtime/tools/mve.awk || die "mve.awk sed failed"
+
+	# Read vimrc and gvimrc from /etc/vim
+	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' \
+		>> "${S}"/src/feature.h || die "echo failed"
+
+	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
+	# Hopefully this pattern won't break for a while at least.
+	# This fixes bug #29398 (27 Sep 2003 agriffis)
+	sed -i -e \
+		's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
+		"${S}"/runtime/doc/syntax.txt \
+		"${S}"/runtime/doc/tagsrch.txt \
+		"${S}"/runtime/doc/usr_29.txt \
+		"${S}"/runtime/menu.vim \
+		"${S}"/src/configure.ac || die 'sed failed'
+
+	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
+	# correctly. To avoid some really entertaining error messages about stuff
+	# which isn't even in the source file being invalid, we'll do some trickery
+	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
+	find "${S}" -name '*.c' | while read c; do
+		echo >> "$c" || die "echo failed"
+	done
+
+	# conditionally make the manpager.sh script
+	if use vim-pager; then
+		cat > "${S}"/runtime/macros/manpager.sh <<-_EOF_ || die "cat EOF failed"
+			#!/bin/sh
+			sed -e 's/\x1B\[[[:digit:]]\+m//g' | col -b | \\
+					vim \\
+						-c 'let no_plugin_maps = 1' \\
+						-c 'set nolist nomod ft=man ts=8' \\
+						-c 'let g:showmarks_enable=0' \\
+						-c 'runtime! macros/less.vim' -
+			_EOF_
+	fi
+
+	# Try to avoid sandbox problems. Bug #114475.
+	if [[ -d "${S}"/src/po ]]; then
+		sed -i -e \
+			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
+			"${S}"/src/po/Makefile || die "sed failed"
+	fi
+
+	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
+
+	# Fix bug 18245: Prevent "make" from the following chain:
+	# (1) Notice configure.ac is newer than auto/configure
+	# (2) Rebuild auto/configure
+	# (3) Notice auto/configure is newer than auto/config.mk
+	# (4) Run ./configure (with wrong args) to remake auto/config.mk
+	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
+	rm src/auto/configure || die "rm failed"
+}
+
+src_configure() {
+
+	# Fix bug #37354: Disallow -funroll-all-loops on amd64
+	# Bug #57859 suggests that we want to do this for all archs
+	filter-flags -funroll-all-loops
+
+	# Fix bug 76331: -O3 causes problems, use -O2 instead. We'll do this for
+	# everyone since previous flag filtering bugs have turned out to affect
+	# multiple archs...
+	replace-flags -O3 -O2
+
+	emake -j1 -C src autoconf
+
+	# This should fix a sandbox violation (see bug #24447). The hvc
+	# things are for ppc64, see bug #86433.
+	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
+		if [[ -e "${file}" ]]; then
+			addwrite ${file}
+		fi
+	done
+
+	local myconf=()
+	if use minimal; then
+		myconf=(
+			--with-features=tiny
+			--disable-nls
+			--disable-canberra
+			--disable-acl
+			--enable-gui=no
+			--without-x
+			--disable-darwin
+			--disable-luainterp
+			--disable-perlinterp
+			--disable-pythoninterp
+			--disable-mzschemeinterp
+			--disable-rubyinterp
+			--disable-selinux
+			--disable-tclinterp
+			--disable-gpm
+		)
+	else
+		use debug && append-flags "-DDEBUG"
+
+		myconf=(
+			--with-features=huge
+			$(use_enable sound canberra)
+			$(use_enable acl)
+			$(use_enable crypt libsodium)
+			$(use_enable cscope)
+			$(use_enable gpm)
+			$(use_enable nls)
+			$(use_enable perl perlinterp)
+			$(use_enable python python3interp)
+			$(use_with python python3-command "${PYTHON}")
+			$(use_enable racket mzschemeinterp)
+			$(use_enable ruby rubyinterp)
+			$(use_enable selinux)
+			$(use_enable tcl tclinterp)
+			$(use_enable terminal)
+		)
+
+		# --with-features=huge forces on cscope even if we --disable it. We need
+		# to sed this out to avoid screwiness. (1 Sep 2004 ciaranm)
+		if ! use cscope; then
+			sed -i -e \
+				'/# define FEAT_CSCOPE/d' src/feature.h || die "sed failed"
+		fi
+
+		if use lua; then
+			# -DLUA_COMPAT_OPENLIB=1 is required to enable the
+			# deprecated (in 5.1) luaL_openlib API (#874690)
+			use lua_single_target_lua5-1 && append-cppflags -DLUA_COMPAT_OPENLIB=1
+
+			myconf+=(
+				--enable-luainterp
+				$(use_with lua_single_target_luajit luajit)
+				--with-lua-prefix="${EPREFIX}/usr"
+			)
+		fi
+
+		# don't test USE=X here ... see bug #19115
+		# but need to provide a way to link against X ... see bug #20093
+		myconf+=(
+			--enable-gui=no
+			--disable-darwin
+			$(use_with X x)
+		)
+	fi
+
+	# let package manager strip binaries
+	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
+
+	# keep prefix env contained within the EPREFIX
+	use prefix && myconf+=( --without-local-dir )
+
+	if tc-is-cross-compiler ; then
+		export vim_cv_getcwd_broken=no \
+			   vim_cv_memmove_handles_overlap=yes \
+			   vim_cv_stat_ignores_slash=yes \
+			   vim_cv_terminfo=yes \
+			   vim_cv_toupper_broken=no
+	fi
+
+	econf \
+		--with-modified-by="Gentoo-${PVR} (RIP Bram)" \
+		"${myconf[@]}"
+}
+
+src_compile() {
+	# The following allows emake to be used
+	emake -j1 -C src auto/osdef.h objects
+
+	emake
+}
+
+src_test() {
+	einfo
+	einfo "Starting vim tests. Several error messages will be shown"
+	einfo "while the tests run. This is normal behaviour and does not"
+	einfo "indicate a fault."
+	einfo
+	ewarn "If the tests fail, your terminal may be left in a strange"
+	ewarn "state. Usually, running 'reset' will fix this."
+	einfo
+
+	# Don't let vim talk to X
+	unset DISPLAY
+
+	# Arch and opensuse seem to do this and at this point, I'm willing
+	# to try anything to avoid random test hangs!
+	export TERM=xterm
+
+	# See https://github.com/vim/vim/blob/f08b0eb8691ff09f98bc4beef986ece1c521655f/src/testdir/runtest.vim#L5
+	# for more information on test variables we can use.
+	# Note that certain variables need vim-compatible regex (not PCRE), see e.g.
+	# http://www.softpanorama.org/Editors/Vimorama/vim_regular_expressions.shtml.
+	#
+	# Skipped tests:
+	# - Test_expand_star_star
+	# Hangs because of a recursive symlink in /usr/include/nodejs (bug #616680)
+	# - Test_exrc
+	# Looks in wrong location? (bug #742710)
+	# - Test_job_tty_in_out
+	# Fragile and depends on TERM(?)
+	# - Test_spelldump_bang
+	# Hangs.
+	# - Test_fuzzy_completion_env
+	# Too sensitive to leaked environment variables.
+	# - Test_term_mouse_multiple_clicks_to_select_mode
+	# Hangs.
+	# - Test_spelldump
+	# Hangs.
+	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
+
+	emake -j1 -C src/testdir nongui
+}
+
+# Call eselect vi update with --if-unset
+# to respect user's choice (bug #187449)
+eselect_vi_update() {
+	ebegin "Calling eselect vi update"
+	eselect vi update --if-unset
+	eend $?
+}
+
+src_install() {
+	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
+
+	# Note: Do not install symlinks for 'vi', 'ex', or 'view', as these are
+	#       managed by eselect-vi
+	dobin src/vim
+	if ! use minimal ; then
+		dosym vim /usr/bin/vimdiff
+	fi
+	dosym vim /usr/bin/rvim
+	dosym vim /usr/bin/rview
+	if use vim-pager ; then
+		dosym ${vimfiles}/macros/less.sh /usr/bin/vimpager
+		dosym ${vimfiles}/macros/manpager.sh /usr/bin/vimmanpager
+		insinto ${vimfiles}/macros
+		doins runtime/macros/manpager.sh
+		fperms a+x ${vimfiles}/macros/manpager.sh
+	fi
+
+	domenu runtime/vim.desktop
+
+	newbashcomp "${FILESDIR}"/${PN}-completion ${PN}
+
+	# keep in sync with 'complete ... -F' list
+	bashcomp_alias vim ex vi view rvim rview vimdiff
+}
+
+pkg_postinst() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}
+
+pkg_postrm() {
+	# Update documentation tags (from vim-doc.eclass)
+	update_vim_helptags
+
+	# Call eselect vi update
+	eselect_vi_update
+
+	# update desktop file mime cache
+	xdg_desktop_database_update
+}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest

@@ -4,8 +4,10 @@ DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
 DIST qemu-7.2.4.tar.xz 121849100 BLAKE2B a9c5ffce9ff0fac4e2d1fa4be1a1dcee2f5d7f793ddf726871c5ae9a68c22f7ba03692a8a5096de3051030d3c2f34e46697d5af2d66c34984b8161ae3bb07b42 SHA512 fa765673833a1f2cbecdb9d47dc7dc29d7613be5a5c8fc63925ae70e1f5aafb4f9f02e45b212a329f17b689351b8a9cdf5f5235ab6adb71bb40e41868898d95b
 DIST qemu-7.2.6.tar.xz 121322888 BLAKE2B c3f51cc1647f5c75774513f624c2e1a1e4badd7275c9f9a64a175809daf17d0b3c58eab0c36fa98fc46834d4d79f8552d1c9f34e840ee21ddd049cc3adba480a SHA512 534fffe2d751a707a7cf15db8d5b9eddc2468fd7fe875715e79ee879fb20d7370553588384d345b586eeaddf9284de36f2d0d69f747380ee55161cc6eb09bf30
+DIST qemu-7.2.7.tar.xz 121869000 BLAKE2B b8d754c4c4e4aea63dc884ec568edf308829fe869e4eb8b9c0ae6a4f30debcbaa6a584decce416eed7bd4dd4913263238ed28575a1cf56db939bc141815de25a SHA512 44c0023a9f6177706be5e565297b0ff5fd62a0ea17b085fe478677ada33ab4c922968e4e8fca7aecb310b2b7809a08c075262cc640981a42bcee618e6ae4e592
 DIST qemu-8.0.0-docs.tar.xz 3218024 BLAKE2B b764a625024e78a39470048355471e12cfb57ab3c34e764dc4200fdf5c1aea635d26095ec961979bf46f177101c5bd38618bacf7e98e04bd64688ab5e29591aa SHA512 d9dfe191372e105fe16fe8f66f41ed793ade4c89b5ab1d84b39459f3419a1ca61bd49422a83981965cc257c05eca7fd49054703f58f179f5c7b656e9473a1054
 DIST qemu-8.0.4.tar.xz 126179324 BLAKE2B dfb98964c629b251f0004b4630ae4500a52465579417d6f5c7dbbb1f672e10d8d7ffb98a4b00e26fb98b3c867208146dbdca026e4d30cbf1752ac733c4d9b915 SHA512 bd5ed682d51f974abd4be93f949701f9b5bfb87fd9929e31df130534da2f2c03b99adc9f924b3efd47d3b254e0e3c0046f4e69fbe9f6d0c4ac1f6babecb29449
 DIST qemu-8.0.5.tar.xz 126175064 BLAKE2B 1d1f78c185ab64b4ca946a44ad04d0bbb6ea48de058037e4ba18176abeb0f0528754c6e832f742f93227182bbce145544eca5b908a366006e7ee58876aca0bda SHA512 ec9679473dda84a2f56ae8ee0039ec4dafb056414bfc5a3a147b2b6bb45ae3b130dd80f6385e8567b5d18f4be94f3536bc8acc45c61eddf40c9678b46cb8bddc
 DIST qemu-8.1.0-docs.tar.xz 2129912 BLAKE2B 8aaf7b748538afdb5bcb6da15dbd96572d086824377c4b0e93f1ddc695f9a4775471e360a9616d2d481dbf8113e91d2601c69d92cef565fb90b65ffacfdb304e SHA512 905515742bb56a439fc8117ec48ea668e7b2bf0244587673e4352d9e8e49911eb84ff093596ff566e44787197cf9789ec8950e3d75fb7a670c5546394a322ac9
 DIST qemu-8.1.2.tar.xz 123553328 BLAKE2B 8f48638cd1f0285356aae2d14862f56cc79da09bb9ff9f09e90221fdca851e9c3f8a3d940039f578d24d0b4435baf19cb52a3e927e97bf978ea674d148ecd746 SHA512 d95ba8b294115b86b7f3bd1b438b059e38c7ccc68f14e76b455b355b4b68ec84fb799bef44dbf96befcad7c40a15f4660096b5ad5be4396d54dfeaba34c89db8
+DIST qemu-8.1.3.tar.xz 124040288 BLAKE2B 365b5fa508c57f4738b73666c6f7306985b5d3fe00d1f1bd14d9277121adbd7ffda7764fbded834512e88d19f96b2c3def39bdf336396c27b26dc388c3821852 SHA512 d3847f1c0c0099937d08bba604713ac288b6151867a8da230297ee1d93b7e741fa406a2f7bf6645ce3293c0a98458dc9c79454746e7c2920e9a73e0574753e5a

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-7.2.0-tcg-curl-ssl.patch

@@ -1,182 +0,0 @@
-https://bugs.gentoo.org/895746#c3
-https://gitlab.com/qemu-project/qemu/-/issues/1471
-https://gitlab.com/qemu-project/qemu/-/commit/60c7dd22e1383754d5f150bc9f7c2785c662a7b6
-
-From 60c7dd22e1383754d5f150bc9f7c2785c662a7b6 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Tue, 31 Jan 2023 09:48:03 +0100
-Subject: [PATCH] target/i386: fix ADOX followed by ADCX
-
-When ADCX is followed by ADOX or vice versa, the second instruction's
-carry comes from EFLAGS and the condition codes use the CC_OP_ADCOX
-operation.  Retrieving the carry from EFLAGS is handled by this bit
-of gen_ADCOX:
-
-        tcg_gen_extract_tl(carry_in, cpu_cc_src,
-            ctz32(cc_op == CC_OP_ADCX ? CC_C : CC_O), 1);
-
-Unfortunately, in this case cc_op has been overwritten by the previous
-"if" statement to CC_OP_ADCOX.  This works by chance when the first
-instruction is ADCX; however, if the first instruction is ADOX,
-ADCX will incorrectly take its carry from OF instead of CF.
-
-Fix by moving the computation of the new cc_op at the end of the function.
-The included exhaustive test case fails without this patch and passes
-afterwards.
-
-Because ADCX/ADOX need not be invoked through the VEX prefix, this
-regression bisects to commit 16fc5726a6e2 ("target/i386: reimplement
-0x0f 0x38, add AVX", 2022-10-18).  However, the mistake happened a
-little earlier, when BMI instructions were rewritten using the new
-decoder framework.
-
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1471
-Reported-by: Paul Jolly <https://gitlab.com/myitcv>
-Fixes: 1d0b926150e5 ("target/i386: move scalar 0F 38 and 0F 3A instruction to new decoder", 2022-10-18)
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---- a/target/i386/tcg/emit.c.inc
-+++ b/target/i386/tcg/emit.c.inc
-@@ -1015,6 +1015,7 @@ VSIB_AVX(VPGATHERQ, vpgatherq)
- 
- static void gen_ADCOX(DisasContext *s, CPUX86State *env, MemOp ot, int cc_op)
- {
-+    int opposite_cc_op;
-     TCGv carry_in = NULL;
-     TCGv carry_out = (cc_op == CC_OP_ADCX ? cpu_cc_dst : cpu_cc_src2);
-     TCGv zero;
-@@ -1022,14 +1023,8 @@ static void gen_ADCOX(DisasContext *s, CPUX86State *env, MemOp ot, int cc_op)
-     if (cc_op == s->cc_op || s->cc_op == CC_OP_ADCOX) {
-         /* Re-use the carry-out from a previous round.  */
-         carry_in = carry_out;
--        cc_op = s->cc_op;
--    } else if (s->cc_op == CC_OP_ADCX || s->cc_op == CC_OP_ADOX) {
--        /* Merge with the carry-out from the opposite instruction.  */
--        cc_op = CC_OP_ADCOX;
--    }
--
--    /* If we don't have a carry-in, get it out of EFLAGS.  */
--    if (!carry_in) {
-+    } else {
-+        /* We don't have a carry-in, get it out of EFLAGS.  */
-         if (s->cc_op != CC_OP_ADCX && s->cc_op != CC_OP_ADOX) {
-             gen_compute_eflags(s);
-         }
-@@ -1053,7 +1048,14 @@ static void gen_ADCOX(DisasContext *s, CPUX86State *env, MemOp ot, int cc_op)
-         tcg_gen_add2_tl(s->T0, carry_out, s->T0, carry_out, s->T1, zero);
-         break;
-     }
--    set_cc_op(s, cc_op);
-+
-+    opposite_cc_op = cc_op == CC_OP_ADCX ? CC_OP_ADOX : CC_OP_ADCX;
-+    if (s->cc_op == CC_OP_ADCOX || s->cc_op == opposite_cc_op) {
-+        /* Merge with the carry-out from the opposite instruction.  */
-+        set_cc_op(s, CC_OP_ADCOX);
-+    } else {
-+        set_cc_op(s, cc_op);
-+    }
- }
- 
- static void gen_ADCX(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode)
---- a/tests/tcg/i386/Makefile.target
-+++ b/tests/tcg/i386/Makefile.target
-@@ -14,7 +14,7 @@ config-cc.mak: Makefile
- I386_SRCS=$(notdir $(wildcard $(I386_SRC)/*.c))
- ALL_X86_TESTS=$(I386_SRCS:.c=)
- SKIP_I386_TESTS=test-i386-ssse3 test-avx test-3dnow test-mmx
--X86_64_TESTS:=$(filter test-i386-bmi2 $(SKIP_I386_TESTS), $(ALL_X86_TESTS))
-+X86_64_TESTS:=$(filter test-i386-adcox test-i386-bmi2 $(SKIP_I386_TESTS), $(ALL_X86_TESTS))
- 
- test-i386-sse-exceptions: CFLAGS += -msse4.1 -mfpmath=sse
- run-test-i386-sse-exceptions: QEMU_OPTS += -cpu max
-@@ -28,6 +28,10 @@ test-i386-bmi2: CFLAGS=-O2
- run-test-i386-bmi2: QEMU_OPTS += -cpu max
- run-plugin-test-i386-bmi2-%: QEMU_OPTS += -cpu max
- 
-+test-i386-adcox: CFLAGS=-O2
-+run-test-i386-adcox: QEMU_OPTS += -cpu max
-+run-plugin-test-i386-adcox-%: QEMU_OPTS += -cpu max
-+
- #
- # hello-i386 is a barebones app
- #
---- /dev/null
-+++ b/tests/tcg/i386/test-i386-adcox.c
-@@ -0,0 +1,75 @@
-+/* See if various BMI2 instructions give expected results */
-+#include <assert.h>
-+#include <stdint.h>
-+#include <stdio.h>
-+
-+#define CC_C 1
-+#define CC_O (1 << 11)
-+
-+#ifdef __x86_64__
-+#define REG uint64_t
-+#else
-+#define REG uint32_t
-+#endif
-+
-+void test_adox_adcx(uint32_t in_c, uint32_t in_o, REG adcx_operand, REG adox_operand)
-+{
-+    REG flags;
-+    REG out_adcx, out_adox;
-+
-+    asm("pushf; pop %0" : "=r"(flags));
-+    flags &= ~(CC_C | CC_O);
-+    flags |= (in_c ? CC_C : 0);
-+    flags |= (in_o ? CC_O : 0);
-+
-+    out_adcx = adcx_operand;
-+    out_adox = adox_operand;
-+    asm("push %0; popf;"
-+        "adox %3, %2;"
-+        "adcx %3, %1;"
-+        "pushf; pop %0"
-+        : "+r" (flags), "+r" (out_adcx), "+r" (out_adox)
-+        : "r" ((REG)-1), "0" (flags), "1" (out_adcx), "2" (out_adox));
-+
-+    assert(out_adcx == in_c + adcx_operand - 1);
-+    assert(out_adox == in_o + adox_operand - 1);
-+    assert(!!(flags & CC_C) == (in_c || adcx_operand));
-+    assert(!!(flags & CC_O) == (in_o || adox_operand));
-+}
-+
-+void test_adcx_adox(uint32_t in_c, uint32_t in_o, REG adcx_operand, REG adox_operand)
-+{
-+    REG flags;
-+    REG out_adcx, out_adox;
-+
-+    asm("pushf; pop %0" : "=r"(flags));
-+    flags &= ~(CC_C | CC_O);
-+    flags |= (in_c ? CC_C : 0);
-+    flags |= (in_o ? CC_O : 0);
-+
-+    out_adcx = adcx_operand;
-+    out_adox = adox_operand;
-+    asm("push %0; popf;"
-+        "adcx %3, %1;"
-+        "adox %3, %2;"
-+        "pushf; pop %0"
-+        : "+r" (flags), "+r" (out_adcx), "+r" (out_adox)
-+        : "r" ((REG)-1), "0" (flags), "1" (out_adcx), "2" (out_adox));
-+
-+    assert(out_adcx == in_c + adcx_operand - 1);
-+    assert(out_adox == in_o + adox_operand - 1);
-+    assert(!!(flags & CC_C) == (in_c || adcx_operand));
-+    assert(!!(flags & CC_O) == (in_o || adox_operand));
-+}
-+
-+int main(int argc, char *argv[]) {
-+    /* try all combinations of input CF, input OF, CF from op1+op2,  OF from op2+op1 */
-+    int i;
-+    for (i = 0; i <= 15; i++) {
-+        printf("%d\n", i);
-+        test_adcx_adox(!!(i & 1), !!(i & 2), !!(i & 4), !!(i & 8));
-+        test_adox_adcx(!!(i & 1), !!(i & 2), !!(i & 4), !!(i & 8));
-+    }
-+    return 0;
-+}
-+
--- 
-GitLab

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.7.ebuild

@@ -0,0 +1,971 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=ajak
+QEMU_DOCS_VERSION="7.2.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{9,10,11} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-util/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.3.ebuild

@@ -0,0 +1,969 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+#QEMU_DOCS_VERSION=$(ver_cut 1-3)
+QEMU_DOCS_VERSION=8.1.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		subprojects/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg keyutils
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	keyutils? ( sys-apps/keyutils[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-util/meson-0.63.0
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r subprojects/dtc roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser keyutils libkeyutils)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}

sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest

@@ -403,3 +403,15 @@ DIST bash52-014 3245 BLAKE2B 990e6566c446ce030d1333a05de9027a994054e983bf414e9aa
 DIST bash52-014.sig 95 BLAKE2B 2206483fd1b356099bab6fb7793d21dbd5b2adcbe2b108c69c5d7ccd6a13f934c69adcecd5f3fb1783b380c91c362609a175c4b95f25ac9996bbfad0147f250d SHA512 e7404ca3ff8bac3cb0dc7edd0bfc79dddd07734474c8d99a4dfffae87645653f05a26911e5f1e4670d80472423c84b42f86c84835ca310c083bcf16cdf860dd2
 DIST bash52-015 8088 BLAKE2B 038f03bc543297a3f2e7612afdee7b27eb5d65d7f81c22976936211f4a80acd9f0faf1ba6c56e20fc653b877a448ab7872b5488da3684952682d80c752227ab2 SHA512 eb1bd6b3bf8811d765f222cd48360eb7f3f0aaa4f29f1b6c1f17635b819e5e4734ec4e7fcfde551fd7a6299a7d67869ea0bc5cc86cc523bc4a64d30e433df493
 DIST bash52-015.sig 95 BLAKE2B b32afb78e24554ccc73f95883e1c78cdee222e589634ecca947b00ce163596373de6179f7c6e6bccbb9ab846c9ff3c8ee04723f23b1a641c908f535c01cbea2c SHA512 047d84c9e1bc996acfb735667409a7285d025fc8c63b9c7da86ace9e6be133d58bd66bf8bf918b81d27aaebc5795419604418d2ddb0ee11b675f283b634f441f
+DIST bash52-016 1225 BLAKE2B 675b70e1df1083021fb6336e50d10012dc02e1a80865a64579256319ca98c8282af20e7210ef9d993f97718c7bfed2315f23edac04e6f3af65a1e08cd5f7ef2e SHA512 11c3197870570050767887a7497b52549caf2bf74e69c5a4eb95ff316942177da0a1150819f7051eb690841796b98d9a81f784204d18ad176cd2c29473e466d4
+DIST bash52-016.sig 95 BLAKE2B 6b61d9293f0f804c12d3c0a0afa802d91fbdbb55e3f69daaad8b1fcb23718ebcca56c9a9fc6b35eaefe05f146b5a502291aead23c523f966e32e3f0585b0fc08 SHA512 59bae9616765a10b3f12f5ca6f6ef6c2d2179c50d94e5698b1c6bfc5cb0819328ee8537bab86ab6efb936f262bdfe14f7fc9d5ba0b88e5c4ebd2cf1aae22990a
+DIST bash52-017 1396 BLAKE2B 461f2f6543501306faa5decd98211699f0ce84eea5a1225145dc401ec0ca893c9d8021359c04af4dec265e7d247f2fbb70cfe8d5382e3c38fd2774e017de4aed SHA512 1844d1f4fbce0ae1dd8f2b9c152decc7cc645b7c0c66e84ed129072251e990f2da2220917957e98dd8b1299d2d10fb2dd23e184e40457063c1d554bb132ef1e5
+DIST bash52-017.sig 95 BLAKE2B cf83b861273b9f7e7611367f7551be7af678839fd1c0570eaf1f8ec54ab8e858b78086f2c20ff5d1899aa8544cc27dd2dc2b6d518f6ff4e1d35bc6f4eb5c752e SHA512 8978eeb9180d2cf699247a1cff537708be9882916cba02ed991b0403aaf0b9d7bbff54b601f4251466114dc0ce5100685ef655504ce1f2d08bb5f5a2b73dadd8
+DIST bash52-018 151467 BLAKE2B 89f95c096f8e487e2a1a00541087d157321b125ae93dc656af0cf6ead9158401a028f5c838c4b81aeb95e7c4951a3b4dfb1a88e08297a03236c0ad36eb6710d2 SHA512 b454ba8a311b0943f9669425891499fe8d4b5f1a90899bf6c4d0969699e21f8f8e08d0b0e23a7cf5c97aa6b21384ae907ed710254053e7edd43328aa6003780c
+DIST bash52-018.sig 95 BLAKE2B 4b371fda53d2bd01b4527688209b49677b5b9f60de6c393fb2b810ba1342c98af0b1e50f35a0a6ef85116686451fad1e103da74611645ed99e04f438dd6245c7 SHA512 0930923972e94dab24f33ef68be03dde13b9b13424078102f5f7d5a7c8080f64989b283417efe2c72c89d2e2c2def9a27470b3e125cc233f5c95122c78b9b540
+DIST bash52-019 2548 BLAKE2B bcf683825da1e56692d7024748501cc582e623168fc1a8713ef3b4eb284222f6bf9144871d6357464a1c8c031f105ca6cac6cc591b5463d8b72eb139fcf044f0 SHA512 d009b0a571a3e23ab723c6c6fd4b28c48db1a927d690b4c42d7ed2fa51052aaf662026a2de9e4ee3676087eac844f8b57adae567556228c4fd8fb4ed3c8a1b94
+DIST bash52-019.sig 95 BLAKE2B f42700d5a25003d9f3e722c6230bb8795e2d01fe4b4b49411956757346f8df42bdfcc5af3a87469df7f560fb9857a05e45258f6057fd26090f0d3e17f9303fc5 SHA512 56de5fe1b98ff89ea5483f9ccef68ea8a7563e7cfa933daa223cd98f9b2d882e6692ae34859281906a228e9c510f1506c3c808eaaad6eeab762df00da2fbf55b
+DIST bash52-020 1459 BLAKE2B de3e38dbb2395c765767aed516ae3d143e3187a44964f90c587f41f93447c43515481e3c9bd562175d750d0dfb9e4e3eacb25c31f8bf54168fa544c938955eae SHA512 a5a927e90ac3daead54e90f8ff99dbda0fd652c3df83b7bcde0adb136fc4ba8498810e5bfa1d7f0c143422bf1f4622a4669c96e505bccad7c9a271d7e0668187
+DIST bash52-020.sig 95 BLAKE2B 8fd778b381cc14d17de8f2b7e215fa0d35c569a90d46fac77c0a94bea525bd62428663f0a908e64ff773bd4caf0aab7f92c2dda1f4158aacbd53f053be91d16d SHA512 0ae6d9189329e560a89af9f42f0f98126faeb15d29bd327e6bd7694870a9bcfae3d3d545e42baf4223dcc732a50d46e4c22477c41b98be85736bb05a359eeeec
+DIST bash52-021 1890 BLAKE2B cc2d886da8c51eb7bdbed694423eae29dc05dc2c7bd0cd41b9ee3acbc56ef135043bb48275c4162d33d2d4051a0a8b27f3aec097335b9d15e38fd841a6793f71 SHA512 c3a61e975819919d7ba120f322fc5e9a420b21f03d7bf989a5e7b6a99bfe35372744277040e88361ee383ab53b05d607d52ff2000b401de038af67c91728b48f
+DIST bash52-021.sig 95 BLAKE2B 79572b14f423f0a96e89d106c5ed448c2b447760e99c743354bd6315132325c19312cfcad98f94c42d3094bb4283c1f7753ac4d3c600d46c63e49d0f7cc3befd SHA512 4063559edade78d1510c12b825aa29925e515807b447e50fe564770ee26ddf34e18b47132e5154a4c883043cc80b3d6415e4ba370bad308a17dc0f6b53fc61c5

sdk_container/src/third_party/portage-stable/app-shells/bash/bash-5.2_p21.ebuild

@@ -0,0 +1,373 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
+inherit flag-o-matic toolchain-funcs prefix verify-sig
+
+# Uncomment if we have a patchset
+#GENTOO_PATCH_DEV="sam"
+#GENTOO_PATCH_VER="${PV}"
+
+# Official patchlevel
+# See ftp://ftp.cwru.edu/pub/bash/bash-5.1-patches/
+PLEVEL="${PV##*_p}"
+MY_PV="${PV/_p*}"
+MY_PV="${MY_PV/_/-}"
+MY_P="${PN}-${MY_PV}"
+MY_PATCHES=()
+
+is_release() {
+	case ${PV} in
+		9999|*_alpha*|*_beta*|*_rc*)
+			return 1
+			;;
+		*)
+			return 0
+			;;
+	esac
+}
+
+[[ ${PV} != *_p* ]] && PLEVEL=0
+
+# The version of readline this bash normally ships with.
+# Note: right now, we don't use the system copy of readline for bash for non-releases.
+READLINE_VER="8.2_p1"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
+	EGIT_BRANCH=devel
+	inherit git-r3
+elif is_release ; then
+	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/bash/${MY_P}.tar.gz.sig )"
+
+	if [[ ${PLEVEL} -gt 0 ]] ; then
+		# bash-5.1 -> bash51
+		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
+
+		patch_url=
+		my_patch_index=
+
+		upstream_url_base="mirror://gnu/bash"
+		mirror_url_base="ftp://ftp.cwru.edu/pub/bash"
+
+		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
+			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
+			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+
+			SRC_URI+=" ${patch_url}"
+			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+
+			# Add in the mirror URL too.
+			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
+			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}} )"
+
+			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
+		done
+
+		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
+	fi
+else
+	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
+	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz.sig )"
+fi
+
+if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+if is_release ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:=
+	nls? ( virtual/libintl )
+"
+if is_release ; then
+	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
+fi
+RDEPEND="
+	${DEPEND}
+"
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011)
+BDEPEND="
+	pgo? ( dev-util/gperf )
+	verify-sig? ( sec-keys/openpgp-keys-chetramey )
+"
+
+S="${WORKDIR}/${MY_P}"
+
+# EAPI 8 tries to append it but it doesn't exist here
+QA_CONFIGURE_OPTIONS="--disable-static"
+
+PATCHES=(
+	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
+
+	# Patches from Chet sent to bash-bug ml
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	"${FILESDIR}"/${PN}-5.2_p15-random-ub.patch
+	"${FILESDIR}"/${PN}-5.2_p15-configure-clang16.patch
+	"${FILESDIR}"/${PN}-5.2_p21-wpointer-to-int.patch
+)
+
+pkg_setup() {
+	# bug #7332
+	if is-flag -malign-double ; then
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+
+	if use bashlogger ; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig ; then
+			verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.sig}
+
+			local patch
+			for patch in "${MY_PATCHES[@]}" ; do
+				verify-sig_verify_detached ${patch}{,.sig}
+			done
+		fi
+
+		unpack ${MY_P}.tar.gz
+
+		if [[ -n ${GENTOO_PATCH_VER} ]] ; then
+			unpack ${PN}-${GENTOO_PATCH_VER}-patches.tar.xz
+		fi
+	fi
+}
+
+src_prepare() {
+	# Include official patches
+	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases.
+	if is_release ; then
+		rm -rf lib/{readline,termcap}/* || die
+		touch lib/{readline,termcap}/Makefile.in || die # for config.status
+		sed -ri -e 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in || die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches, bug #407985
+	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
+	touch -r . doc/* || die
+
+	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
+	rm tests/run-jobs || die
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	# Upstream only test with Bison and require GNUisms like YYEOF and
+	# YYERRCODE. The former at least may be in POSIX soon:
+	# https://www.austingroupbugs.net/view.php?id=1269.
+	# configure warns on use of non-Bison but doesn't abort. The result
+	# may misbehave at runtime.
+	unset YACC
+
+	local myconf=(
+		--disable-profiling
+
+		# Force linking with system curses ... the bundled termcap lib
+		# sucks bad compared to ncurses.  For the most part, ncurses
+		# is here because readline needs it.  But bash itself calls
+		# ncurses in one or two small places :(.
+		--with-curses
+
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\""${EPREFIX}"/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\""${EPREFIX}"/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	# Don't even think about building this statically without
+	# reading bug #7714 first.  If you still build it statically,
+	# don't come crying to us with bugs ;).
+	#use static && export LDFLAGS="${LDFLAGS} -static"
+	use nls || myconf+=( --disable-nls )
+
+	if is_release ; then
+		# Historically, we always used the builtin readline, but since
+		# our handling of SONAME upgrades has gotten much more stable
+		# in the PM (and the readline ebuild itself preserves the old
+		# libs during upgrades), linking against the system copy should
+		# be safe.
+		# Exact cached version here doesn't really matter as long as it
+		# is at least what's in the DEPEND up above.
+		export ac_cv_rl_version=${READLINE_VER%%_*}
+
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins ; then
+		append-ldflags -Wl,-rpath,"${EPREFIX}"/usr/$(get_libdir)/bash
+	else
+		# Disable the plugins logic by hand since bash doesn't
+		# provide a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+
+		sed -i \
+			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
+			configure || die
+	fi
+
+	# bug #444070
+	tc-export AR
+
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/pgo -fprofile-generate=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/pgo -fprofile-dir=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
+
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags}" all others
+
+	# Build Bash and run its tests to generate profiles.
+	if use pgo ; then
+		# Used in test suite.
+		unset A
+
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
+
+		if tc-is-clang; then
+			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
+		fi
+
+		# Rebuild Bash using the profiling data we just generated.
+		emake clean
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags}" all others
+	fi
+}
+
+src_test() {
+	# Used in test suite.
+	unset A
+
+	default
+}
+
+src_install() {
+	local d f
+
+	default
+
+	dodir /bin
+	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	doins "$(prefixify_ro "${FILESDIR}"/bashrc)"
+
+	keepdir /etc/bash/bashrc.d
+
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc} ; do
+		newins "${FILESDIR}"/dot-${f} .${f}
+	done
+
+	local sed_args=(
+		-e 's:#GNU#@::'
+		-e '/#@/d'
+	)
+
+	if ! use readline ; then
+		# bug #432338
+		sed_args+=(
+			-e '/^shopt -s histappend/s:^:#:'
+			-e 's:use_color=true:use_color=false:'
+		)
+	fi
+
+	sed -i \
+		"${sed_args[@]}" \
+		"${ED}"/etc/skel/.bashrc \
+		"${ED}"/etc/bash/bashrc || die
+
+	if use plugins ; then
+		exeinto /usr/$(get_libdir)/bash
+		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples ; then
+		for d in examples/{functions,misc,scripts,startup-files} ; do
+			exeinto /usr/share/doc/${PF}/${d}
+			docinto ${d}
+			for f in ${d}/* ; do
+				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
+					doexe ${f}
+				else
+					dodoc ${f}
+				fi
+			done
+		done
+	fi
+
+	# Install bash_builtins.1 and rbash.1
+	emake -C doc DESTDIR="${D}" install_builtins
+	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
+	doman "${T}"/rbash.1
+
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
+		mkdir -p "${EROOT}"/etc/bash
+		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+	fi
+}
+
+pkg_postinst() {
+	# If /bin/sh does not exist, provide it
+	if [[ ! -e ${EROOT}/bin/sh ]] ; then
+		ln -sf bash "${EROOT}"/bin/sh
+	fi
+}

sdk_container/src/third_party/portage-stable/app-shells/bash/files/bash-5.2_p21-wpointer-to-int.patch

@@ -0,0 +1,13 @@
+https://lists.gnu.org/archive/html/bug-bash/2023-03/msg00116.html
+https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=57d4dc15ff35895a1c1248f948f59739ffb99fde
+--- lib/sh/random.c
++++ lib/sh/random.c
+@@ -90,7 +90,7 @@ genseed ()
+   u_bits32_t iv;
+ 
+   gettimeofday (&tv, NULL);
+-  iv = (u_bits32_t)seedrand;		/* let the compiler truncate */
++  iv = (uintptr_t)seedrand;		/* let the compiler truncate */
+   iv = tv.tv_sec ^ tv.tv_usec ^ getpid () ^ getppid () ^ current_user.uid ^ iv;
+   return (iv);
+ }

sdk_container/src/third_party/portage-stable/app-text/asciidoc/asciidoc-10.2.0.ebuild

@@ -5,7 +5,7 @@ EAPI=8
 
 DISTUTILS_SINGLE_IMPL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{9..11} pypy3 )
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
 inherit distutils-r1 optfeature readme.gentoo-r1 pypi
 
 DESCRIPTION="A plain text human readable/writable document format"
@@ -15,10 +15,12 @@ LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 
-RDEPEND="app-text/docbook-xml-dtd:4.5
+RDEPEND="
+	app-text/docbook-xml-dtd:4.5
 	>=app-text/docbook-xsl-stylesheets-1.75
 	dev-libs/libxslt
-	dev-libs/libxml2:2"
+	dev-libs/libxml2:2
+"
 
 DOC_CONTENTS="
 If you are going to use a2x, please also look at a2x(1) under

sdk_container/src/third_party/portage-stable/app-text/asciidoc/metadata.xml

@@ -5,6 +5,7 @@
   <upstream>
     <remote-id type="sourceforge">asciidoc</remote-id>
     <remote-id type="github">asciidoc-py/asciidoc-py</remote-id>
+    <remote-id type="pypi">asciidoc</remote-id>
     <bugs-to>https://github.com/asciidoc-py/asciidoc-py/issues</bugs-to>
   </upstream>
 </pkgmetadata>

sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest

@@ -2,7 +2,9 @@ DIST sqlite-doc-3420000.zip 10665938 BLAKE2B 62aef59e6976101ecca60d1ee194e9e5580
 DIST sqlite-doc-3430000.zip 10663888 BLAKE2B 2bffca5a33c46183bf9d82042b89ad0968aa6061c7ccd5f6cd7a886ae48faa9a5356883b02048b66661f253401513d90f689f8a9f6debc0897cd25997c19ab4e SHA512 393c759e86a2fd6a7bbdc820c78289b84f984acd83879d7385c8627c73060562d376d66a9464887fdbccdea395025db677aa4c6f37aa32e99048fcde3561ae06
 DIST sqlite-doc-3430100.zip 10668827 BLAKE2B 66ae2abbe4e6f7e7922f55f90f0bdac150948b7d76c633299a4ce34dfaa050d7b0f7404938c3b39c2b117223a5bc57ca981e466d8fc1efef5d0a1892350e64c3 SHA512 62c107d716c3c656b12a08750f81db25ccb68c267795247307be88a44b3fe7ceb0f1563278a2f504b91cd985a83196a50e58de5f3240601c49a25b2b3e147d8c
 DIST sqlite-doc-3430200.zip 10681883 BLAKE2B 4bdf30c44fc7df2c54a26092ffd06779d42e41d260b0ea0303db7b0ba1f1e087a452fa8fde9ce4969910e773a7620606bccad515100e2b2c642e34df4cda9282 SHA512 efef55ee96745afccbb48fa5b611b4de86871ccf36ee1da8d164a9c063aca3049392de856c5f81fc6117b8e5ef8dba63bda9bd1bd4663a0746f81f1f348aa11c
+DIST sqlite-doc-3440000.zip 10689348 BLAKE2B 37f37ad801dbc690a8165936d627276e2ecbef7b5b37c2f1a4cd1d32340cebfefe3b58d944df6ccf28e3dadeb8539153cb39f6c485e097d125a3f923293fa157 SHA512 6873fcc265a1d89e63237d7703e750f5e4191591e17392a1060091408a9bce75e824b0bbc3d8cf2a82d6d58454f73cf3fd7c65c7276268bdfba527a168c580ff
 DIST sqlite-src-3420000.zip 13910252 BLAKE2B defe14bf0b5588775b2a2b17b3adbbaf39f1e95eac049cbd4868e2e59fbf50fb92b11c74ecf12fe0138521e7d4d3cc2a4bf45e7c83fd774abd7aa9ed7ee0f925 SHA512 509b7aa292870c927ef137469028e5e07ca74907414c5b295360cb10b377a42de7469d3afe79f8d9947d486ef74d676679c7f2d3b1caaeb8c949f27201180def
 DIST sqlite-src-3430000.zip 13927457 BLAKE2B dfa7311af66b76ca18001f98712f6187030d24e4ca679dbe1d30ef12d77f439056724087ae19640a77b075b35e3faeecc342ab8fcd5625ccd832f3e0fbe2b004 SHA512 56a16980bf10ba0d312ada183cabaa4123faf4ed531749d70349ca55ca11cc8a6733f473b2247f6cc0e500523f1b598ffee31efb81e07879c523957f0e3efa90
 DIST sqlite-src-3430100.zip 13928044 BLAKE2B dcd1927bc092b5b8a2eb244132a8c4d62a17ab2fe67c2c53c3c48159c9fa6055fd35627ac6339b95627da5fa5d374db43e0dfa4d2f733e5fa7ad0844e8208018 SHA512 90f320653069b5ba9caadc8fbc914c7e63e520b884dbf9267badb07f5c573141d7db903dbfbcc0a97f6a116d8c4edec0cfac70c3c6b8ffb2efbb808f559173e3
 DIST sqlite-src-3430200.zip 13929567 BLAKE2B 9366861b500bb6400b0d4eadf6890449b624dd42b039ee3861e18c088e1d96873978882ab747b52ac1dace40399ad7f5e583f7af608fb2120d22c311df947f65 SHA512 ab704038ae8d315144935cb99a727f85a7457ab5f0b8c639f49bb14a973dabe4784f9b23bd1ae7a351a81ce4a443142a05867c29eddb724beeff0b5c8dc0409f
+DIST sqlite-src-3440000.zip 14059695 BLAKE2B da24095877348680e199eca1bfd2099d8fdeb127e222f73aa4e6090c7921b88de81a7859cdb77040f52102e4046c851a3b8e5b5d70bea3b146c962224aa33929 SHA512 3376d42b5f78afa028e4112ec545b5dd63b38188368046b92f0ebc536fd3ba909b0fdf6cd36f4d2de1d08a5eb3aa29a723f368adfa7208a5c737a04e878ca0d4

sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.44.0.ebuild

@@ -0,0 +1,428 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2023/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2023/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+BDEPEND=">=dev-lang/tcl-8.6:0"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS4
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	append-cppflags -DSQLITE_ENABLE_MEMSYS5
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	append-cppflags -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	append-cppflags -DSQLITE_ENABLE_SESSION
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		append-cppflags -DSQLITE_ENABLE_ICU
+		sed -e "s/^TLIBS = @LIBS@/& -licui18n -licuuc/" -i Makefile.in || die "sed failed"
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+
+		# Skip known-broken test for now
+		# https://sqlite.org/forum/forumpost/d97caf168f
+		# https://sqlite.org/forum/forumpost/50f136d91d
+		if use test ; then
+			rm test/atof1.test || die
+		fi
+	fi
+
+	econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db:/ÿ.db"
+
+	emake -Onone HAVE_TCL="$(usex tcl 1 "")" $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}

sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.4.6.ebuild

@@ -12,7 +12,7 @@ SRC_URI="https://dev.gentoo.org/~soap/distfiles/${P}.tar.xz"
 
 LICENSE="MIT"
 SLOT="5.4"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+deprecated readline"
 
 DEPEND="

sdk_container/src/third_party/portage-stable/dev-lang/perl/Manifest

@@ -3,6 +3,8 @@ DIST perl-5.36.0.tar.xz 13051500 BLAKE2B e4864a4c21e5242df4164c73db8af10f7b9c36b
 DIST perl-5.36.1.tar.xz 13053604 BLAKE2B baab610d16e444338ad7d529bad6a88e12010786bd25f2ab117ab4dd636859ff862cb925700095434f05a802bea5b89a9d41769f26bdbae439443020950882bd SHA512 8d1ec654c59d078bfc477f11c9526233199a85e4d4f6f5a55bf9eb7802cd355189c669cc6785d2d5e741c1de4d740b7a0cfd3c0198122586a07ac7f527fb14af
 DIST perl-5.38.0-patches-1.tar.gz 26047 BLAKE2B 809dd5242f9868e54525ae8056598d3252c889afc72ed6f122174f828947223399a5ba4dbc16dd43501f7138205991f8c102cbe0ed94175ae3353040c53a0162 SHA512 c66160e20095555aa21d3be70050dce934d62e55e01dcf0f716129b2faa390923958a48bc448b4fab6f55e5b097eb378f7a6409a92c024fe68c8b34fddcfc5e4
 DIST perl-5.38.0.tar.xz 13565448 BLAKE2B 22fd334d911e8ebe16ad2a96522110ad2c14d09dcd04d5e64391c7ffffbb8ec92dd80d3a0f8eb105fb45aef8a2f78457174133503f7aeac4d90f762a44631478 SHA512 71beff7f6daa22a967972f5805daf2d4ff837a17e5ab808780f815d5914a67acf4f2e92acac0f2d8b24bdde4ceec0c2f7cb3029b5eadeeb30191f757e1bf0f9d
+DIST perl-5.38.1.tar.xz 13683376 BLAKE2B 1a34d37cbf67da5c17a93d9262c2e0095da4e76f5517656084abf11ba61eefc328346e326402c16836462a4363b7a35a5ae723ecb0a75982abf84df08d8e9390 SHA512 720b2c2707f219509e652bc3d80f9ce82bec85f882dee9ff88b6bc5183064d66333651830daeb92a6e96bbe5d9d48581ab8496ce9427f8db6103fc438e2c05db
 DIST perl-cross-1.4.1.tar.gz 117688 BLAKE2B e01103fb92764213dafb1ab92954fdc4bdcf1bd71a0064279ee75fed55a1c71850eaabdf667d6ab1c15eadccf7497668e5bb5ab13de33fef707fba14bfd52912 SHA512 5f403d3a52f724383d25c23b08e8001954300fa8f07a5b49df440ef4d06ef756404a6e448093c4f4d4f9a470b1c3f2b1b8b27d3d227ac1823552f6a377edd06a
 DIST perl-cross-1.4.tar.gz 113861 BLAKE2B 7c7783afccc6a04ab122a7c60b1cff7f0a2725655b2b63325ca25d7b8acb0cf993b496e2a590db943054336337ad215550b6b2a565f1d91a5aa9cfe3a4c36db4 SHA512 bde73cac13c0b42c4c6783d7e30dea491d70b65131e1c8434ef75db1f39a8e15ef5857568b706e8456faa3822402676dd247a1f20f4bed983597fdd5a6b4faad
+DIST perl-cross-1.5.1.tar.gz 118175 BLAKE2B 0b4a650073756056423fc8e0a309f0bdf665d207122bdd34ef7f5c6e3faf800adb963aa36b5f755171432e2db04025bd94cf049661f63d2f8a20c174b1884770 SHA512 beacee078b3321dcdba16fe2b1f54cdf8528715961209b685663fe8a50500c53299f047f5df974895f9b850de8bbf7bdc343b11878133c45c4bb1d6a2db90efd
 DIST perl-cross-1.5.tar.gz 115073 BLAKE2B ecc2764beef5dd188e56c2e499297e09e03a48fe4cb3b1582005e5899d7a3e9f28b9e600a18e16560a9a1955fef6d0a543a601574991a3853c8c9cdee7acc5df SHA512 b358d79e10777118b97568329e11b6b72cfe4960f2f3c0e857de31b515bd588448ad224d182b083f4075b47fd3877decbb037e7d26d4ba090011e6e41946370f

sdk_container/src/third_party/portage-stable/dev-lang/perl/perl-5.38.1.ebuild

@@ -0,0 +1,820 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit alternatives flag-o-matic toolchain-funcs multilib multiprocessing
+
+PATCH_VER=1
+CROSS_VER=1.5.1
+PATCH_BASE="perl-5.38.0-patches-${PATCH_VER}"
+PATCH_DEV=dilfridge
+
+DIST_AUTHOR=RJBS
+
+# Greatest first, don't include yourself
+# Devel point-releases are not ABI-intercompatible, but stable point releases are
+# BIN_OLDVERSEN contains only C-ABI-intercompatible versions
+PERL_BIN_OLDVERSEN=""
+
+if [[ "${PV##*.}" == "9999" ]]; then
+	DIST_VERSION=5.30.0
+else
+	DIST_VERSION="${PV/_rc/-RC}"
+fi
+SHORT_PV="${DIST_VERSION%.*}"
+
+# Even numbered major versions are ABI intercompatible
+# Odd numbered major versions are not
+if [[ $(( ${SHORT_PV#*.} % 2 )) == 1 ]]; then
+	SUBSLOT="${DIST_VERSION%-RC*}"
+else
+	SUBSLOT="${DIST_VERSION%.*}"
+fi
+
+# Used only in tar paths
+MY_P="perl-${DIST_VERSION}"
+# Used in library paths
+MY_PV="${DIST_VERSION%-RC*}"
+
+DESCRIPTION="Larry Wall's Practical Extraction and Report Language"
+
+SRC_URI="
+	mirror://cpan/src/5.0/${MY_P}.tar.xz
+	mirror://cpan/authors/id/${DIST_AUTHOR:0:1}/${DIST_AUTHOR:0:2}/${DIST_AUTHOR}/${MY_P}.tar.xz
+	https://github.com/gentoo-perl/perl-patchset/archive/refs/tags/${PATCH_BASE}.tar.gz
+	https://dev.gentoo.org/~${PATCH_DEV}/distfiles/${PATCH_BASE}.tar.gz
+	https://github.com/arsv/perl-cross/releases/download/${CROSS_VER}/perl-cross-${CROSS_VER}.tar.gz
+"
+
+HOMEPAGE="https://www.perl.org/"
+
+LICENSE="|| ( Artistic GPL-1+ )"
+SLOT="0/${SUBSLOT}"
+
+if [[ "${PV##*.}" != "9999" ]] && [[ "${PV/rc//}" == "${PV}" ]] ; then
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+IUSE="berkdb debug doc gdbm ithreads minimal quadmath"
+
+RDEPEND="
+	berkdb? ( sys-libs/db:= )
+	gdbm? ( >=sys-libs/gdbm-1.8.3:= )
+	app-arch/bzip2
+	>=sys-libs/zlib-1.2.12
+	virtual/libcrypt:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="${RDEPEND}"
+
+PDEPEND="
+	>=app-admin/perl-cleaner-2.30
+	!minimal? (
+		>=virtual/perl-CPAN-2.290.0
+		>=virtual/perl-Encode-3.120.0
+		>=virtual/perl-File-Temp-0.230.400-r2
+		>=virtual/perl-Data-Dumper-2.154.0
+		virtual/perl-Test-Harness
+	)
+"
+# bug 390719, bug 523624
+# virtual/perl-Test-Harness is here for the bundled ExtUtils::MakeMaker
+
+S="${WORKDIR}/${MY_P}"
+
+dual_scripts() {
+	src_remove_dual      perl-core/Archive-Tar        2.400.0       ptar ptardiff ptargrep
+	src_remove_dual      perl-core/CPAN               2.360.0       cpan
+	src_remove_dual      perl-core/Digest-SHA         6.40.0        shasum
+	src_remove_dual      perl-core/Encode             3.190.0       enc2xs piconv
+	src_remove_dual      perl-core/ExtUtils-MakeMaker 7.700.0       instmodsh
+	src_remove_dual      perl-core/ExtUtils-ParseXS   3.510.0       xsubpp
+	src_remove_dual      perl-core/IO-Compress        2.204.0       zipdetails
+	src_remove_dual      perl-core/JSON-PP            4.160.0        json_pp
+	src_remove_dual      perl-core/Module-CoreList    5.202.311.250 corelist
+	src_remove_dual      perl-core/Pod-Checker        1.750.0       podchecker
+	src_remove_dual      perl-core/Pod-Perldoc        3.280.100     perldoc
+	src_remove_dual      perl-core/Pod-Usage          2.30.0       pod2usage
+	src_remove_dual      perl-core/Test-Harness       3.440.0       prove
+	src_remove_dual      perl-core/podlators          5.10.0       pod2man pod2text
+	src_remove_dual_man  perl-core/podlators          5.10.0       /usr/share/man/man1/perlpodstyle.1
+}
+
+check_rebuild() {
+	# Fresh install
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		return 0;
+	# Major Upgrade
+	# doesn't matter if there's multiple copies, it still needs a rebuild
+	# if the string is anything other than "5.CURRENTMAJOR"
+	elif [[ "${REPLACING_VERSIONS%.*}" != "${PV%.*}" ]]; then
+		echo ""
+		ewarn "UPDATE THE PERL MODULES:"
+		ewarn "After updating dev-lang/perl the installed Perl modules"
+		ewarn "have to be re-installed. In most cases, this is done automatically"
+		ewarn "by the package manager, but subsequent steps are still recommended"
+		ewarn "to ensure system consistency."
+		ewarn
+		ewarn "You should start with a depclean to remove any unused perl dependencies"
+		ewarn "that may confuse portage in future. Regular depcleans are also encouraged"
+		ewarn "as part of your regular update cycle, as that will keep perl upgrades working."
+		ewarn "Recommended: emerge --depclean -va"
+		ewarn
+		ewarn "You should then call perl-cleaner to clean up any old files and trigger any"
+		ewarn "remaining rebuilds portage may have missed."
+		ewarn "Use: perl-cleaner --all"
+		return 0;
+
+	# Reinstall w/ USE Change
+	elif
+		 (   use ithreads && ! has_version dev-lang/perl[ithreads] ) || \
+		 ( ! use ithreads &&   has_version dev-lang/perl[ithreads] ) || \
+		 (   use quadmath && ! has_version dev-lang/perl[quadmath] ) || \
+		 ( ! use quadmath &&   has_version dev-lang/perl[quadmath] ) || \
+		 (   use debug    && ! has_version dev-lang/perl[debug]    ) || \
+		 ( ! use debug    &&   has_version dev-lang/perl[debug]    ) ; then
+		echo ""
+		ewarn "TOGGLED USE-FLAGS WARNING:"
+		ewarn "You changed one of the use-flags ithreads, quadmath, or debug."
+		ewarn "You must rebuild all perl-modules installed."
+		ewarn "Use: perl-cleaner --modules ; perl-cleaner --force --libperl"
+	fi
+}
+
+pkg_setup() {
+	case ${CHOST} in
+		*-darwin*)    osname="darwin" ;;
+		*-solaris*)   osname="solaris" ;;
+		*)            osname="linux" ;;
+	esac
+
+	myarch="${CHOST%%-*}-${osname}"
+	if use debug ; then
+		myarch+="-debug"
+	fi
+	if use quadmath ; then
+		myarch+="-quadmath"
+	fi
+	if use ithreads ; then
+		mythreading="-multi"
+		myarch+="-thread"
+	fi
+
+	PRIV_BASE="/usr/$(get_libdir)/perl5"
+	SITE_BASE="/usr/local/$(get_libdir)/perl5"
+	VENDOR_BASE="/usr/$(get_libdir)/perl5/vendor_perl"
+
+	LIBPERL="libperl$(get_libname ${MY_PV} )"
+
+	PRIV_LIB="${PRIV_BASE}/${SUBSLOT}"
+	ARCH_LIB="${PRIV_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	SITE_LIB="${SITE_BASE}/${SUBSLOT}"
+	SITE_ARCH="${SITE_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+	VENDOR_LIB="${VENDOR_BASE}/${SUBSLOT}"
+	VENDOR_ARCH="${VENDOR_BASE}/${SUBSLOT}/${myarch}${mythreading}"
+
+	dual_scripts
+}
+
+src_remove_dual_file() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				alternatives_auto_makesym "${i}" "${i}-[0-9]*"
+			done
+			;;
+		setup)
+			for i in "$@" ; do
+				if [[ -f ${EROOT}${i} && ! -h ${EROOT}${i} ]] ; then
+					has_version ${pkg} && ewarn "You must reinstall ${pkg} !"
+					break
+				fi
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i}{,-${ver}-${P}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual_man() {
+	local i pkg ver ff
+	pkg="$1"
+	ver="$2"
+	shift 2
+	case "${EBUILD_PHASE:-none}" in
+		postinst|postrm)
+			for i in "$@" ; do
+				ff=`echo "${EROOT}${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}}"*`
+				ff=${ff##*${i#${i%.[0-9]}}}
+				alternatives_auto_makesym "${i}${ff}" "${i%.[0-9]}-[0-9]*"
+			done
+			;;
+		install)
+			for i in "$@" ; do
+				if ! [[ -f "${ED}"${i} ]] ; then
+					ewarn "${i} does not exist!"
+					continue
+				fi
+				mv "${ED}"${i} "${ED}"${i%.[0-9]}-${ver}-${P}${i#${i%.[0-9]}} || die
+			done
+			;;
+	esac
+}
+
+src_remove_dual() {
+	local i pkg ver
+	pkg="$1"
+	ver="$2"
+	shift 2
+	for i in "$@" ; do
+		src_remove_dual_file  "${pkg}" "${ver}" "/usr/bin/${i}"
+		src_remove_dual_man   "${pkg}" "${ver}" "/usr/share/man/man1/${i}.1"
+	done
+}
+
+src_prepare_perlcross() {
+	cp -a ../perl-cross-${CROSS_VER}/* . || die
+
+	# bug 794463, needs further analysis what is exactly wrong here
+	eapply "${FILESDIR}/perl-5.34.0-crossfit.patch"
+
+	# bug 604072
+	MAKEOPTS+=" -j1"
+	export MAKEOPTS
+}
+
+src_prepare_dynamic() {
+	ln -s ${LIBPERL} libperl$(get_libname ${SHORT_PV}) || die
+	ln -s ${LIBPERL} libperl$(get_libname ) || die
+}
+
+# Copy a patch into the patch series
+# add_patch SRC_PATH DEST_NAME ['description'] ['bug'] ['bug']
+# - description is optional, but recommended
+# - all arguments after descriptions are bug URLs
+add_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local src_name dest_name desc
+	src_name="$1"
+	dest_name="$2"
+	desc="$3"
+	shift; shift; shift;
+	einfo "Adding ${dest_name} to patch bundle"
+	cp "${src_name}" "${patchdir}/${dest_name}" || die "Couldn't copy ${src_name} to ${dest_name}"
+	if [[ -n "${desc}" ]]; then
+		printf "%s" "${desc}" > "${infodir}/${dest_name}.desc" || die "Couldn't write ${dest_name}.desc"
+	fi
+	if [[ $# -gt 0 ]]; then
+		# Note: when $@ is more than one element, this emits a
+		# line for each element
+		printf "%s\n" "$@" > "${infodir}/${dest_name}.bugs" || die "Couldn't write ${dest_name}.bugs"
+	fi
+}
+
+# Remove a patch using a glob expr
+# eg:
+#	 rm_patch *-darwin-Use-CC*
+#
+rm_patch() {
+	local patchdir="${WORKDIR}/patches"
+	local expr="$1"
+	local patch="$( cd "${patchdir}"; echo $expr )"
+	einfo "Removing $patch ($expr) from patch bundle"
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		rm -f "${patchdir}/${patch}" || die "Can't remove ${patch} ( $expr )"
+	else
+		ewarn "No ${expr} found in ${patchdir} to remove"
+	fi
+}
+
+# Yes, this is a reasonable amount of code for something seemingly simple
+# but this is far easier to debug when things go wrong, and things went wrong
+# multiple times while I was getting the exact number of slashes right, which
+# requires circumnavigating both bash and sed escape mechanisms.
+c_escape_string() {
+	local slash dquote
+	slash='\'
+	dquote='"'
+	re_slash="${slash}${slash}"
+	re_dquote="${slash}${dquote}"
+
+	# Convert \ to \\,
+	#         " to \"
+	echo "$1" |\
+		sed "s|${re_slash}|${re_slash}${re_slash}|g" |\
+		sed "s|${re_dquote}|${re_slash}${re_dquote}|g"
+}
+c_escape_file() {
+	c_escape_string "$(cat "$1")"
+}
+
+apply_patchdir() {
+	local patchdir="${WORKDIR}/patches"
+	local infodir="${WORKDIR}/patch-info"
+	local patchoutput="patchlevel-gentoo.h"
+
+	# Inject Patch-Level info into description for patchlevel.h patch
+	# to show in -V
+	local patch_expr="*List-packaged-patches*"
+	local patch="$( cd "${patchdir}"; echo $patch_expr )";
+	einfo "Injecting patch-level info into ${patch}.desc ( $patch_expr )"
+
+	if [[ -e "${patchdir}/${patch}" ]]; then
+		printf "List packaged patches for %s(%s) in patchlevel.h" "${PF}" "${PATCH_BASE}"\
+			>"${infodir}/${patch}.desc" || die "Can't rewrite ${patch}.desc"
+	else
+		eerror "No $patch_expr found in ${patchdir}"
+	fi
+
+	# Compute patch list to apply
+	# different name other than PATCHES to stop default
+	# reapplying it
+	# Single depth is currently only supported, as artifacts can reside
+	# from the old layout being multiple-directories, as well as it grossly
+	# simplifying the patchlevel_gentoo.h generation.
+	local PERL_PATCHES=($(
+		find "${patchdir}" -maxdepth 1 -mindepth 1 -type f -printf "%f\n" |\
+			grep -E '[.](diff|patch)$' |\
+			sort -n
+	))
+
+	for patch in "${PERL_PATCHES[@]}"; do
+		eapply "${WORKDIR}"/patches/${patch}
+	done
+
+	einfo "Generating $patchoutput"
+
+	# This code creates a header file, each iteration
+	# creates one-or-more-lines for each entry found in PERL_PATCHES
+	# and STDOUT is redirected to the .h file
+	for patch in "${PERL_PATCHES[@]}"; do
+		local desc_f="${infodir}/${patch}.desc"
+		local bugs_f="${infodir}/${patch}.bugs"
+
+		printf ',"%s"\n' "${patch}"
+		if [[ ! -e "${desc_f}" ]]; then
+			ewarn "No description provided for ${patch} (expected: ${desc_f} )"
+		else
+			local desc="$(c_escape_file "${desc_f}")"
+			printf ',"- %s"\n' "${desc}"
+		fi
+		if [[ -e "${bugs_f}" ]]; then
+			while read -d $'\n' -r line; do
+				local esc_line="$(c_escape_string "${line}")"
+				printf ',"- Bug: %s"\n' "${esc_line}"
+			done <"${bugs_f}"
+		fi
+	done > "${S}/${patchoutput}"
+	printf "%s\n" "${patchoutput}" >> "${S}/MANIFEST"
+
+}
+
+src_prepare() {
+
+	local patchdir="${WORKDIR}/patches"
+
+	mv -v "${WORKDIR}/perl-patchset-${PATCH_BASE}/patches" "${WORKDIR}/patches" || die
+	mv -v "${WORKDIR}/perl-patchset-${PATCH_BASE}/patch-info" "${WORKDIR}/patch-info" || die
+
+	# Prepare Patch dir with additional patches / remove unwanted patches
+	# Inject bug/desc entries for perl -V
+	# Old example:
+	# add_patch "${FILESDIR}/${PN}-5.26.2-hppa.patch" "100-5.26.2-hppa.patch"\
+	#		"Fix broken miniperl on hppa"\
+	#		"https://bugs.debian.org/869122" "https://bugs.gentoo.org/634162"
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# do NOT mess with nsl, on Solaris this is always necessary,
+		# when -lsocket is used e.g. to get h_errno
+		rm_patch "*-nsl-and-cl*"
+	fi
+
+	apply_patchdir
+
+	tc-is-cross-compiler && src_prepare_perlcross
+
+	tc-is-static-only || src_prepare_dynamic
+
+	if use gdbm; then
+		sed -i "s:INC => .*:INC => \"-I${EROOT}/usr/include/gdbm\":g" \
+			ext/NDBM_File/Makefile.PL || die
+	fi
+
+	# Use errno.h from prefix rather than from host system, bug #645804
+	if use prefix && [[ -e "${EPREFIX}"/usr/include/errno.h ]] ; then
+		sed -i "/my..sysroot/s:'':'${EPREFIX}':" ext/Errno/Errno_pm.PL || die
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# set a soname, fix linking against just built libperl
+		sed -i -e 's/netbsd\*/netbsd*|solaris*/' Makefile.SH || die
+	fi
+
+	if [[ ${CHOST} == *-darwin* ]] ; then
+		# fix install_name (soname) not to reference $D
+		sed -i -e '/install_name `pwd/s/`pwd`/\\$(shrpdir)/' Makefile.SH || die
+
+		# fix environ linkage absence (only a real issue on Darwin9)
+		if [[ ${CHOST##*-darwin} -le 9 ]] ; then
+			sed -i -e '/^PLDLFLAGS =/s/=/= -include crt_externs.h -Denviron="(*_NSGetEnviron())"/' \
+				Makefile.SH || die
+		fi
+	fi
+
+	default
+}
+
+myconf() {
+	# the myconf array is declared in src_configure
+	myconf=( "${myconf[@]}" "$@" )
+}
+
+# Outputs a list of versions which have been seen in any of the
+# primary perl @INC prefix paths, such as:
+#  /usr/lib64/perl5/<NUMBER>
+#  /usr/local/lib64/perl5/<NUMBER>
+#  /usr/lib64/perl5/vendor_perl/<NUMBER>
+#
+# All values of NUMBER must be like "5.x.y" or like "5.x"
+#
+find_candidate_inc_versions() {
+	local regex='.*/5[.][0-9]+\([.][0-9]+\|\)$'
+	local dirs=(
+		"${EROOT}${PRIV_BASE}"
+		"${EROOT}${SITE_BASE}"
+		"${EROOT}${VENDOR_BASE}"
+	)
+	for dir in "${dirs[@]}"; do
+		if [[ ! -e "${dir}" ]]; then
+			continue
+		fi
+		# Without access to readdir() on these dirs, find will not be able
+		# to reveal any @INC directories inside them, and will subsequently prune
+		# them from the built perl's @INC support, breaking our compatiblity options
+		# entirely.
+		if [[ ! -r "${dir}" || ! -x "${dir}" ]]; then
+			eerror "Bad permissions on ${dir}, this will probably break things"
+			eerror "Ensure ${dir} is +rx for at least uid=$EUID"
+			eerror "Recommended permission is +rx for all"
+			eerror "> chmod o+rx ${dir}"
+		fi
+	done
+	einfo "Scanning for old @INC dirs matching '$regex' in: ${dirs[*]}"
+	find "${dirs[@]}" -maxdepth 1 -mindepth 1 -type d -regex "${regex}" -printf "%f "  2>/dev/null
+}
+
+# Sort versions passed versiony-ly, remove self-version if present
+# dedup. Takes each version as an argument
+sanitize_inc_versions() {
+	local vexclude="${SUBSLOT}"
+	einfo "Normalizing/Sorting candidate list: $*"
+	einfo " to remove '${vexclude}'"
+	# Note, general numeric sort has to be used
+	# for the last component, or unique will convert
+	#  5.30.0 + 5.30 into just 5.30
+	printf "%s\n" "$@" |\
+		grep -vxF "${vexclude}" |\
+		sort -u -nr -t'.' -k1,1rn -k2,2rn -k3,3rg
+}
+
+versions_to_inclist() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+
+	for v;	do
+			has "${v}" ${oldv} && echo -n "${v}/${myarch}${mythreading}/ ";
+			echo -n "${v}/ ";
+	done
+}
+
+versions_to_gentoolibdirs() {
+	local oldv="${DIST_VERSION%-RC} ${PERL_BIN_OLDVERSEN}"
+	local root
+	local v
+	for v;	do
+		for root in "${PRIV_BASE}" "${VENDOR_BASE}" "${SITE_BASE}"; do
+			local fullpath="${EROOT}${root}/${v}"
+			if [[ -e "${fullpath}" ]]; then
+				has "${v}" ${oldv} && printf "%s:" "${fullpath}/${myarch}${mythreading}";
+				printf "%s:" "${fullpath}"
+			fi
+		done
+	done
+}
+
+src_configure() {
+	declare -a myconf
+
+	export LC_ALL="C"
+	[[ ${COLUMNS:-1} -ge 1 ]] || unset COLUMNS # bug #394091
+
+	# Perl has problems compiling with -Os in your flags with glibc
+	replace-flags "-Os" "-O2"
+
+	# xlocale.h is going away in glibc-2.26, so it's counterproductive
+	# if we use it and include it in CORE/perl.h ... Perl builds just
+	# fine with glibc and locale.h only.
+	# However, the darwin prefix people have no locale.h ...
+	use elibc_glibc && myconf -Ui_xlocale
+
+	# This flag makes compiling crash in interesting ways
+	filter-flags "-malign-double"
+
+	# Generic LTO broken since 5.28, triggers EUMM failures
+	filter-lto
+
+	use sparc && myconf -Ud_longdbl
+
+	export BUILD_BZIP2=0
+	export BZIP2_INCLUDE=${EROOT}/usr/include
+	export BZIP2_LIB=${EROOT}/usr/$(get_libdir)
+
+	export BUILD_ZLIB=False
+	export ZLIB_INCLUDE=${EROOT}/usr/include
+	export ZLIB_LIB=${EROOT}/usr/$(get_libdir)
+
+	# allow either gdbm to provide ndbm (in <gdbm/ndbm.h>) or db1
+	myndbm='U'
+	mygdbm='U'
+	mydb='U'
+	if use gdbm ; then
+		mygdbm='D'
+		if use berkdb ; then
+			myndbm='D'
+		fi
+	fi
+	if use berkdb ; then
+		mydb='D'
+		has_version '=sys-libs/db-1*' && myndbm='D'
+	fi
+
+	myconf "-${myndbm}i_ndbm" "-${mygdbm}i_gdbm" "-${mydb}i_db"
+
+	if use alpha && [[ "$(tc-getCC)" = "ccc" ]] ; then
+		ewarn "Perl will not be built with berkdb support, use gcc if you needed it..."
+		myconf -Ui_db -Ui_ndbm
+	fi
+
+	use ithreads && myconf -Dusethreads
+
+	use quadmath && myconf -Dusequadmath
+
+	if use debug ; then
+		append-cflags "-g"
+		myconf -DDEBUGGING
+	elif [[ ${CFLAGS} == *-g* ]] ; then
+		myconf -DDEBUGGING=-g
+	else
+		myconf -DDEBUGGING=none
+	fi
+
+	# modifying 'optimize' prevents cross configure script from appending required flags
+	if tc-is-cross-compiler; then
+		append-cflags "-fwrapv"
+
+		# bug #913171
+		export HOSTCFLAGS="${CFLAGS_FOR_BUILD} -D_GNU_SOURCE"
+	fi
+
+	# bug #877659, bug #821577
+	append-cflags -fno-strict-aliasing
+
+	# Autodiscover all old version directories, some of them will even be newer
+	# if you downgrade
+	if [[ -z ${PERL_OLDVERSEN} ]]; then
+		PERL_OLDVERSEN="$( find_candidate_inc_versions )"
+	fi
+
+	# Fixup versions, removing self match, fixing order and dupes
+	PERL_OLDVERSEN="$( sanitize_inc_versions ${PERL_OLDVERSEN} )"
+
+	# Experts who want a "Pure" install can set PERL_OLDVERSEN to an empty string
+	if [[ -n "${PERL_OLDVERSEN// }" ]]; then
+		local inclist="$( versions_to_inclist ${PERL_OLDVERSEN} )"
+		einfo "This version of perl may partially support modules previously"
+		einfo "installed in any of the following paths:"
+		for incpath in ${inclist}; do
+			[[ -e "${EROOT}${VENDOR_BASE}/${incpath}" ]] && einfo " ${EROOT}${VENDOR_BASE}/${incpath}"
+			[[ -e "${EROOT}${PRIV_BASE}/${incpath}"   ]] && einfo " ${EROOT}${PRIV_BASE}/${incpath}"
+			[[ -e "${EROOT}${SITE_BASE}/${incpath}"   ]] && einfo " ${EROOT}${SITE_BASE}/${incpath}"
+		done
+		einfo "This is a temporary measure and you should aim to cleanup these paths"
+		einfo "via world updates and perl-cleaner"
+		# myconf -Dinc_version_list="${inclist}"
+		myconf -Dgentoolibdirs="$( versions_to_gentoolibdirs ${PERL_OLDVERSEN} )"
+	fi
+
+	[[ ${ELIBC} == "FreeBSD" ]] && myconf "-Dlibc=/usr/$(get_libdir)/libc.a"
+
+	# Make sure we can do the final link #523730, need to set deployment
+	# target to override hardcoded 10.3 which breaks on modern OSX
+	[[ ${CHOST} == *-darwin* ]] && \
+		myconf "-Dld=env MACOSX_DEPLOYMENT_TARGET=${MACOSX_DEPLOYMENT_TARGET} $(tc-getCC)"
+
+	# Older macOS with non-Apple GCC chokes on inline in system headers
+	# using c89 mode as injected by cflags.SH, in addition, we override
+	# cflags, so we loose PERL_DARWIN which enables compat code that
+	# apparently on more recent macOS releases is no longer necessary
+	[[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] && tc-is-gcc && \
+		append-cflags -Dinline=__inline__ -DPERL_DARWIN
+
+	# Prefix: the host system needs not to follow Gentoo multilib stuff, and in
+	# Prefix itself we don't do multilib either, so make sure perl can find
+	# something compatible.
+	if use prefix ; then
+		# Set a hook to check for each detected library whether it actually works.
+		export libscheck="
+			( echo 'main(){}' > '${T}'/conftest.c &&
+				$(tc-getCC) -o '${T}'/conftest '${T}'/conftest.c -l\$thislib >/dev/null 2>/dev/null
+			) || xxx=/dev/null"
+
+		# Use all host paths that might contain useful stuff, the hook above will filter out bad choices.
+		local paths="/lib/*-linux-gnu /usr/lib/*-linux-gnu /lib64 /lib/64 /usr/lib64 /usr/lib/64 /lib32 /usr/lib32 /lib /usr/lib"
+		myconf "-Dlibpth=${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir) ${paths}"
+	elif [[ $(get_libdir) != "lib" ]] ; then
+		# We need to use " and not ', as the written config.sh use ' ...
+		myconf "-Dlibpth=/usr/local/$(get_libdir) /$(get_libdir) /usr/$(get_libdir)"
+	fi
+
+	# don't try building ODBM, bug #354453
+	disabled_extensions="ODBM_File"
+
+	if ! use gdbm ; then
+		# workaround for bug #157774: don't try building GDBM related stuff with USE="-gdbm"
+		disabled_extensions="${disabled_extensions} GDBM_File NDBM_File"
+	fi
+
+	myconf -Dnoextensions="${disabled_extensions}"
+
+	[[ "${PV##*.}" == "9999" ]] && myconf -Dusedevel -Uversiononly
+
+	[[ -n "${EXTRA_ECONF}" ]] && ewarn During Perl build, EXTRA_ECONF=${EXTRA_ECONF}
+	# allow fiddling via EXTRA_ECONF, bug 558070
+	eval "local -a EXTRA_ECONF=(${EXTRA_ECONF})"
+
+	# setting -Dld= to tc-getLD breaks perl and all perl things
+	# https://github.com/Perl/perl5/issues/17791#issuecomment-630145202
+	myconf \
+		-Duseshrplib \
+		-Darchname="${myarch}" \
+		-Dcc="$(tc-getCC)" \
+		-Dar="$(tc-getAR)" \
+		-Dnm="$(tc-getNM)" \
+		-Dcpp="$(tc-getCPP)" \
+		-Dranlib="$(tc-getRANLIB)" \
+		-Accflags="${CFLAGS} -DNO_PERL_RAND_SEED" \
+		-Doptimize="${CFLAGS}" \
+		-Dldflags="${LDFLAGS}" \
+		-Dprefix="${EPREFIX}"'/usr' \
+		-Dsiteprefix="${EPREFIX}"'/usr/local' \
+		-Dvendorprefix="${EPREFIX}"'/usr' \
+		-Dscriptdir="${EPREFIX}"'/usr/bin' \
+		-Dprivlib="${EPREFIX}${PRIV_LIB}" \
+		-Darchlib="${EPREFIX}${ARCH_LIB}" \
+		-Dsitelib="${EPREFIX}${SITE_LIB}" \
+		-Dsitearch="${EPREFIX}${SITE_ARCH}" \
+		-Dvendorlib="${EPREFIX}${VENDOR_LIB}" \
+		-Dvendorarch="${EPREFIX}${VENDOR_ARCH}" \
+		-Dman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dsiteman1dir="${EPREFIX}"/usr/local/man/man1 \
+		-Dsiteman3dir="${EPREFIX}"/usr/local/man/man3 \
+		-Dvendorman1dir="${EPREFIX}"/usr/share/man/man1 \
+		-Dvendorman3dir="${EPREFIX}"/usr/share/man/man3 \
+		-Dman1ext='1' \
+		-Dman3ext='3pm' \
+		-Dlibperl="${LIBPERL}" \
+		-Dlocincpth="${EPREFIX}"'/usr/include ' \
+		-Dglibpth="${EPREFIX}/$(get_libdir) ${EPREFIX}/usr/$(get_libdir)"' ' \
+		-Duselargefiles \
+		-Dd_semctl_semun \
+		-Dcf_by='Gentoo' \
+		-Dmyhostname='localhost' \
+		-Dperladmin='root@localhost' \
+		-Ud_csh \
+		-Dsh="${EPREFIX}"/bin/sh \
+		-Dtargetsh="${EPREFIX}"/bin/sh \
+		-Uusenm \
+		"${EXTRA_ECONF[@]}"
+
+	if tc-is-cross-compiler; then
+		./configure \
+			--target="${CHOST}" \
+			--build="${CBUILD}" \
+			-Dinstallprefix='' \
+			-Dinstallusrbinperl='undef' \
+			-Dusevendorprefix='define' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	else
+		sh Configure \
+			-des \
+			-Dinstallprefix="${EPREFIX}"'/usr' \
+			-Dinstallusrbinperl='n' \
+			"${myconf[@]}" \
+			|| die "Unable to configure"
+	fi
+}
+
+src_test() {
+	export NO_GENTOO_NETWORK_TESTS=1;
+	export GENTOO_ASSUME_SANDBOXED="${GENTOO_ASSUME_SANDBOXED:-1}"
+	export GENTOO_NO_PORTING_TESTS="${GENTOO_NO_PORTING_TESTS:-1}"
+	if [[ ${EUID} == 0 ]] ; then
+		ewarn "Test fails with a sandbox error (#328793) if run as root. Skipping tests..."
+		return 0
+	fi
+	TEST_JOBS="$(makeopts_jobs)" make test_harness || die "test failed"
+}
+
+src_install() {
+	local i
+	local coredir="${ARCH_LIB}/CORE"
+
+	emake DESTDIR="${D}" install
+
+	rm -f "${ED}/usr/bin/perl${MY_PV}"
+	ln -s perl "${ED}"/usr/bin/perl${MY_PV} || die
+
+	if ! tc-is-static-only ; then
+		dolib.so "${ED}"${coredir}/${LIBPERL}
+		rm -f "${ED}"${coredir}/${LIBPERL}
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ${LIBPERL} "${ED}"/usr/$(get_libdir)/libperl$(get_libname) || die
+
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/${LIBPERL} || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname ${SHORT_PV}) || die
+		ln -sf ../../../../${LIBPERL} "${ED}"${coredir}/libperl$(get_libname) || die
+	fi
+
+	rm -rf "${ED}"/usr/share/man/man3 || die "Unable to remove module man pages"
+
+	# This removes ${D} from Config.pm
+	for i in $(find "${D}" -iname "Config.pm" ) ; do
+		einfo "Removing ${D} from ${i}..."
+		sed -i -e "s:${D}::" "${i}" || die "Sed failed"
+	done
+
+	dodoc Changes* README AUTHORS
+
+	if use doc ; then
+		# HTML Documentation
+		# We expect errors, warnings, and such with the following.
+
+		dodir /usr/share/doc/${PF}/html
+		LD_LIBRARY_PATH=. ./perl installhtml \
+			--podroot='.' \
+			--podpath='lib:ext:pod:vms' \
+			--recurse \
+			--htmldir="${ED}/usr/share/doc/${PF}/html"
+	fi
+
+	[[ -d ${ED}/usr/local ]] && rm -r "${ED}"/usr/local
+
+	dual_scripts
+}
+
+pkg_preinst() {
+	check_rebuild
+}
+
+pkg_postinst() {
+	dual_scripts
+
+	if [[ -z "${ROOT}" ]] ; then
+		local INC DIR file
+		INC=$(perl -e 'for $line (@INC) { next if $line eq "."; next if $line =~ m/'${SHORT_PV}'|etc|local|perl$/; print "$line\n" }')
+		einfo "Removing old .ph files"
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				for file in $(find "${DIR}" -name "*.ph" -type f ) ; do
+					rm -f "${file}"
+					einfo "<< ${file}"
+				done
+			fi
+		done
+		# Silently remove the now empty dirs
+		for DIR in ${INC} ; do
+			if [[ -d "${DIR}" ]] ; then
+				find "${DIR}" -depth -type d -print0 | xargs -0 -r rmdir &> /dev/null
+			fi
+		done
+
+	fi
+}
+
+pkg_postrm() {
+	dual_scripts
+}

sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest

@@ -18,6 +18,8 @@ DIST Python-3.12.0rc3.tar.xz 20566024 BLAKE2B b5f709eb80ceec58ced5bc7b0a4bd96496
 DIST Python-3.12.0rc3.tar.xz.asc 963 BLAKE2B 790b5c25ff5058d4d53c0c189ba82ba32b62cdfb100e658ca6171b2ade73bbfa155208a6c3053f498caf664852649d900b8a5173e48928f5c3c90d51a557877b SHA512 224d4402b96d6f5938d0eec83a3e494e25b4d883f9466c653788b86fc4ce5ab26ac8d9891f7aa20a6bd4766a5bc47fbe19afbc27db9148071b6b215bbdcc32f6
 DIST Python-3.13.0a1.tar.xz 20137588 BLAKE2B 62612d22ce652f4b1d7ce93aa30bd5814dbf271dbe98e321b99d003d7da8f74798e55f556db75fc39b676295c1d1f7b31919c444fe3c667d2fbd2ea16799a211 SHA512 456c6c7cb18b92645269ffa6c4db4b18370664aa60f2dbe8f42c87ae4d6d0e34940500fa06c13f0f043c33213f4e3022e233ef01bb65b50fba91454f1db3ed5e
 DIST Python-3.13.0a1.tar.xz.asc 963 BLAKE2B b4d765b76bfa13370bb9eb649e009149a292a09ec2739bbc7014be1026b9e6de06d3223cdc404fa86ef022a67c5605513c47050ca14f9d9d8dffd5e505f64328 SHA512 964e9eca1964b43333c755437d923abf0e96c7567a09ae3b9a9aad52fa5063b9699546e7b1f0bc96883b7487f3c44fd3bfda1573147fc1c4384580d77ec0272f
+DIST Python-3.13.0a2.tar.xz 20244640 BLAKE2B b1edae4c5f6c33e7250f718caa3164e163ea13f245817a997f0497d20bb9695e6e2f777eb42fc210b21fb315bd1753fe4a46b7f213312a03201481d26544fa63 SHA512 2702f630ebb49a835c213656f2f0d41f87daf2dad6b856821f4011f4614c19279656eaa1dad9f1cbfd258992aa5f59d4571577057c6a4ad1cdcfa4d8ada3b607
+DIST Python-3.13.0a2.tar.xz.asc 963 BLAKE2B db603fcf2dcf0c727b3a92a5ccbaadd080e11d664b1c07944ef082b5ca8625b2ccd4d4384d344d14e61eb73466011f2284f5240d710b3be7206c7316e2a3872b SHA512 c6a0101b844701fcd860a519ec4830bde0df486ea78377831544dbe0db25dd67c28360f46d5ef01db64aa4347cf7b0d489590f6dc91e768b16753228f2c93b25
 DIST Python-3.8.18.tar.xz 20696952 BLAKE2B 45be712aeef8bb3ba04aa2bd7d0282aa5f817327749c620ede18ee307fcb432540db9062a8186b08b49467515c74f01eb6fa739f366cca76dfadedcb22858429 SHA512 0be1d85cafade25e99b8277ba51d7b9b3a3d2dbbcc52fd0d1c633c47982e5dd87fd7a0ca180a78d7801d79a8ecafa79bd9d501d544cd7b6da53ea409daa70adf
 DIST Python-3.8.18.tar.xz.asc 833 BLAKE2B bc4e989748d53c6be7040e78d9f1852227c6a76f4c63a68824f5139defd51d1ea7988df01f961ff5c77382e156ef45fead2bb97bddbb38b208ddfa9c709e4f34 SHA512 99a0fd74fe19144819fd9522836474e10c1593787eb464694bdc6224b2d4a9331e31d2ecafc35c2bbb9bf67f20186295b28f9374c1fdcd05ac13f5f400219489
 DIST Python-3.9.18.tar.xz 19673928 BLAKE2B 97da9bedaf29101e5df82199ac3ee12f1da74d5cc89de21ff1510c3f6d34d7f9194489e79855f1ab3c6f26768738e784cb7231c1a692fa746edd21d35558bc4e SHA512 aab155aca757d298394eddb91ff9a8f239665bd46feb495c6b6f735bbcb7489c05c858cc4cd08f1575c24f293b33492d763e9a140d92f0b2b0cc81a165a677c7
@@ -35,5 +37,6 @@ DIST python-gentoo-patches-3.12.0rc2_p1.tar.xz 5168 BLAKE2B 399ad4854c46e0a2bdc7
 DIST python-gentoo-patches-3.12.0rc3.tar.xz 5168 BLAKE2B 66f132bb26c5ce36823897a6938c0f7018afd8f3c53cf738656929a944604de2764263c437c6ee4f81b617f02a33ef154d354998d14fcaef358b19b867da2937 SHA512 72fb6371871bb41ba59ddf711444fa17524fc7ac185db0ac762f6664c61cf086c73d13df10c0346094f603ed2d783bae201ee79de8d7d4cc339b74b26bd0a2f6
 DIST python-gentoo-patches-3.12.0rc3_p1.tar.xz 9700 BLAKE2B e87bc56dcf82dc0ba598ac68ffda4dbd4dd8dac4b1e9d2bc092f4ef05b9045a41270dffc7b727bcc4e82df302ee923d29dae9c18ebf97494a016c30c2f3073ac SHA512 5d9eb94ab0ffe1fba81362c448dabcd771f89e0a8576a72e7d5748831b9b8bb858942ed6c2eee3306be2a42fe4ed01f971269969c0fd6279c32d390a3a8f7cd8
 DIST python-gentoo-patches-3.13.0a1.tar.xz 4352 BLAKE2B 49f52cee497fbde6ca9628002d367e64455a628d383ce88c89a773b8d566c1601a22b65ccc130ce842bef67d3014ed987d35f86a1b83ac7ba9ad78fb7b0a6144 SHA512 bcfdc102f7c52681263e216fb46b08bcb6fa104d5a70f64eba16ab30bad2c7a9bd64a7031d3dc4f6bda842486ce8edd4bd4c17d0de14e6f2682876a8af396c5f
+DIST python-gentoo-patches-3.13.0a2.tar.xz 4360 BLAKE2B 1c55b3ae512a2c04bab00fb3a47faabd2726b6cd7a082d27b4c354ff334c22cb7296d9bf4ca531fc91e2d31be8b1f385de82081980272bca9163bc208b54fea4 SHA512 c7bd4dc3f8f698d65ffe54f46432903e3591687d997b1f6b7429bead461652d9de9dea3515cb0063a662d14ddcf7916199779d61edf888cc24c01d89f1fafbee
 DIST python-gentoo-patches-3.8.18.tar.xz 32424 BLAKE2B 2e0b6e1c8e3df666934ba283214ca1577b01140dea00513f6420b0255650002e4bc4cb142076620227cd430bc2547123fd392883285886e543ef72ca466f8ea6 SHA512 b005f1054b726fc8c82a50b006309de64fb7858fe5c22cc7b160687d059a7859ec9388706b74a0e6c1f42301bed071dc639eb8cfae0d7c5eef2f565c63cc2d29
 DIST python-gentoo-patches-3.9.18.tar.xz 25044 BLAKE2B 1d9ace5c5a0f1c15bc23595cc51d64b4c2b416552cdaaa960c3e34360aba3e7029a06e2a077212c68fa7aee4fd20f649a3b0926bd4ebb10e529e8350ab051e63 SHA512 bc180c3346dfae60a7db221d114146ee83409bc42092171eb05c83de528bf5f0e5654d1441f40ba839d0a98e866a5b43452fb7a72047c837497620a12097b8f5

sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_p1.ebuild

@@ -28,7 +28,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha ~amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 IUSE="
 	bluetooth build debug +ensurepip examples gdbm libedit lto
 	+ncurses pgo +readline +sqlite +ssl test tk valgrind

sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.13.0_alpha2.ebuild

@@ -0,0 +1,530 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_alpha/a}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils[extra-filters(+)]
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-util/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# pydoc
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}

sdk_container/src/third_party/portage-stable/dev-libs/elfutils/Manifest

@@ -1,6 +1,3 @@
-DIST elfutils-0.187-patches.tar.xz 2804 BLAKE2B 77cbd0666d8da3d5229baaba6605c84e7990200f39bfb72b2008eb2527e4567abd90c93c291cc0c8f3c10bbf97758ccf5877cbdae823780cf8dc97ff4ff2f932 SHA512 d056fdd6ae0e71471087af472a72384d6e73ff2d7fe1b708b5ec9f091a913c8327197660132b7a6619a0db86534715507ef67ee91691a00a591c1d24c55a99f4
-DIST elfutils-0.188.tar.bz2 9112977 BLAKE2B 6b0474f1436eaf6af73b735b9b2ddd5448ab9c03fbaa0be745a31c89ae8f15b0e21a651409c38643ca125794ce82c19d7b46db4a079f3e72cb919d643560e7a4 SHA512 585551b2d937d19d1becfc2f28935db1dd1a3d25571a62f322b70ac8da98c1a741a55d070327705df6c3e2ee026652e0b9a3c733b050a0b0ec5f2fc75d5b74b5
-DIST elfutils-0.188.tar.bz2.sig 310 BLAKE2B c8d9135cffde3b1dd337b692d5351855cf799915d3ebd553327febaac192bd2f108b3f45a6376d458e179390a1ceaf4809762cdc40ea1e05fed0214ac33ed56e SHA512 4cc8a7417d244e319a1650d71b1831660cfe41afc7c73e9c83d1f076f4013fe15247e8b4f5e12a5396d83c4f1c7663ca4be5ea42bff3dc23263f85331fd9d566
 DIST elfutils-0.189.tar.bz2 9143169 BLAKE2B 30596271e14cf3408326abc38a9775b849b8cb0ee119a5455df9434a7d3b9a57afb15e0236a179a26c7bd400d303749964c9d6350c419f747784fd99d12517e0 SHA512 93a877e34db93e5498581d0ab2d702b08c0d87e4cafd9cec9d6636dfa85a168095c305c11583a5b0fb79374dd93bc8d0e9ce6016e6c172764bcea12861605b71
 DIST elfutils-0.189.tar.bz2.sig 310 BLAKE2B d4155de64b15a9ab5c497cd603e73bf918eb1117de36cf28f8ddb50ccb4874fb24cffdf44bcbbc028b2ef3f64562960bf11a431274d861f9db96e3d865b37ec2 SHA512 2016c5f0ccd16f7feb0c825164bb18b2f1afad17dcd39d9f159429360fe4afd645665f612397d48bde191a1e59bb8352e2d065d61d7f649b929c3a7e7bfe8dd0
 DIST elfutils-0.190.tar.bz2 9162766 BLAKE2B 9934aff08f1898377708b28595fb52130ef9f80408132ac7d306845b10672ba45cf1ac69783da07b3eea9fd647741d44da45b8b2626c45a768cb2844c6186513 SHA512 9c4f5328097e028286c42f29e39dc3d80914b656cdfbbe05b639e91bc787ae8ae64dd4d69a6e317ce30c01648ded10281b86a51e718295f4c589df1225a48102

sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.188.ebuild

@@ -1,122 +0,0 @@
-# Copyright 2003-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/elfutils.gpg
-inherit flag-o-matic multilib-minimal verify-sig
-
-DESCRIPTION="Libraries/utilities to handle ELF objects (drop in replacement for libelf)"
-HOMEPAGE="https://sourceware.org/elfutils/"
-SRC_URI="https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2"
-SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-0.187-patches.tar.xz"
-SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.sig )"
-
-LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="bzip2 lzma nls static-libs test +utils zstd"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!dev-libs/libelf
-	>=sys-libs/zlib-1.2.8-r1[static-libs?,${MULTILIB_USEDEP}]
-	bzip2? ( >=app-arch/bzip2-1.0.6-r4[static-libs?,${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1[static-libs?,${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd:=[static-libs?,${MULTILIB_USEDEP}] )
-	elibc_musl? (
-		dev-libs/libbsd
-		sys-libs/argp-standalone
-		sys-libs/fts-standalone
-		sys-libs/obstack-standalone
-	)
-"
-DEPEND="
-	${RDEPEND}
-"
-BDEPEND="
-	>=sys-devel/flex-2.5.4a
-	sys-devel/m4
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-elfutils )
-"
-
-PATCHES=(
-	"${WORKDIR}"/${PN}-0.187-patches/
-)
-
-src_unpack() {
-	if use verify-sig ; then
-		# Needed for downloaded patch (which is unsigned, which is fine)
-		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.bz2{,.sig}
-	fi
-
-	default
-}
-
-src_prepare() {
-	default
-
-	if use elibc_musl; then
-		eapply "${WORKDIR}"/${PN}-0.187-patches/musl/
-	fi
-
-	if ! use static-libs; then
-		sed -i -e '/^lib_LIBRARIES/s:=.*:=:' -e '/^%.os/s:%.o$::' lib{asm,dw,elf}/Makefile.in || die
-	fi
-
-	# https://sourceware.org/PR23914
-	sed -i 's:-Werror::' */Makefile.in || die
-}
-
-src_configure() {
-	# bug #407135
-	use test && append-flags -g
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable nls)
-		--disable-debuginfod
-		--disable-libdebuginfod
-
-		# explicitly disable thread safety, it's not recommended by upstream
-		# doesn't build either on musl.
-		--disable-thread-safety
-
-		# Valgrind option is just for running tests under it; dodgy under sandbox
-		# and indeed even w/ glibc with newer instructions.
-		--disable-valgrind
-		--program-prefix="eu-"
-		--with-zlib
-		$(use_with bzip2 bzlib)
-		$(use_with lzma)
-		$(use_with zstd)
-	)
-
-	# Needed because sets alignment macro
-	is-flagq -fsanitize=address && myeconfargs+=( --enable-sanitize-address )
-	is-flagq -fsanitize=undefined && myeconfargs+=( --enable-sanitize-undefined )
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_test() {
-	env LD_LIBRARY_PATH="${BUILD_DIR}/libelf:${BUILD_DIR}/libebl:${BUILD_DIR}/libdw:${BUILD_DIR}/libasm" \
-		LC_ALL="C" \
-		emake check VERBOSE=1
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	dodoc NOTES
-
-	# These build quick, and are needed for most tests, so don't
-	# disable their building when the USE flag is disabled.
-	if ! use utils; then
-		rm -rf "${ED}"/usr/bin || die
-	fi
-}

sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r1.ebuild

@@ -1,127 +0,0 @@
-# Copyright 2003-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/elfutils.gpg
-inherit autotools flag-o-matic multilib-minimal verify-sig
-
-DESCRIPTION="Libraries/utilities to handle ELF objects (drop in replacement for libelf)"
-HOMEPAGE="https://sourceware.org/elfutils/"
-SRC_URI="https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2"
-SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-0.187-patches.tar.xz"
-SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.sig )"
-
-LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="bzip2 lzma nls static-libs test +utils zstd"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!dev-libs/libelf
-	>=sys-libs/zlib-1.2.8-r1[static-libs?,${MULTILIB_USEDEP}]
-	bzip2? ( >=app-arch/bzip2-1.0.6-r4[static-libs?,${MULTILIB_USEDEP}] )
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1[static-libs?,${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd:=[static-libs?,${MULTILIB_USEDEP}] )
-	elibc_musl? (
-		dev-libs/libbsd
-		sys-libs/argp-standalone
-		sys-libs/fts-standalone
-		sys-libs/obstack-standalone
-	)
-"
-DEPEND="
-	${RDEPEND}
-"
-BDEPEND="
-	>=sys-devel/flex-2.5.4a
-	sys-devel/m4
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-elfutils )
-"
-
-PATCHES=(
-	"${WORKDIR}"/${PN}-0.187-patches/
-	"${FILESDIR}"/${P}-configure-bashisms.patch
-	"${FILESDIR}"/${P}-clang16-tests.patch
-)
-
-src_unpack() {
-	if use verify-sig ; then
-		# Needed for downloaded patch (which is unsigned, which is fine)
-		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.bz2{,.sig}
-	fi
-
-	default
-}
-
-src_prepare() {
-	default
-
-	if use elibc_musl; then
-		eapply "${WORKDIR}"/${PN}-0.187-patches/musl/
-	fi
-
-	# Only here for ${P}-configure-bashisms.patch, delete on next bump!
-	eautoreconf
-
-	if ! use static-libs; then
-		sed -i -e '/^lib_LIBRARIES/s:=.*:=:' -e '/^%.os/s:%.o$::' lib{asm,dw,elf}/Makefile.in || die
-	fi
-
-	# https://sourceware.org/PR23914
-	sed -i 's:-Werror::' */Makefile.in || die
-}
-
-src_configure() {
-	# bug #407135
-	use test && append-flags -g
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable nls)
-		--disable-debuginfod
-		--disable-libdebuginfod
-
-		# explicitly disable thread safety, it's not recommended by upstream
-		# doesn't build either on musl.
-		--disable-thread-safety
-
-		# Valgrind option is just for running tests under it; dodgy under sandbox
-		# and indeed even w/ glibc with newer instructions.
-		--disable-valgrind
-		--program-prefix="eu-"
-		--with-zlib
-		$(use_with bzip2 bzlib)
-		$(use_with lzma)
-		$(use_with zstd)
-	)
-
-	# Needed because sets alignment macro
-	is-flagq -fsanitize=address && myeconfargs+=( --enable-sanitize-address )
-	is-flagq -fsanitize=undefined && myeconfargs+=( --enable-sanitize-undefined )
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_test() {
-	env LD_LIBRARY_PATH="${BUILD_DIR}/libelf:${BUILD_DIR}/libebl:${BUILD_DIR}/libdw:${BUILD_DIR}/libasm" \
-		LC_ALL="C" \
-		emake check VERBOSE=1
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	dodoc NOTES
-
-	# These build quick, and are needed for most tests, so don't
-	# disable their building when the USE flag is disabled.
-	if ! use utils; then
-		rm -rf "${ED}"/usr/bin || die
-	fi
-}

sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild

@@ -1,127 +0,0 @@
-# Copyright 2003-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/elfutils.gpg
-inherit autotools flag-o-matic multilib-minimal verify-sig
-
-DESCRIPTION="Libraries/utilities to handle ELF objects (drop in replacement for libelf)"
-HOMEPAGE="https://sourceware.org/elfutils/"
-SRC_URI="https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2"
-SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.sig )"
-
-LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
-IUSE="bzip2 debuginfod lzma nls static-libs test +utils zstd"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	!dev-libs/libelf
-	>=sys-libs/zlib-1.2.8-r1[static-libs?,${MULTILIB_USEDEP}]
-	bzip2? ( >=app-arch/bzip2-1.0.6-r4[static-libs?,${MULTILIB_USEDEP}] )
-	debuginfod? (
-		app-arch/libarchive:=
-		dev-db/sqlite:3=
-		net-libs/libmicrohttpd:=
-
-		net-misc/curl[static-libs?,${MULTILIB_USEDEP}]
-	)
-	lzma? ( >=app-arch/xz-utils-5.0.5-r1[static-libs?,${MULTILIB_USEDEP}] )
-	zstd? ( app-arch/zstd:=[static-libs?,${MULTILIB_USEDEP}] )
-	elibc_musl? (
-		dev-libs/libbsd
-		sys-libs/argp-standalone
-		sys-libs/fts-standalone
-		sys-libs/obstack-standalone
-	)
-"
-DEPEND="
-	${RDEPEND}
-"
-BDEPEND="
-	>=sys-devel/flex-2.5.4a
-	sys-devel/m4
-	nls? ( sys-devel/gettext )
-	verify-sig? ( sec-keys/openpgp-keys-elfutils )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-0.189-PaX-support.patch
-	"${FILESDIR}"/${PN}-0.189-skip-DT_RELR-failing-tests.patch
-	"${FILESDIR}"/${PN}-0.189-tests-run-lfs-symbols.sh-needs-gawk.patch
-	"${FILESDIR}"/${PN}-0.189-musl-aarch64-regs.patch
-	"${FILESDIR}"/${PN}-0.189-musl-macros.patch
-	"${FILESDIR}"/${P}-configure-bashisms.patch
-	"${FILESDIR}"/${P}-clang16-tests.patch
-)
-
-src_prepare() {
-	default
-
-	# Only here for ${P}-configure-bashisms.patch, delete on next bump!
-	eautoreconf
-
-	if ! use static-libs; then
-		sed -i -e '/^lib_LIBRARIES/s:=.*:=:' -e '/^%.os/s:%.o$::' lib{asm,dw,elf}/Makefile.in || die
-	fi
-
-	# https://sourceware.org/PR23914
-	sed -i 's:-Werror::' */Makefile.in || die
-}
-
-src_configure() {
-	# bug #407135
-	use test && append-flags -g
-
-	# bug 660738
-	filter-flags -fno-asynchronous-unwind-tables
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable nls)
-		$(multilib_native_use_enable debuginfod)
-		$(use_enable debuginfod libdebuginfod)
-
-		# explicitly disable thread safety, it's not recommended by upstream
-		# doesn't build either on musl.
-		--disable-thread-safety
-
-		# Valgrind option is just for running tests under it; dodgy under sandbox
-		# and indeed even w/ glibc with newer instructions.
-		--disable-valgrind
-		--program-prefix="eu-"
-		--with-zlib
-		$(use_with bzip2 bzlib)
-		$(use_with lzma)
-		$(use_with zstd)
-	)
-
-	# Needed because sets alignment macro
-	is-flagq -fsanitize=address && myeconfargs+=( --enable-sanitize-address )
-	is-flagq -fsanitize=undefined && myeconfargs+=( --enable-sanitize-undefined )
-
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_test() {
-	env LD_LIBRARY_PATH="${BUILD_DIR}/libelf:${BUILD_DIR}/libebl:${BUILD_DIR}/libdw:${BUILD_DIR}/libasm" \
-		LC_ALL="C" \
-		emake check VERBOSE=1
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	dodoc NOTES
-
-	# These build quick, and are needed for most tests, so don't
-	# disable their building when the USE flag is disabled.
-	if ! use utils; then
-		rm -rf "${ED}"/usr/bin || die
-	fi
-}

sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r4.ebuild

@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( https://sourceware.org/elfutils/ftp/${PV}/${P}.tar.bz2.
 
 LICENSE="|| ( GPL-2+ LGPL-3+ ) utils? ( GPL-3+ )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="bzip2 debuginfod lzma nls static-libs test +utils zstd"
 RESTRICT="!test? ( test )"
 

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/Manifest

@@ -2,5 +2,7 @@ DIST libgcrypt-1.10.1.tar.bz2 3778457 BLAKE2B 46f30459891183b6d9ec18f1c7907fee0a
 DIST libgcrypt-1.10.1.tar.bz2.sig 119 BLAKE2B 5261d7dbfd5d82b2d3fa2ebf864a9ef0c7c978dd66a71c078df7bbb3b63f5d85180e5f909f43a49712fc16c45f7aabaa6bc30ed82a39ffc9a5d483ea6a94d162 SHA512 b156ae05079776698bc95ba5a9e48e95de8f716aa1760ef4b2e7cb8518ccec660337fc7823f865bde870461800d472fd8e458d03a7095b6bb614f6dd96f796d8
 DIST libgcrypt-1.10.2.tar.bz2 3795164 BLAKE2B c86b29648664aae3fb694b20ad258828d2cecbb09db2b83df00fbdebd5d74228c92015c50f659c250cb0768ccaef7949294d9b7cdcd47e1387b7dce81d35da19 SHA512 3a850baddfe8ffe8b3e96dc54af3fbb9e1dab204db1f06b9b90b8fbbfb7fb7276260cd1e61ba4dde5a662a2385385007478834e62e95f785d2e3d32652adb29e
 DIST libgcrypt-1.10.2.tar.bz2.sig 119 BLAKE2B 3753134a1ed1fd2bfd2c64f175c3745db02791359646b3f0229c80ce4ccedbb147ee889a6b8c4fe4bf7e9067d804ee18a8411cd347026cd1656ad1d4d5686bec SHA512 9350444a0bcfa49217815a831f2286ccea470311673257bd809eb5dedbe97d2a5543b0bc7fb752312df69adeb7ac5f064e433f2545a8bf3e494027986cd8020c
+DIST libgcrypt-1.10.3.tar.bz2 3783827 BLAKE2B 1a228e02820e886016eb55dee75936c4422a15fb4f95a2f9bcd1e4faac4015d4321c7c8d23f164eb08ece5d62935ab3b3d3104eabfdd22db997ab3e5689dfa6f SHA512 8a8d4c61a6622d8481ceb9edc88ec43f58da32e316f79f8d4775325a48f8936aaa9eb355923b39e2c267b784e9c390600daeb62e0c94f00e30bbadb0d8c0865d
+DIST libgcrypt-1.10.3.tar.bz2.sig 238 BLAKE2B 216baebca91b2e940f60d70a4260b6b6b8221ef88cfb42b020bc7b3743a465ef2cf105316648ed1e689cbbf7d79da421aa9f08b5af21c5b862734cf01f377214 SHA512 73795781a458c334ec6daade1b86ae8b788dd5da0b7198b46b8e54a103c5ec4c65a5dd7e6a9d173d136889f24e7f5721992f59117334f39bd1c8a94e3b55a048
 DIST libgcrypt-1.9.4.tar.bz2 3239704 BLAKE2B b8244bc12a68955797b0c2b474ac5c95df1014231f7180a2ffa113e3aacedc98eed60ee1e4b30b032a5fcd6a04855ae07142c223906d5db9c28328a71e014f33 SHA512 d0e117ac73c94d70e9521ee1e6328691498cc8328f8c4e21338096908f5c04c7b838966eb63d59494565f4e19f506c07dab4f4d922150d75610d9f7b57abbf60
 DIST libgcrypt-1.9.4.tar.bz2.sig 119 BLAKE2B 4012c22259a9fd56f9da6c87d60077cea0dbfef85d4d4ad1ff6a2375ddefafc4cd03ee9083d18e080c14c95887b495062af886732a9593bcf1b8f187d21073fe SHA512 4aee16449b4b50dac62bd80217e769f32f43fb7cd994402b7d9cffbb1934b2771041c8c0c41a63ced9c8d9408025f9c5608ffc7f00e5e9a9b92a07cb5118a98a

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.1-r2.ebuild

@@ -157,6 +157,14 @@ multilib_src_compile() {
 	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
 }
 
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+
+	default
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.1-r3.ebuild

@@ -160,6 +160,14 @@ multilib_src_compile() {
 	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
 }
 
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+
+	default
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild

@@ -158,6 +158,14 @@ multilib_src_compile() {
 	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
 }
 
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+
+	default
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.3.ebuild

@@ -0,0 +1,180 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1 MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="+asm cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1 doc +getentropy static-libs"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.25[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+	"${FILESDIR}"/${PN}-1.9.4-no-fgrep-libgcrypt-config.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == *86*-solaris* ]] ; then
+		# ASM code uses GNU ELF syntax, divide in particular, we need to
+		# allow this via ASFLAGS, since we don't have a flag-o-matic
+		# function for that, we'll have to abuse cflags for this
+		append-cflags -Wa,--divide
+	fi
+
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	# Workaround for GCC < 11.3 bug
+	# https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commitdiff;h=0b399721ce9709ae25f9d2050360c5ab2115ae29
+	# https://dev.gnupg.org/T5581
+	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102124
+	if use arm64 && tc-is-gcc && (($(gcc-major-version) == 11)) &&
+		(($(gcc-minor-version) <= 2)) && (($(gcc-micro-version) == 0)) ; then
+		append-flags -fno-tree-loop-vectorize
+	fi
+
+	# ideally we want !tc-ld-is-bfd for best future-proofing, but it needs
+	# https://github.com/gentoo/gentoo/pull/28355
+	# mold needs this too but right now tc-ld-is-mold is also not available
+	if tc-ld-is-lld; then
+		append-ldflags -Wl,--undefined-version
+	fi
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		# http://trac.videolan.org/vlc/ticket/620
+		$([[ ${CHOST} == *86*-darwin* ]] && echo "--disable-asm")
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.9.4-r2.ebuild

@@ -123,6 +123,14 @@ multilib_src_compile() {
 	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
 }
 
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+
+	default
+}
+
 multilib_src_install() {
 	emake DESTDIR="${D}" install
 	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf

sdk_container/src/third_party/portage-stable/dev-libs/libksba/Manifest

@@ -2,3 +2,5 @@ DIST libksba-1.6.3.tar.bz2 668287 BLAKE2B a2b474aa5ea8eb387a2d9a459ec1e3daf36bbe
 DIST libksba-1.6.3.tar.bz2.sig 119 BLAKE2B c6ab01889e7d7efa6117b388c8bf8e1916a3d5c174659b01a34a60bcf8e04181aaf60c79ebd8ab423300f19de084a7968db9b9afd8aa5980246d9ce3f91d66d2 SHA512 57081497e32af41abbe84678dfb2379318ae75fdde1f871f3960b7dce7270b952a832b64accbb2a1f19fbef8db9f4d35ac59890ac6cbe45215a65f6971ba43f1
 DIST libksba-1.6.4.tar.bz2 668445 BLAKE2B 639be954727e2c3a74e075c52090bc2d9998a149f168ede376520d83a7dfd776212ba2948270096b303803e9f41381747f73c8ec97117a4d743b8df49defef9a SHA512 07bc26584d1901b2975a02012d90084e3c247a7aeab56d7bcc7197ef0210ece0c4ffd5cb468b998ef696deadfcfdc5fa5dc367077863926503e8f7a8d06856a5
 DIST libksba-1.6.4.tar.bz2.sig 119 BLAKE2B 5b9edcf65eb7b46182144a8d17a1656ada93a8a7ce3106ea5f525ab3e892b078f9c723544c13702d6d3b40fefd2bff78dc0cfbc3b1a3c156ba18740ecfc42ce6 SHA512 fbf75e03b9e0e771027acfef8cc702744a0d1fe37ef285fcf6475d4a58f7936d3bc890ee3ffe923195152bbcede807ba721ac3fdfdd6d05a1a523416f64ff8c1
+DIST libksba-1.6.5.tar.bz2 708400 BLAKE2B 934bde6412de6c1f3062b101930d7b2beac3f6e3f2fbeb5c964a6252b68a3b70c7cb3a48c7eac04b7f1d2ea3c717e1c7e164c1bc6113b46244b9dd130c64b540 SHA512 959312ac0bb2dabcdd22217266daccdf3938d62ff2936c767cade76888757ece1bb6fe79f2c679db03d1baf3919757265d0ded216fee8b8d235e94a70fcf05de
+DIST libksba-1.6.5.tar.bz2.sig 119 BLAKE2B 70f290ed44160af2882b5f2543965e3003dd0fd106ab6eaa1f7dfbb878d1f0402c16f3e802af6be589e501e17d0ead82c03afe73c8353b314c8cafb24e7d4a11 SHA512 e70f136edcf29bf931eccaf930e0ae644fd372e0a6f472599898d2fd5e44e64ab2cea63b0be2b1d9a468f73f607881dfdf06adfe6d1fc9ebd66b21e4c245f837

sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.5.ebuild

@@ -0,0 +1,62 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+# in-source builds are not supported: https://dev.gnupg.org/T6313#166339
+inherit toolchain-funcs out-of-source verify-sig libtool
+
+DESCRIPTION="X.509 and CMS (PKCS#7) library"
+HOMEPAGE="https://www.gnupg.org/related_software/libksba"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-3+ GPL-2+ GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="static-libs"
+
+RDEPEND=">=dev-libs/libgpg-error-1.33"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	sys-devel/bison
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.6.0-no-fgrep-ksba-config.patch
+)
+
+src_prepare() {
+	default
+
+	elibtoolize  # necessary on Solaris for shared lib support
+}
+
+my_src_configure() {
+	export CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+	local myeconfargs=(
+		--disable-valgrind-tests
+		$(use_enable static-libs static)
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+		LIBGCRYPT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-libgcrypt-config"
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+my_src_install() {
+	default
+
+	# People need to use ksba-config for --cflags and --libs
+	find "${ED}" -type f -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-libs/libuv/Manifest

@@ -1,3 +1,4 @@
 DIST libuv-1.44.2.tar.gz 1309062 BLAKE2B 883a1fbffcd8f55bf28ea5a79ed18aa3e2f2fac126285e8aca2ef9370eafc62f69f95ddb8bf27d4159e038bfb0a01abafdf0dadbc4309e5d31f0e77057ee84ac SHA512 d21c890787b0b364fafa5fc0cbbff296bc2ca269e1991d2f7f35fcb37b8634da377466f5af5a4245425fcf876ae6870d100ab32b12bce64f8e0b01fd25a1bc83
 DIST libuv-1.45.0.tar.gz 1307245 BLAKE2B fcd9aad052cf641e5e974b1e3c47bef7968474f4b0e38363559719a164867ce6e67630c1d0fd0386da22ba5b82e35c6ca946b7509a8a08f08f972388e70a40b9 SHA512 a156dd0ed06bc7c50515f46ef6e5636d870288636f442ce9ec46716e22fdaa664ce49e432f4737c81e9c6013b34ed150e7420ab9fc316ed23281096954359774
 DIST libuv-1.46.0.tar.gz 1311065 BLAKE2B fd492b6ca873a08ad4df7561b9d83a09d9bd2cbc10c17265c02982a231edb5c6d71698aecc9a14d455ea230f9e791807f42561d8b3c96e37edb4a709860859b0 SHA512 e3a7c10ffd909f9b128fb2316e09b8456e87278107178b49368f31ba30e7f62d64e7eba650cc59ef2d7eb178199c7a2c5b5c99b333849200492235116d7aee7a
+DIST libuv-1.47.0.tar.gz 1316016 BLAKE2B 6c530f8625366a9bf3f99ac4eb6b3bf3d4f6a05f98848e08cdab884934d79862cf8e79dd2d506ec734d701faab517eba2215063dce4b4216add5cfd6bfebd82e SHA512 3d0e76c4e29c5de14fddda07409f8db30dc64261d1c0bdfce7f70eb8f5ac911707fe662e81c4f117e4068cb0728158fc2b8255f8aa497c0f688e46c7fb93a5b3

sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-hppa-kernel.patch

@@ -0,0 +1,32 @@
+https://github.com/libuv/libuv/commit/f1444293652cf5478a67b9305271d73ad6d36232
+
+From f1444293652cf5478a67b9305271d73ad6d36232 Mon Sep 17 00:00:00 2001
+From: matoro <12038583+matoro@users.noreply.github.com>
+Date: Wed, 15 Nov 2023 17:57:06 -0500
+Subject: [PATCH] linux: disable io_uring on hppa below kernel 6.1.51 (#4224)
+
+First kernel with support is 6.1, was only fully functional from .51
+onwards: https://lore.kernel.org/all/cb912694-b1fe-dbb0-4d8c-d608f3526905@gmx.de/
+
+Co-authored-by: matoro <matoro@users.noreply.github.com>
+--- a/src/unix/linux.c
++++ b/src/unix/linux.c
+@@ -487,8 +487,16 @@ static int uv__use_io_uring(void) {
+   use = atomic_load_explicit(&use_io_uring, memory_order_relaxed);
+ 
+   if (use == 0) {
++    use = uv__kernel_version() >=
++#if defined(__hppa__)
++    /* io_uring first supported on parisc in 6.1, functional in .51 */
++    /* https://lore.kernel.org/all/cb912694-b1fe-dbb0-4d8c-d608f3526905@gmx.de/ */
++    /* 6.1.51 */ 0x060133
++#else
+     /* Older kernels have a bug where the sqpoll thread uses 100% CPU. */
+-    use = uv__kernel_version() >= /* 5.10.186 */ 0x050ABA ? 1 : -1;
++    /* 5.10.186 */ 0x050ABA
++#endif
++    ? 1 : -1;
+ 
+     /* But users can still enable it if they so desire. */
+     val = getenv("UV_USE_IO_URING");
+

sdk_container/src/third_party/portage-stable/dev-libs/libuv/files/libuv-1.47.0-ipv6-tests.patch

@@ -0,0 +1,54 @@
+https://github.com/libuv/libuv/issues/4211
+https://github.com/libuv/libuv/pull/4220
+https://github.com/libuv/libuv/commit/54d8364c2406758b572621af381f1d83e01ae46c
+
+From 54d8364c2406758b572621af381f1d83e01ae46c Mon Sep 17 00:00:00 2001
+From: Ben Noordhuis <info@bnoordhuis.nl>
+Date: Tue, 14 Nov 2023 22:09:30 +0100
+Subject: [PATCH] test: check if ipv6 link-local traffic is routable (#4220)
+
+Fixes: https://github.com/libuv/libuv/issues/4211
+--- a/test/test-tcp-connect6-error.c
++++ b/test/test-tcp-connect6-error.c
+@@ -23,6 +23,7 @@
+ #include "task.h"
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <string.h>
+ 
+ 
+ static int connect_cb_called = 0;
+@@ -75,9 +76,13 @@ TEST_IMPL(tcp_connect6_error_fault) {
+ 
+ 
+ TEST_IMPL(tcp_connect6_link_local) {
++  uv_interface_address_t* ifs;
++  uv_interface_address_t* p;
+   struct sockaddr_in6 addr;
+   uv_connect_t req;
+   uv_tcp_t server;
++  int ok;
++  int n;
+ 
+   if (!can_ipv6())
+     RETURN_SKIP("IPv6 not supported");
+@@ -90,6 +95,18 @@ TEST_IMPL(tcp_connect6_link_local) {
+   RETURN_SKIP("Test does not currently work in QEMU");
+ #endif  /* defined(__QEMU__) */
+ 
++  /* Check there's an interface that routes link-local (fe80::/10) traffic. */
++  ASSERT_OK(uv_interface_addresses(&ifs, &n));
++  for (p = ifs; p < &ifs[n]; p++)
++    if (p->address.address6.sin6_family == AF_INET6)
++      if (!memcmp(&p->address.address6.sin6_addr, "\xfe\x80", 2))
++        break;
++  ok = (p < &ifs[n]);
++  uv_free_interface_addresses(ifs, n);
++
++  if (!ok)
++    RETURN_SKIP("IPv6 link-local traffic not supported");
++
+   ASSERT_OK(uv_ip6_addr("fe80::0bad:babe", 1337, &addr));
+   ASSERT_OK(uv_tcp_init(uv_default_loop(), &server));
+ 
+

sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.45.0.ebuild

@@ -13,7 +13,7 @@ if [[ ${PV} = 9999* ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 -hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD BSD-2 ISC MIT"

sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.46.0.ebuild

@@ -13,7 +13,7 @@ if [[ ${PV} = 9999* ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 -hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD BSD-2 ISC MIT"

sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-1.47.0-r1.ebuild

@@ -0,0 +1,58 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Cross-platform asychronous I/O"
+HOMEPAGE="https://github.com/libuv/libuv"
+
+if [[ ${PV} = 9999* ]]; then
+	EGIT_REPO_URI="https://github.com/libuv/libuv.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="BSD BSD-2 ISC MIT"
+SLOT="0/1"
+
+BDEPEND="
+	sys-devel/libtool
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-ipv6-tests.patch
+	"${FILESDIR}"/${P}-hppa-kernel.patch
+)
+
+src_prepare() {
+	default
+
+	echo "m4_define([UV_EXTRA_AUTOMAKE_FLAGS], [serial-tests])" \
+		> m4/libuv-extra-automake-flags.m4 || die
+
+	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
+		eapply "${FILESDIR}"/${PN}-1.41.0-darwin.patch
+	fi
+
+	# Upstream fails to ship a configure script
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		cc_cv_cflags__g=no
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-libs/libuv/libuv-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ if [[ ${PV} = 9999* ]]; then
 	inherit git-r3
 else
 	SRC_URI="https://github.com/libuv/libuv/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 LICENSE="BSD BSD-2 ISC MIT"

sdk_container/src/third_party/portage-stable/dev-libs/libxml2/Manifest

@@ -1,6 +1,8 @@
 DIST libxml2-2.10.4.tar.xz 2643600 BLAKE2B 5bbb63c6e58accf434513aeb974fed7349e5458de642ef89db77768c8d1383532614254e0e3f1d9471e2274c6b81a04a0a3afcb602707ce79550c2bd8e9028d9 SHA512 792c1dceb098cd353a7eca4c46d31cce6310b2553d97fd3918cf0b94d93b2480759202036511bde36c24166236bd4616f57e79959eea9afe3f60614bdfe13094
 DIST libxml2-2.11.4.tar.xz 2626756 BLAKE2B 5d7e6388291a8473195131f5cb22aee9a4182f28fd8eed468c449b762d363cfb1713a7466c1f98e96cf819ed8f78e13a6ba930c2fadd8d63869b6efe8e8be8a8 SHA512 c1df7441c729430bdd2de52e9da69b171afc4b776e4a2eb43acbc71ada7a3814a465247fb5fca4c83ecf1c281f7745069ec3d051a7964cb7cc119a3d983f93ba
 DIST libxml2-2.11.5.tar.xz 2628132 BLAKE2B 4af53ef7c19cfcddcf3de5c694a1b03cf4212f8e4c4cb3d873a897fddd8a89d7a52d049a8b85e96c6cdb471689aa385512d87b9710074e90583bf7ad46319172 SHA512 8f087cdaf61957567f04280facc70211c09ca131a532fd13ed4bfc38ddec50e44b1f842b108e635bd4205232036a3e1097904ac016f1fd135bacd17aebb04272
+DIST libxml2-2.11.6.tar.xz 2628652 BLAKE2B 0a1776ca44b21143c538665b6cf7a50962bb1bda6c85f45e4fd4fb7c36ecb4d592d1f5a8d38015bac06a3acb6f7adb1d4afa10fe95987197509f4c1f45b15962 SHA512 43d244450b494c7dbd3521287b87cba0c11267be8d7940a1ecd49dbf0ebefdd052c4c3472c3f267b0d8c431d9b5b964b05067af9e38bc4b0e4f46bc0445b6201
+DIST libxml2-2.12.1.tar.xz 2637392 BLAKE2B 86ca96c35388386d4e6433e4c452bdca46d9267a9370117c5f5d8826de79a01b09a6a9184e27e805f657ac06aba106ee118c5aff3bcdef9231d01d1569c5fd9e SHA512 84ade06df7d170b777cfe701389444176a02714b1d8f1916d022ef6cf7cf85822571989608dcecc470c2eec044a65dd971562a95921ddb1668736295a5be2806
 DIST xmlts20130923.tar.gz 641522 BLAKE2B 63a47bc69278ef510cd0b3779aed729e1b309e30efa0015d28ed051cc03f9dfddb447ab57b07b3393e8f47393d15473b0e199c34cb1f5f746b15ddfaa55670be SHA512 d5c4d26b324ed21f4e0641cd7f8b76dbf9de80df8b519982e44d41c960df29fd03618e02e9693b2d11ad06d19c4a965274c95a048ec3b9653eacb919a7f8b733
 DIST xsts-2002-01-16.tar.gz 6894439 BLAKE2B 1e9ec63d2c104655e64249e07440a04d862fcbcd4d4e19745d81b34994319b510a531c9d6df1491fae1e90b5d0764f0f1a827251ca8df5d613178b0eab01ef25 SHA512 43300af6d39c1e2221b0ed7318fe14c7464eeb6eb030ed1e22eb29b4ab17f014e2a4c8887c3a46ae5d243e3072da27f00f4e285498ae6f1288177d38d1108288
 DIST xsts-2004-01-14.tar.gz 2761085 BLAKE2B 41545995fb3a65d053257c376c07d45ffd1041a433bfbdb46d4dd87a5afb60c18c8629a3d988323f9e7a1d709775b5a7e5930276a7121c0725a22705c0976e36 SHA512 32854388d7e720ad67156baf50bf2bae7bd878ca3e35fd7e44e57cad3f434f69d56bbbedd61509f8a1faf01c9eae74a078df8fe130780b182c05c05cb1c39ebe

sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.11.6.ebuild

@@ -0,0 +1,200 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Note: Please bump in sync with dev-libs/libxslt
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="xml(+)"
+inherit flag-o-matic python-r1 multilib-minimal
+
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
+XSTS_NAME_1="xmlschema2002-01-16"
+XSTS_NAME_2="xmlschema2004-01-14"
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
+XMLCONF_TARBALL="xmlts20130923.tar.gz"
+
+DESCRIPTION="XML C parser and toolkit"
+HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
+	inherit autotools git-r3
+else
+	inherit gnome.org libtool
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+SRC_URI+="
+	test? (
+		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
+		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
+		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
+	)
+"
+S="${WORKDIR}/${PN}-${PV%_rc*}"
+
+LICENSE="MIT"
+SLOT="2"
+IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="
+	virtual/libiconv
+	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
+	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+if [[ ${PV} == 9999 ]] ; then
+	BDEPEND+=" dev-util/gtk-doc-am"
+fi
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/xml2-config
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.11.5-CVE-2023-45322.patch
+)
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		local tarname=${P/_rc/-rc}.tar.xz
+
+		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
+		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
+		unpack ${tarname}
+
+		if [[ -n ${PATCHSET_VERSION} ]] ; then
+			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
+		fi
+	fi
+
+	cd "${S}" || die
+
+	if use test ; then
+		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
+			"${DISTDIR}/${XSTS_TARBALL_2}" \
+			"${S}"/xstc/ \
+			|| die "Failed to install test tarballs"
+		unpack ${XMLCONF_TARBALL}
+	fi
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		# Please do not remove, as else we get references to PORTAGE_TMPDIR
+		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	# Filter seemingly problematic CFLAGS (bug #26320)
+	filter-flags -fprefetch-loop-arrays -funroll-loops
+
+	# Notes:
+	# The meaning of the 'debug' USE flag does not apply to the --with-debug
+	# switch (enabling the libxml2 debug module). See bug #100898.
+	libxml2_configure() {
+		ECONF_SOURCE="${S}" econf \
+			--enable-ipv6 \
+			$(use_with ftp) \
+			$(use_with debug run-debug) \
+			$(use_with icu) \
+			$(use_with lzma) \
+			$(use_enable static-libs static) \
+			$(multilib_native_use_with readline) \
+			$(multilib_native_use_with readline history) \
+			"$@"
+	}
+
+	# Build python bindings separately
+	libxml2_configure --without-python
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+}
+
+libxml2_py_emake() {
+	pushd "${BUILD_DIR}"/python >/dev/null || die
+
+	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+
+	popd >/dev/null || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		NATIVE_BUILD_DIR="${BUILD_DIR}"
+		python_foreach_impl run_in_build_dir libxml2_py_emake all
+	fi
+}
+
+multilib_src_test() {
+	ln -s "${S}"/xmlconf || die
+
+	emake check
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_py_emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
+
+	# Hack until automake release is made for the optimise fix
+	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
+	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use examples ; then
+		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
+		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+	fi
+
+	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
+	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
+	if [[ -n "${ROOT}" ]]; then
+		elog "Skipping XML catalog creation for stage building (bug #208887)."
+	else
+		# Need an XML catalog, so no-one writes to a non-existent one
+		CATALOG="${EROOT}/etc/xml/catalog"
+
+		# We don't want to clobber an existing catalog though,
+		# only ensure that one is there
+		# <obz@gentoo.org>
+		if [[ ! -e "${CATALOG}" ]]; then
+			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
+			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
+			einfo "Created XML catalog in ${CATALOG}"
+		fi
+	fi
+}

sdk_container/src/third_party/portage-stable/dev-libs/libxml2/libxml2-2.12.1.ebuild

@@ -0,0 +1,196 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Note: Please bump in sync with dev-libs/libxslt
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="xml(+)"
+inherit flag-o-matic python-r1 multilib-minimal
+
+XSTS_HOME="http://www.w3.org/XML/2004/xml-schema-test-suite"
+XSTS_NAME_1="xmlschema2002-01-16"
+XSTS_NAME_2="xmlschema2004-01-14"
+XSTS_TARBALL_1="xsts-2002-01-16.tar.gz"
+XSTS_TARBALL_2="xsts-2004-01-14.tar.gz"
+XMLCONF_TARBALL="xmlts20130923.tar.gz"
+
+DESCRIPTION="XML C parser and toolkit"
+HOMEPAGE="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxml2"
+	inherit autotools git-r3
+else
+	inherit gnome.org libtool
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+SRC_URI+="
+	test? (
+		${XSTS_HOME}/${XSTS_NAME_1}/${XSTS_TARBALL_1}
+		${XSTS_HOME}/${XSTS_NAME_2}/${XSTS_TARBALL_2}
+		https://www.w3.org/XML/Test/${XMLCONF_TARBALL}
+	)
+"
+S="${WORKDIR}/${PN}-${PV%_rc*}"
+
+LICENSE="MIT"
+SLOT="2"
+IUSE="debug examples +ftp icu lzma +python readline static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="
+	virtual/libiconv
+	>=sys-libs/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}]
+	icu? ( >=dev-libs/icu-51.2-r1:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.0.5-r1:=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+	readline? ( sys-libs/readline:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+if [[ ${PV} == 9999 ]] ; then
+	BDEPEND+=" dev-util/gtk-doc-am"
+fi
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/xml2-config
+)
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		local tarname=${P/_rc/-rc}.tar.xz
+
+		# ${A} isn't used to avoid unpacking of test tarballs into ${WORKDIR},
+		# as they are needed as tarballs in ${S}/xstc instead and not unpacked
+		unpack ${tarname}
+
+		if [[ -n ${PATCHSET_VERSION} ]] ; then
+			unpack ${PN}-${PATCHSET_VERSION}.tar.xz
+		fi
+	fi
+
+	cd "${S}" || die
+
+	if use test ; then
+		cp "${DISTDIR}/${XSTS_TARBALL_1}" \
+			"${DISTDIR}/${XSTS_TARBALL_2}" \
+			"${S}"/xstc/ \
+			|| die "Failed to install test tarballs"
+		unpack ${XMLCONF_TARBALL}
+	fi
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		# Please do not remove, as else we get references to PORTAGE_TMPDIR
+		# in /usr/lib/python?.?/site-packages/libxml2mod.la among things.
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	# Filter seemingly problematic CFLAGS (bug #26320)
+	filter-flags -fprefetch-loop-arrays -funroll-loops
+
+	# Notes:
+	# The meaning of the 'debug' USE flag does not apply to the --with-debug
+	# switch (enabling the libxml2 debug module). See bug #100898.
+	libxml2_configure() {
+		ECONF_SOURCE="${S}" econf \
+			--enable-ipv6 \
+			$(use_with ftp) \
+			$(use_with debug run-debug) \
+			$(use_with icu) \
+			$(use_with lzma) \
+			$(use_enable static-libs static) \
+			$(multilib_native_use_with readline) \
+			$(multilib_native_use_with readline history) \
+			"$@"
+	}
+
+	# Build python bindings separately
+	libxml2_configure --without-python
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_configure --with-python
+}
+
+libxml2_py_emake() {
+	pushd "${BUILD_DIR}"/python >/dev/null || die
+
+	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+
+	popd >/dev/null || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		NATIVE_BUILD_DIR="${BUILD_DIR}"
+		python_foreach_impl run_in_build_dir libxml2_py_emake all
+	fi
+}
+
+multilib_src_test() {
+	ln -s "${S}"/xmlconf || die
+
+	emake check
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_py_emake check
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	multilib_is_native_abi && use python &&
+		python_foreach_impl run_in_build_dir libxml2_py_emake DESTDIR="${D}" install
+
+	# Hack until automake release is made for the optimise fix
+	# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
+	multilib_is_native_abi && use python && python_foreach_impl python_optimize
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use examples ; then
+		rm -rf "${ED}"/usr/share/doc/${PF}/examples || die
+		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+	fi
+
+	rm -rf "${ED}"/usr/share/doc/${PN}-python-${PVR} || die
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	# We don't want to do the xmlcatalog during stage1, as xmlcatalog will not
+	# be in / and stage1 builds to ROOT=/tmp/stage1root. This fixes bug #208887.
+	if [[ -n "${ROOT}" ]]; then
+		elog "Skipping XML catalog creation for stage building (bug #208887)."
+	else
+		# Need an XML catalog, so no-one writes to a non-existent one
+		CATALOG="${EROOT}/etc/xml/catalog"
+
+		# We don't want to clobber an existing catalog though,
+		# only ensure that one is there
+		# <obz@gentoo.org>
+		if [[ ! -e "${CATALOG}" ]]; then
+			[[ -d "${EROOT}/etc/xml" ]] || mkdir -p "${EROOT}/etc/xml"
+			"${EPREFIX}"/usr/bin/xmlcatalog --create > "${CATALOG}"
+			einfo "Created XML catalog in ${CATALOG}"
+		fi
+	fi
+}

sdk_container/src/third_party/portage-stable/dev-libs/libxslt/Manifest

@@ -1,2 +1,3 @@
 DIST libxslt-1.1.37.tar.xz 1588572 BLAKE2B 096d93dd7178bf4483207514b1435f5bf426eea4952ffab7cc00c3e85aa736534c4acb5377af9647aa77a0cd793205194509d997a7bb5cae692f65e326566cd8 SHA512 a4e477d2bb918b7d01945e2c7491c3a4aae799dc1602bbd13de55c8a5052e210a20bc45115347eae44473c8b1d03dbc5e4a2aa18c2218f1fdfd376d87cd501ca
 DIST libxslt-1.1.38.tar.xz 1576676 BLAKE2B 9397be8b223bd68b326b954fe6a749a269e969b4669747678715728f553916c23475232fc2894a5e4230e15b031981423adeb8f83407f4db8075a784c7e6a55b SHA512 2836bd2990b95680db0960ac4c465d0c6c28a293ad095a224c05021a1c8d2576a45e41da8947a31f4ef3e6ef368cbda65243661e311c9886c19694be5a7c9a8e
+DIST libxslt-1.1.39.tar.xz 1578216 BLAKE2B 7c87b769d345fc99a966bea6b4e94533fa211dc3a987ce013a03eefb05dde73ef75526bdecf7d32d8c77112232096fb22d8ec4f0a781b9f59d0422a2db75df01 SHA512 c0c99dc63f8b2acb6cc3ad7ad684ffa2a427ee8d1740495cbf8a7c9b9c8679f96351b4b676c73ccc191014db4cb4ab42b9a0070f6295565f39dbc665c5c16f89

sdk_container/src/third_party/portage-stable/dev-libs/libxslt/libxslt-1.1.39.ebuild

@@ -0,0 +1,125 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Note: Please bump this in sync with dev-libs/libxml2.
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit flag-o-matic python-r1 multilib-minimal
+
+DESCRIPTION="XSLT libraries and tools"
+HOMEPAGE="https://gitlab.gnome.org/GNOME/libxslt"
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.gnome.org/GNOME/libxslt"
+	inherit autotools git-r3
+else
+	inherit libtool gnome.org
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE="crypt debug examples python static-libs"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+BDEPEND=">=virtual/pkgconfig-1"
+RDEPEND="
+	>=dev-libs/libxml2-2.9.11:2[${MULTILIB_USEDEP}]
+	crypt? ( >=dev-libs/libgcrypt-1.5.3:0=[${MULTILIB_USEDEP}] )
+	python? ( ${PYTHON_DEPS} )
+"
+DEPEND="${RDEPEND}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/xslt-config
+)
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/libxslt/xsltconfig.h
+)
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	else
+		# Prefix always needs elibtoolize if not eautoreconf'd.
+		elibtoolize
+	fi
+}
+
+multilib_src_configure() {
+	# Remove this after upstream merge request to add AC_SYS_LARGEFILE lands:
+	# https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/55
+	append-lfs-flags
+
+	libxslt_configure() {
+		ECONF_SOURCE="${S}" econf \
+			--without-python \
+			$(use_with crypt crypto) \
+			$(use_with debug) \
+			$(use_with debug mem-debug) \
+			$(use_enable static-libs static) \
+			"$@"
+	}
+
+	# Build Python bindings separately
+	libxslt_configure --without-python
+
+	if multilib_is_native_abi && use python ; then
+		NATIVE_BUILD_DIR="${BUILD_DIR}"
+		python_foreach_impl run_in_build_dir libxslt_configure --with-python
+	fi
+}
+
+libxslt_py_emake() {
+	pushd "${BUILD_DIR}"/python >/dev/null || die
+
+	emake top_builddir="${NATIVE_BUILD_DIR}" "$@"
+
+	popd >/dev/null || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake all
+	fi
+}
+
+multilib_src_test() {
+	default
+
+	if multilib_is_native_abi && use python ; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake check
+	fi
+}
+
+multilib_src_install() {
+	# "default" does not work here - docs are installed by multilib_src_install_all
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi && use python; then
+		python_foreach_impl run_in_build_dir libxslt_py_emake \
+			DESTDIR="${D}" \
+			install
+
+		# Hack until automake release is made for the optimise fix
+		# https://git.savannah.gnu.org/cgit/automake.git/commit/?id=bde43d0481ff540418271ac37012a574a4fcf097
+		python_foreach_impl python_optimize
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+
+	if ! use examples ; then
+		rm -rf "${ED}"/usr/share/doc/${PF}/tutorial{,2} || die
+		rm -rf "${ED}"/usr/share/doc/${PF}/python/examples || die
+	fi
+
+	find "${ED}" -type f -name "*.la" -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.8.1.ebuild

@@ -7,7 +7,7 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nettle.asc
 inherit multilib-build multilib-minimal toolchain-funcs verify-sig
 
 DESCRIPTION="Low-level cryptographic library"
-HOMEPAGE="http://www.lysator.liu.se/~nisse/nettle/"
+HOMEPAGE="https://www.lysator.liu.se/~nisse/nettle/ https://git.lysator.liu.se/nettle/nettle"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
 SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 

sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.1.ebuild

@@ -7,7 +7,7 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nettle.asc
 inherit multilib-build multilib-minimal toolchain-funcs verify-sig
 
 DESCRIPTION="Low-level cryptographic library"
-HOMEPAGE="http://www.lysator.liu.se/~nisse/nettle/"
+HOMEPAGE="https://www.lysator.liu.se/~nisse/nettle/ https://git.lysator.liu.se/nettle/nettle"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
 SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 

sdk_container/src/third_party/portage-stable/dev-libs/nettle/nettle-3.9.ebuild

@@ -7,7 +7,7 @@ VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/nettle.asc
 inherit multilib-build multilib-minimal toolchain-funcs verify-sig
 
 DESCRIPTION="Low-level cryptographic library"
-HOMEPAGE="http://www.lysator.liu.se/~nisse/nettle/"
+HOMEPAGE="https://www.lysator.liu.se/~nisse/nettle/ https://git.lysator.liu.se/nettle/nettle"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.gz"
 SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 

sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/Manifest

@@ -1 +1,2 @@
 DIST onig-6.9.8.tar.gz 944148 BLAKE2B ee7d91f2d3a7a41d675bcbb9d18490aa3e5a9edb8f3c6e880d27f2218c476499bba21088def41fbb5d500bfb2916af85c2489fca5bd846594fab53ac492531af SHA512 5a3d220961c22cda981bbae06dc383401771362cdf67e4f0b5d2fa8951a03907362edae498f63226287e70715c0abe4acdd22ec3ceb74bbb226234a52c36a4d7
+DIST onig-6.9.9.tar.gz 957444 BLAKE2B d31f4caf5e14477ec1fd40ab764137b49046ac759f487432a129ebdf6da89b128218bb14b08f9359ac0b87286bcd309faa3878b26528926aab6f7d2e25e722b0 SHA512 14d2afd0d2cf86012c9959f221e9a77e7787e709c9dd7295d159e0a9ba89df52fa3edc59f95a6d859c34181e2e2e53e21b932b3eceb4d6ddeb2a3445ef951e95

sdk_container/src/third_party/portage-stable/dev-libs/oniguruma/oniguruma-6.9.9.ebuild

@@ -0,0 +1,55 @@
+# Copyright 2003-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit multilib-minimal
+
+if [[ "${PV}" == "9999" ]]; then
+	inherit autotools git-r3
+
+	EGIT_REPO_URI="https://github.com/kkos/oniguruma"
+fi
+
+DESCRIPTION="Regular expression library for different character encodings"
+HOMEPAGE="https://github.com/kkos/oniguruma"
+if [[ "${PV}" == "9999" ]]; then
+	SRC_URI=""
+else
+	SRC_URI="https://github.com/kkos/${PN}/releases/download/v${PV}/onig-${PV}.tar.gz"
+fi
+
+LICENSE="BSD-2"
+SLOT="0/5"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="crnl-as-line-terminator static-libs"
+
+BDEPEND=""
+DEPEND=""
+RDEPEND=""
+
+if [[ "${PV}" != "9999" ]]; then
+	S="${WORKDIR}/onig-${PV}"
+fi
+
+DOCS=(AUTHORS HISTORY README{,_japanese} doc/{API,CALLOUTS.API,CALLOUTS.BUILTIN,FAQ,RE}{,.ja} doc/{SYNTAX.md,UNICODE_PROPERTIES})
+
+src_prepare() {
+	default
+
+	if [[ "${PV}" == "9999" ]]; then
+		eautoreconf
+	fi
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE="${S}" econf \
+		--enable-posix-api \
+		$(use_enable crnl-as-line-terminator) \
+		$(use_enable static-libs static)
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/Manifest

@@ -1,3 +1,4 @@
 DIST xmlsec1-1.2.37.tar.gz 2009175 BLAKE2B 19f43ba6bf6eb49428b9c5563baecbab21476f326cceee13785ae16769afa258f100732831c0f3f7d160543bd075cdcfdc5cbf11b7406637ee6c2f0e27c07f30 SHA512 99220cb28a346ffac0023f9f177d6a7be3ddcea04bea434b7dc926c1f0aaa5564d75f74f92896ac100179c04d77e001f688ddf46fed4e0a0b4f20b7b87c24900
 DIST xmlsec1-1.2.38.tar.gz 2036578 BLAKE2B 03f7e1b5e659793bf1984c5a59582d9459089ce913620d5cc1e5a5d0eb65557580cd23fa190db277298fd7cc55bd41563b93cf61a37c8b7521a4690cd2ca3489 SHA512 724089777caae95db27e67f24381c066eaae23a9d64819a18bb04837c1ab1b380d19be2c7ee25659ca481d9eab96fcbe8027a430a0ac1630ad3b073cddd20fac
 DIST xmlsec1-1.3.1.tar.gz 2432943 BLAKE2B 1dafdffd959579add5c579e3fa9c9f9ddc73ce4aadc6fc2139506e6e64ffcd1bbe7298786e414900eb9f33f93b0a47da64e686c499e48d4c80d81b256db6692e SHA512 7f30c15c3edcafe70fa5febaa0ba39f73f8d30525ee102b5961a658dd2842fbc58e63f7595f15b150d71bf735bfa7688c3694a191b0d475776ca26902d90d25f
+DIST xmlsec1-1.3.2.tar.gz 2437263 BLAKE2B d11953c6e2a263a6742ef62309c2f29e2ba5761d58bee5f8cc761965d0e16fea148811ac3d8036d271400840a62ff2a7fff947bb5331170d3bcc598c558b2a95 SHA512 328f3d27cc1dadee27e5ee4649f6c5a094203cc27f42f1fe98fd429f7dd5630eaadff0e8bf14616016fc3530482ed8bcee4870289a41a083f6dd9bd603782a92

sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/files/xmlsec-1.3.2-libxml2-2.12.0-includes.patch

@@ -0,0 +1,114 @@
+https://github.com/lsh123/xmlsec/commit/ffb327376f5bb69e8dfe7f805529e45a40118c2b
+
+From ffb327376f5bb69e8dfe7f805529e45a40118c2b Mon Sep 17 00:00:00 2001
+From: lsh123 <aleksey@aleksey.com>
+Date: Mon, 20 Nov 2023 11:50:43 -0500
+Subject: [PATCH] Fix libxml2 v2.12.0 includes  (#729)
+
+--- a/apps/crypto.c
++++ b/apps/crypto.c
+@@ -12,6 +12,7 @@
+ #endif
+ 
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #include <xmlsec/xmlsec.h>
+ #include <xmlsec/keys.h>
+--- a/apps/xmlsec.c
++++ b/apps/xmlsec.c
+@@ -22,6 +22,7 @@
+ #include <libxml/xmlmemory.h>
+ #include <libxml/parser.h>
+ #include <libxml/xpath.h>
++#include <libxml/xmlsave.h>
+ #include <libxml/xpathInternals.h>
+ 
+ #ifndef XMLSEC_NO_XSLT
+@@ -3030,7 +3031,7 @@ xmlSecAppInit(void) {
+     /* Init libxml */
+     xmlInitParser();
+     LIBXML_TEST_VERSION
+-    xmlTreeIndentString = "\t";
++    xmlThrDefTreeIndentString("\t");
+ #ifndef XMLSEC_NO_XSLT
+     xmlIndentTreeOutput = 1;
+ #endif /* XMLSEC_NO_XSLT */
+--- a/include/xmlsec/xmlsec.h
++++ b/include/xmlsec/xmlsec.h
+@@ -12,6 +12,7 @@
+ #define __XMLSEC_H__
+ 
+ #include <libxml/tree.h>
++#include <libxml/parser.h>
+ 
+ #include <xmlsec/version.h>
+ #include <xmlsec/exports.h>
+--- a/src/errors_helpers.h
++++ b/src/errors_helpers.h
+@@ -136,7 +136,7 @@ extern "C" {
+  */
+ #define xmlSecXmlError(errorFunction, errorObject) \
+     {                                                 \
+-        xmlErrorPtr error = xmlGetLastError();        \
++        const xmlError * error = xmlGetLastError();        \
+         int code = (error != NULL) ? error->code : 0; \
+         const char* message = (error != NULL) ? error->message : NULL; \
+         xmlSecError(XMLSEC_ERRORS_HERE,               \
+@@ -159,7 +159,7 @@ extern "C" {
+  */
+ #define xmlSecXmlError2(errorFunction, errorObject, msg, param) \
+     {                                                 \
+-        xmlErrorPtr error = xmlGetLastError();        \
++        const xmlError * error = xmlGetLastError();        \
+         int code = (error != NULL) ? error->code : 0; \
+         const char* message = (error != NULL) ? error->message : NULL; \
+         xmlSecError(XMLSEC_ERRORS_HERE,               \
+@@ -181,7 +181,7 @@ extern "C" {
+  */
+ #define xmlSecXmlParserError(errorFunction, ctxt, errorObject) \
+     {                                                 \
+-        xmlErrorPtr error = xmlCtxtGetLastError(ctxt);\
++        const xmlError * error = xmlCtxtGetLastError(ctxt);\
+         int code = (error != NULL) ? error->code : 0; \
+         const char* message = (error != NULL) ? error->message : NULL; \
+         xmlSecError(XMLSEC_ERRORS_HERE,               \
+@@ -205,7 +205,7 @@ extern "C" {
+  */
+ #define xmlSecXmlParserError2(errorFunction, ctxt, errorObject, msg, param) \
+     {                                                 \
+-        xmlErrorPtr error = xmlCtxtGetLastError(ctxt);\
++        const xmlError * error = xmlCtxtGetLastError(ctxt);\
+         int code = (error != NULL) ? error->code : 0; \
+         const char* message = (error != NULL) ? error->message : NULL; \
+         xmlSecError(XMLSEC_ERRORS_HERE,               \
+@@ -227,7 +227,7 @@ extern "C" {
+  */
+ #define xmlSecXsltError(errorFunction, ctxt, errorObject) \
+     {                                                 \
+-        xmlErrorPtr error = xmlGetLastError();        \
++        const xmlError * error = xmlGetLastError();        \
+         int code = (error != NULL) ? error->code : 0; \
+         const char* message = (error != NULL) ? error->message : NULL; \
+         xmlSecError(XMLSEC_ERRORS_HERE,               \
+--- a/src/mscrypto/certkeys.c
++++ b/src/mscrypto/certkeys.c
+@@ -18,6 +18,7 @@
+ #include "globals.h"
+ 
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #ifndef XMLSEC_NO_GOST
+ #include "csp_oid.h"
+--- a/src/mscrypto/signatures.c
++++ b/src/mscrypto/signatures.c
+@@ -17,6 +17,7 @@
+ #include "globals.h"
+ 
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #ifndef XMLSEC_NO_GOST
+ #include "csp_calg.h"
+

sdk_container/src/third_party/portage-stable/dev-libs/xmlsec/xmlsec-1.3.2.ebuild

@@ -0,0 +1,94 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Command line tool for signing, verifying, encrypting and decrypting XML"
+HOMEPAGE="https://www.aleksey.com/xmlsec"
+SRC_URI="https://www.aleksey.com/xmlsec/download/${PN}1-${PV}.tar.gz"
+S="${WORKDIR}/${PN}1-${PV}"
+
+LICENSE="MIT"
+# Upstream consider major version bumps to be changes in either X or Y in X.Y.Z
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="doc gcrypt gnutls http nss +openssl static-libs test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="
+	|| ( gnutls nss openssl )
+"
+
+RDEPEND="
+	>=dev-libs/libxml2-2.7.4
+	>=dev-libs/libxslt-1.0.20
+	dev-libs/libltdl
+	gcrypt? ( >=dev-libs/libgcrypt-1.4.0:= )
+	gnutls? ( >=net-libs/gnutls-3.6.13:= )
+	nss? (
+		>=dev-libs/nspr-4.4.1
+		>=dev-libs/nss-3.9
+	)
+	openssl? ( dev-libs/openssl:= )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	virtual/pkgconfig
+	test? (
+		nss? (
+			>=dev-libs/nss-3.9[utils]
+		)
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.3.0-optimisation.patch
+	"${FILESDIR}"/${P}-libxml2-2.12.0-includes.patch
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable doc docs)
+		$(use_enable static-libs static)
+		$(use_with gcrypt)
+		$(use_with gnutls)
+		$(use_with nss nspr)
+		$(use_with nss)
+		$(use_with openssl)
+
+		--disable-werror
+		--enable-mans
+		--enable-pkgconfig
+
+		--enable-concatkdf
+		--enable-pbkdf2
+		--enable-ec
+		--enable-dh
+		--enable-sha3
+
+		--enable-files
+		$(use_enable http)
+		--disable-ftp
+	)
+
+	# Bash because of bug #721128
+	CONFIG_SHELL="${BROOT}"/bin/bash econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	# See https://github.com/lsh123/xmlsec/issues/280 for TZ=UTC
+	TZ=UTC SHELL="${BROOT}"/bin/bash emake TMPFOLDER="${T}" check
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3021.3.16-r3.ebuild

@@ -1,55 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 7 -- sys-apps/portage dep
-EAPI=7
-
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1
-
-MY_P=certifi-system-store-${PV}
-DESCRIPTION="A certifi hack to use system trust store on Linux/FreeBSD"
-HOMEPAGE="
-	https://github.com/tiran/certifi-system-store/
-	https://pypi.org/project/certifi-system-store/
-"
-SRC_URI="
-	https://github.com/tiran/certifi-system-store/archive/v${PV}.tar.gz
-		-> ${MY_P}.gh.tar.gz
-"
-S=${WORKDIR}/${MY_P}
-
-LICENSE="MPL-2.0"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	app-misc/ca-certificates
-	dev-python/setuptools[${PYTHON_USEDEP}]
-"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-use-importlib.patch
-)
-
-EPYTEST_IGNORE=(
-	# requires Internet
-	tests/test_requests.py
-)
-
-distutils_enable_tests pytest
-
-src_prepare() {
-	sed -i -e "s^/etc^${EPREFIX}/etc^" src/certifi/core.py || die
-	distutils-r1_src_prepare
-}
-
-python_compile() {
-	distutils-r1_python_compile
-	cd "${BUILD_DIR}/install$(python_get_sitedir)" || die
-	local distinfo=( certifi_system_store*.dist-info )
-	[[ -d ${distinfo} ]] || die
-	ln -v -s "${distinfo}" "${distinfo/_system_store}" || die
-}

sdk_container/src/third_party/portage-stable/dev-python/certifi/certifi-3021.3.16-r4.ebuild

@@ -23,7 +23,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
 RDEPEND="
 	app-misc/ca-certificates

sdk_container/src/third_party/portage-stable/dev-python/cython/Manifest

@@ -3,3 +3,4 @@ DIST cython-3.0.2.gh.tar.gz 2744583 BLAKE2B f631891870a6ce24acf2bcde75ebcb9775cf
 DIST cython-3.0.3.gh.tar.gz 2753188 BLAKE2B 0e6d40533f1cebf3c4217dc19aeebc2f873a8bacb94e68810e81d1c6d4cd75176de88516f2d82f43b36107656b6cd5e6990547e93bd8436b1aa93c73ccda6eaf SHA512 c27c16abaf0122ad61e0eeb92aa80a33fc491332b8ebec209cd1810d2b0e3bf14fe1e81838803b86f407520a6d6f7ab8b84d97e495e7d91fd6f7702a46980caa
 DIST cython-3.0.4.gh.tar.gz 2754689 BLAKE2B 5418b8c374565894deb07e7a3f2fe242e1ef43eed5d716cbd9c6b9fd3d62088d9982eb156c981fa9f6edcf42592f2249f9eb450d16ef908be464e357ee9bbea7 SHA512 bc87e38f9c188a5311f75f49ba4b9ec1ee0af00ff9ed655ca69972891f8b0801025265f8cad4521670088275c7da3d6136aeda7ebb6a33554f64cc7aef362c73
 DIST cython-3.0.5.gh.tar.gz 2756583 BLAKE2B d9b5af97933030fc1ac49677a5f3fd8194ba6e685dccd257f4ef4af206565ae2fa6f72c1268d8d0604b6fd6f2d8147c542501e8e319588bfdc4a7f40622976ff SHA512 585d3fe810ace55278fcc6ea4508b3b5259320f92998cd688da787cd5f88ac5fc2467025f20da6d968969eb3296ae9c517136d24a4dbb475441271227968f6be
+DIST cython-3.0.6.gh.tar.gz 2759853 BLAKE2B fdcbb870418eebfb2e55e28f7223699fee4fb06d52f9f41db55b30fbe6ba6ee3de42af9bbdd8930d418ec790dec195546486ea45c370e2df122d6fada08d38cf SHA512 f1d33775166d0b6541ea98bee5d4186fc6128aad788323224397c1f3ba0a058141ac84a8b3baa4885204dcbf0979141bc4b5316342003e96208952f040f31753

sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.5.ebuild

@@ -26,7 +26,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 

sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.6.ebuild

@@ -0,0 +1,84 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{10..12} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" pypy3 )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing toolchain-funcs
+
+MY_P=${P/_rc/rc}
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+SRC_URI="
+	https://github.com/cython/cython/archive/${PV/_rc/rc}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/numpy[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-test_exceptions-py310.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	# https://github.com/cython/cython/issues/1911
+	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}

sdk_container/src/third_party/portage-stable/dev-python/lxml/Manifest

@@ -1,3 +1,2 @@
 DIST lxml-4.9.3-patches-2.tar.xz 24288 BLAKE2B 47b7c486a1c1616c875111bd53b14d4211a1eee3f412985f4022e71b85b087abd71d36919fb025257f17de404329284898ddc639f85e8b15ade21778fa218d98 SHA512 713172b4c907db6479a0a803a842824825b212a9b645c1ca356f793658bd6c63113ea248278e7c46b512e22e3130696e9fc5127fea82a67372d920733fc160b0
-DIST lxml-4.9.3-patches.tar.xz 10544 BLAKE2B 407938d2f701400e919110c3bfe84e94621f39f8178850c466d41549ee0eff4f23e93cdd8ea684713e8276acfaa05d6f7b7af4d375c859b9fc5b2981d60983a3 SHA512 c2d5d2ffb035aed6d846de84885b87142b2be7a09ffe6927e7c032acab343730acfcbefd75e8141cf3b41b308c532869a7878b515f3d4eeefa7526a3d2599398
 DIST lxml-4.9.3.gh.tar.gz 958628 BLAKE2B ffdf3fe781a03815f7c026229d313721c93375ebafad9b4a20c5d8a380a631401e546d8701a94d8c49615fb6a71e84940d8ca0299b47a37c1c9596db36659113 SHA512 903bd4935c7708b459aee9befcf3f6e3e3aaa9adc122591ea923b6e3d8fd288f07cab3f5f0edb08e3bf9db80414324f0a1a8e5a5089f9cda82f6c50f5df59423

sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-4.9.3-tests-py3.11-cython3.patch

@@ -1,10 +0,0 @@
---- a/src/lxml/tests/test_errors.py
-+++ b/src/lxml/tests/test_errors.py
-@@ -25,6 +25,7 @@ class ErrorTestCase(HelperTestCase):
-     def test_empty_parse(self):
-         self.assertRaises(etree.XMLSyntaxError, etree.fromstring, '')
- 
-+    @unittest.skipIf(sys.version_info >= (3, 11), "Known GC failure (https://bugzilla.redhat.com/show_bug.cgi?id=2051510)")
-     @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_element_cyclic_gc_none(self):
-         # test if cyclic reference can crash etree

sdk_container/src/third_party/portage-stable/dev-python/lxml/files/lxml-4.9.3-tests-pypy.patch

@@ -1,424 +0,0 @@
-From 1804702b5e3c85c1a16014d62365a29d0a6d0c75 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Micha=C5=82=20G=C3=B3rny?= <mgorny@gentoo.org>
-Date: Thu, 30 Jan 2020 06:15:27 +0100
-Subject: [PATCH] Skip tests failing on PyPy
-
---- a/doc/element_classes.txt
-+++ b/doc/element_classes.txt
-@@ -576,10 +576,10 @@ subclasses for elements of this namespace:
- 
-   >>> print(honk_element[0].honk())
-   HONK
--  >>> print(honk_element[0].honking)
-+  >>> print(honk_element[0].honking)  # doctest: +ELLIPSIS
-   Traceback (most recent call last):
-   ...
--  AttributeError: 'HonkNSElement' object has no attribute 'honking'
-+  AttributeError: 'HonkNSElement' object has no attribute 'honking'...
- 
-   >>> print(honk_element[1].text)  # uses fallback for non-elements
-   comment
---- a/src/lxml/tests/test_elementtree.py
-+++ b/src/lxml/tests/test_elementtree.py
-@@ -26,7 +26,7 @@ from .common_imports import (
-     BytesIO, etree, HelperTestCase,
-     ElementTree, cElementTree, ET_VERSION, CET_VERSION,
-     filter_by_version, fileInTestDir, canonicalize, tmpfile,
--    _str, _bytes, unicode, IS_PYTHON2
-+    _str, _bytes, unicode, IS_PYTHON2, IS_PYPY
- )
- 
- if cElementTree is not None and (CET_VERSION <= (1,0,7) or sys.version_info[0] >= 3):
-@@ -2734,6 +2734,7 @@ class _ETreeTestCaseBase(HelperTestCase):
-         self.assertEqual('TEST', root2[0].get('{%s}a' % ns_href))
- 
-     required_versions_ET['test_register_namespace'] = (1,3)
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_register_namespace(self):
-         # ET 1.3+
-         Element = self.etree.Element
---- a/src/lxml/tests/test_errors.py
-+++ b/src/lxml/tests/test_errors.py
-@@ -11,7 +11,7 @@ import unittest
- import sys, gc, os.path
- from lxml import etree
- 
--from .common_imports import HelperTestCase
-+from .common_imports import HelperTestCase, IS_PYPY
- 
- 
- class ErrorTestCase(HelperTestCase):
-@@ -25,6 +25,7 @@ class ErrorTestCase(HelperTestCase):
-     def test_empty_parse(self):
-         self.assertRaises(etree.XMLSyntaxError, etree.fromstring, '')
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_element_cyclic_gc_none(self):
-         # test if cyclic reference can crash etree
-         Element = self.etree.Element
---- a/src/lxml/tests/test_http_io.py
-+++ b/src/lxml/tests/test_http_io.py
-@@ -11,10 +11,11 @@ import textwrap
- import sys
- import gzip
- 
--from .common_imports import etree, HelperTestCase, BytesIO, _bytes
-+from .common_imports import etree, HelperTestCase, BytesIO, _bytes, IS_PYPY
- from .dummy_http_server import webserver, HTTPRequestCollector
- 
- 
-+@unittest.skipIf(IS_PYPY, "broken on pypy")
- class HttpIOTestCase(HelperTestCase):
-     etree = etree
- 
---- a/src/lxml/tests/test_nsclasses.py
-+++ b/src/lxml/tests/test_nsclasses.py
-@@ -9,7 +9,7 @@ from __future__ import absolute_import
- 
- import unittest
- 
--from .common_imports import etree, HelperTestCase, _bytes, make_doctest
-+from .common_imports import etree, HelperTestCase, _bytes, make_doctest, IS_PYPY
- 
- class ETreeNamespaceClassesTestCase(HelperTestCase):
-     
-@@ -46,6 +46,7 @@ class ETreeNamespaceClassesTestCase(HelperTestCase):
-         self.Namespace('ns02').clear()
-         self.Namespace('ns03').clear()
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_ns_classes(self):
-         bluff_dict = {'bluff' : self.bluff_class}
-         maeh_dict  = {'maeh'  : self.maeh_class}
---- a/src/lxml/tests/test_objectify.py
-+++ b/src/lxml/tests/test_objectify.py
-@@ -11,7 +11,8 @@ import random
- import unittest
- 
- from .common_imports import (
--    etree, HelperTestCase, fileInTestDir, doctest, make_doctest, _bytes, _str, BytesIO
-+    etree, HelperTestCase, fileInTestDir, doctest, make_doctest, _bytes, _str, BytesIO,
-+    IS_PYPY
- )
- 
- from lxml import objectify
-@@ -215,11 +216,13 @@ class ObjectifyTestCase(HelperTestCase):
-         expected.update(DEFAULT_NSMAP)
-         self.assertEqual(root.value.nsmap, expected)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_date_element_efactory_text(self):
-         # ObjectifiedDataElement can also be used as E-Factory
-         value = objectify.ObjectifiedDataElement('test', 'toast')
-         self.assertEqual(value.text, 'testtoast')
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_date_element_efactory_tail(self):
-         # ObjectifiedDataElement can also be used as E-Factory
-         value = objectify.ObjectifiedElement(objectify.ObjectifiedDataElement(), 'test', 'toast')
-@@ -376,6 +379,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual("4", getattr(root.c1, "{}c2").text)
-         self.assertEqual("0", getattr(root.c1, "c2").text)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_setattr(self):
-         for val in [
-             2, 2**32, 1.2, "Won't get fooled again", 
-@@ -811,6 +815,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(3, len(root.findall(".//b")))
-         self.assertEqual(2, len(root.findall("b")))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_build_tree(self):
-         root = self.Element('root')
-         root.a = 5
-@@ -840,6 +845,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(value, None)
-         self.assertEqual(value.get(XML_SCHEMA_NIL_ATTR), "true")
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_bool(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -877,6 +883,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(objectify.DataElement(False).text, "false")
-         self.assertEqual(objectify.DataElement(True).text, "true")
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -884,6 +891,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = "test"
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_intliteral(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -891,6 +899,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = "3"
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_floatliteral(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -898,6 +907,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = "3.72"
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_mul(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -910,6 +920,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertRaises(TypeError, operator.mul, root.s, "honk")
-         self.assertRaises(TypeError, operator.mul, "honk", root.s)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_add(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -920,6 +931,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual("test" + s, root.s + s)
-         self.assertEqual(s + "test", s + root.s)
-             
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_mod(self):
-         s = "%d %f %s %r"
-         el = objectify.DataElement(s)
-@@ -985,6 +997,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertTrue(isinstance(value, objectify.StringElement))
-         self.assertEqual(value, "3.20")
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -992,6 +1005,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = _str("test")
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_intliteral(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -999,6 +1013,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = _str("3")
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_floatliteral(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -1006,6 +1021,7 @@ class ObjectifyTestCase(HelperTestCase):
-         root.s = _str("3.72")
-         self.assertTrue(isinstance(root.s, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_mul(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -1018,6 +1034,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertRaises(TypeError, operator.mul, root.s, _str("honk"))
-         self.assertRaises(TypeError, operator.mul, _str("honk"), root.s)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_ustr_add(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -1043,6 +1060,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertTrue(isinstance(value, objectify.StringElement))
-         self.assertEqual(value, _str("3.20"))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_int(self):
-         Element = self.Element
-         root = Element("{objectified}root")
-@@ -1059,6 +1077,7 @@ class ObjectifyTestCase(HelperTestCase):
-         value = objectify.DataElement(123)
-         self.assertEqual(hash(value), hash(123))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -1075,6 +1094,7 @@ class ObjectifyTestCase(HelperTestCase):
-         value = objectify.DataElement(5.5)
-         self.assertEqual(hash(value), hash(5.5))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float_precision(self):
-         # test not losing precision by shortened float str() value
-         # repr(2.305064300557): '2.305064300557'
-@@ -1094,6 +1114,7 @@ class ObjectifyTestCase(HelperTestCase):
-         s = "2.305064300557"
-         self.assertEqual(objectify.FloatElement(s), float(s))
-   
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_float_precision_consistency(self):
-         # test consistent FloatElement values for the different instantiation
-         # possibilities
-@@ -1180,6 +1201,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(value.text, None)
-         self.assertEqual(value.pyval, None)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_unregistered(self):
-         Element = self.Element
-         SubElement = self.etree.SubElement
-@@ -1342,6 +1364,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(["why", "try"],
-                           strs)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_str_cmp(self):
-         XML = self.XML
-         root = XML(_bytes('<root><b>test</b><b>taste</b><b></b><b/></root>'))
-@@ -1369,6 +1392,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertEqual(root.b, "")
-         self.assertEqual("", root.b)
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_int_cmp(self):
-         XML = self.XML
-         root = XML(_bytes('<root><b>5</b><b>6</b></root>'))
-@@ -1391,6 +1415,7 @@ class ObjectifyTestCase(HelperTestCase):
-         
-     # float + long share the NumberElement implementation with int
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_type_bool_cmp(self):
-         XML = self.XML
-         root = XML(_bytes('<root><b>false</b><b>true</b></root>'))
-@@ -2060,6 +2085,7 @@ class ObjectifyTestCase(HelperTestCase):
-                           before = [objectify.getRegisteredTypes()[0].name],
-                           after  = [objectify.getRegisteredTypes()[1].name])
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_registered_type_stringify(self):
-         from datetime import datetime
-         def parse_date(value):
-@@ -2530,46 +2556,55 @@ class ObjectifyTestCase(HelperTestCase):
- 
-     # E-Factory tests, need to use sub-elements as root element is always
-     # type-looked-up as ObjectifiedElement (no annotations)
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_int(self):
-         E = objectify.E
-         root = E.root(E.val(23))
-         self.assertTrue(isinstance(root.val, objectify.IntElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_float(self):
-         E = objectify.E
-         root = E.root(E.val(233.23))
-         self.assertTrue(isinstance(root.val, objectify.FloatElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_str(self):
-         E = objectify.E
-         root = E.root(E.val("what?"))
-         self.assertTrue(isinstance(root.val, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_unicode(self):
-         E = objectify.E
-         root = E.root(E.val(_str("blöödy häll", encoding="ISO-8859-1")))
-         self.assertTrue(isinstance(root.val, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_bool(self):
-         E = objectify.E
-         root = E.root(E.val(True))
-         self.assertTrue(isinstance(root.val, objectify.BoolElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_none(self):
-         E = objectify.E
-         root = E.root(E.val(None))
-         self.assertTrue(isinstance(root.val, objectify.NoneElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_value_concatenation(self):
-         E = objectify.E
-         root = E.root(E.val(1, "foo", 2.0, "bar ", True, None))
-         self.assertTrue(isinstance(root.val, objectify.StringElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_attrib(self):
-         E = objectify.E
-         root = E.root(foo="bar")
-         self.assertEqual(root.get("foo"), "bar")
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_nested(self):
-         E = objectify.E
-         DataElement = objectify.DataElement
-@@ -2584,6 +2619,7 @@ class ObjectifyTestCase(HelperTestCase):
-         self.assertTrue(isinstance(root.value[0], objectify.IntElement))
-         self.assertTrue(isinstance(root.value[1], objectify.FloatElement))
- 
-+    @unittest.skipIf(IS_PYPY, "broken on pypy")
-     def test_efactory_subtype(self):
-         class Attribute(objectify.ObjectifiedDataElement):
-             def __init__(self):
-@@ -2739,7 +2775,8 @@ def test_suite():
-     suite = unittest.TestSuite()
-     suite.addTests([unittest.makeSuite(ObjectifyTestCase)])
-     suite.addTests(doctest.DocTestSuite(objectify))
--    suite.addTests([make_doctest('../../../doc/objectify.txt')])
-+    if not IS_PYPY:
-+        suite.addTests([make_doctest('../../../doc/objectify.txt')])
-     return suite
- 
- if __name__ == '__main__':
---- a/src/lxml/tests/test_xpathevaluator.py
-+++ b/src/lxml/tests/test_xpathevaluator.py
-@@ -8,7 +8,7 @@ from __future__ import absolute_import
- 
- import unittest, sys
- 
--from .common_imports import etree, HelperTestCase, _bytes, BytesIO, doctest, make_doctest
-+from .common_imports import etree, HelperTestCase, _bytes, BytesIO, doctest, make_doctest, IS_PYPY
- 
- 
- class ETreeXPathTestCase(HelperTestCase):
-@@ -740,8 +740,9 @@ def test_suite():
-         suite.addTests([unittest.makeSuite(ETreeXPathExsltTestCase)])
-     suite.addTests([unittest.makeSuite(ETreeETXPathClassTestCase)])
-     suite.addTests([doctest.DocTestSuite()])
--    suite.addTests(
--        [make_doctest('../../../doc/xpathxslt.txt')])
-+    if not IS_PYPY:
-+        suite.addTests(
-+            [make_doctest('../../../doc/xpathxslt.txt')])
-     return suite
- 
- if __name__ == '__main__':
---- a/src/lxml/tests/test_xslt.py
-+++ b/src/lxml/tests/test_xslt.py
-@@ -17,6 +17,8 @@ from textwrap import dedent
- from tempfile import NamedTemporaryFile, mkdtemp
- 
- is_python3 = sys.version_info[0] >= 3
-+is_pypy = (getattr(sys, 'implementation', None) == 'pypy' or
-+           getattr(sys, 'pypy_version_info', None) is not None)
- 
- try:
-     unicode
-@@ -2098,8 +2100,9 @@ def test_suite():
-         suite.addTests([unittest.makeSuite(Py3XSLTTestCase)])
-     suite.addTests(
-         [make_doctest('../../../doc/extensions.txt')])
--    suite.addTests(
--        [make_doctest('../../../doc/xpathxslt.txt')])
-+    if not is_pypy:
-+        suite.addTests(
-+            [make_doctest('../../../doc/xpathxslt.txt')])
-     return suite
- 
- if __name__ == '__main__':
--- 
-2.41.0

sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild

@@ -1,116 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-DISTUTILS_EXT=1
-DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 optfeature toolchain-funcs
-
-DESCRIPTION="A Pythonic binding for the libxml2 and libxslt libraries"
-HOMEPAGE="
-	https://lxml.de/
-	https://pypi.org/project/lxml/
-	https://github.com/lxml/lxml/
-"
-SRC_URI="
-	https://github.com/lxml/lxml/archive/${P}.tar.gz
-		-> ${P}.gh.tar.gz
-	https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${PN}-4.9.3-patches.tar.xz
-"
-S=${WORKDIR}/lxml-${P}
-
-LICENSE="BSD ElementTree GPL-2 PSF-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="doc examples +threads test"
-RESTRICT="!test? ( test )"
-
-# Note: lib{xml2,xslt} are used as C libraries, not Python modules.
-DEPEND="
-	>=dev-libs/libxml2-2.10.3
-	>=dev-libs/libxslt-1.1.38
-"
-RDEPEND="
-	${DEPEND}
-"
-BDEPEND="
-	virtual/pkgconfig
-	>=dev-python/cython-0.29.35[${PYTHON_USEDEP}]
-	doc? (
-		$(python_gen_any_dep '
-			dev-python/docutils[${PYTHON_USEDEP}]
-			dev-python/pygments[${PYTHON_USEDEP}]
-			dev-python/sphinx[${PYTHON_USEDEP}]
-			dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
-		')
-	)
-	test? (
-		dev-python/cssselect[${PYTHON_USEDEP}]
-	)
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-4.9.3-tests-pypy.patch
-	"${FILESDIR}"/${PN}-4.9.3-tests-py3.11-cython3.patch
-	"${WORKDIR}"/${PN}-4.9.3-patches
-)
-
-python_check_deps() {
-	use doc || return 0
-	python_has_version -b "dev-python/docutils[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/pygments[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/sphinx[${PYTHON_USEDEP}]" &&
-	python_has_version -b "dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]"
-}
-
-python_prepare_all() {
-	# avoid replacing PYTHONPATH in tests.
-	sed -i -e '/sys\.path/d' test.py || die
-
-	# don't use some random SDK on Darwin
-	sed -i -e '/_ldflags =/s/=.*isysroot.*darwin.*None/= None/' \
-		setupinfo.py || die
-
-	distutils-r1_python_prepare_all
-}
-
-python_compile() {
-	tc-export PKG_CONFIG
-	distutils-r1_python_compile
-}
-
-python_compile_all() {
-	use doc && emake html
-}
-
-python_test() {
-	local dir=${BUILD_DIR}/test$(python_get_sitedir)/lxml
-	local -x PATH=${BUILD_DIR}/test/usr/bin:${PATH}
-
-	cp -al "${BUILD_DIR}"/{install,test} || die
-	cp -al src/lxml/tests "${dir}/" || die
-	cp -al src/lxml/html/tests "${dir}/html/" || die
-	ln -rs "${S}"/doc "${dir}"/../../ || die
-
-	"${EPYTHON}" test.py -vv --all-levels -p || die "Test ${test} fails with ${EPYTHON}"
-}
-
-python_install_all() {
-	if use doc; then
-		local DOCS=( README.rst *.txt doc/*.txt )
-		local HTML_DOCS=( doc/html/. )
-	fi
-	if use examples; then
-		dodoc -r samples
-	fi
-
-	distutils-r1_python_install_all
-}
-
-pkg_postinst() {
-	optfeature "Support for BeautifulSoup as a parser backend" dev-python/beautifulsoup4
-	optfeature "Translates CSS selectors to XPath 1.0 expressions" dev-python/cssselect
-}

sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r2.ebuild

@@ -24,7 +24,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
@@ -76,6 +76,10 @@ python_prepare_all() {
 }
 
 python_compile() {
+	local DISTUTILS_ARGS=(
+		# by default it adds -w to CFLAGS
+		--warnings
+	)
 	tc-export PKG_CONFIG
 	distutils-r1_python_compile
 }

sdk_container/src/third_party/portage-stable/dev-python/packaging/Manifest

@@ -1,2 +1 @@
-DIST packaging-23.1.tar.gz 134240 BLAKE2B ef7ef320a98592769078581e32fcc355d05f6fbb7611e7bd83fd2ed64d5f5f5d9c1f89c2a4a91ace1221214a9047e233d8d6a339fd29066b3695137ec5a870bd SHA512 0f2246b8bfeb467623ee72e6fdb7c0416e3b4ba0e00102c1528581e0835cc8e731a812b15e2e429d3ebb0001713d95cc2675f443f4597b092e305a3ef2e9137a
 DIST packaging-23.2.tar.gz 146714 BLAKE2B cf7986a07312fd82a2a0ee738088993b9570d95cd0b573afa7a1f911bf335de7084e3d40d961adea7f5a8369738688f9d0a4265ef26a393f2d30769bc13f752a SHA512 8ab5e9bc4feef2fac1c9044dc8a6f2d41aaf9fe2dae671de8b98c0b1a19dca2169588b87d85a8c990d808b1e76faee65984ce970eaa3282b75e107ca82cc2863

sdk_container/src/third_party/portage-stable/dev-python/packaging/packaging-23.1.ebuild

@@ -1,36 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
-EAPI=8
-
-DISTUTILS_USE_PEP517=flit
-PYTHON_COMPAT=( python3_{10..12} pypy3 )
-
-inherit distutils-r1 pypi
-
-DESCRIPTION="Core utilities for Python packages"
-HOMEPAGE="
-	https://github.com/pypa/packaging/
-	https://pypi.org/project/packaging/
-"
-
-SLOT="0"
-LICENSE="|| ( Apache-2.0 BSD-2 )"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="
-	>=dev-python/pyparsing-3.0.7-r1[${PYTHON_USEDEP}]
-	!<dev-python/setuptools-67
-"
-DEPEND="
-	test? (
-		dev-python/pretend[${PYTHON_USEDEP}]
-	)
-"
-
-distutils_enable_tests pytest
-
-python_test() {
-	epytest --capture=no
-}

sdk_container/src/third_party/portage-stable/dev-python/platformdirs/Manifest

@@ -1 +1,2 @@
 DIST platformdirs-3.11.0.tar.gz 19914 BLAKE2B bea0cbb3c840441943aaf93b6c88d34ae93cf9a9bea7b00186ffae6f46a820036883cebf996ee998cee9b4b748ab24fcd88d3d318c418e6f70746769bdb8619f SHA512 a273ea8fc5916bdb94da9cc62ccef60a7247b5a019639aae3be9718626ce59d27d8e62c6552c25a3cdd0e7fb7215c32b6c30f2509a3356623f628f771e92bb56
+DIST platformdirs-4.0.0.tar.gz 19914 BLAKE2B 0ae3f7491f3f1d38561c89312c988b4145c9afb60e3d866cd05bef7e02c6df95d56cb230995de2893c0afd32bd63eb08448e67d5cdd0bdf6f3556ea1a23e2b49 SHA512 28eeb18ab5a52bf60d85ab76c986300d0f69c3bcff9ec18b961b70f97bce4e0d1bd3315b8d97f6b6a41de000b734979c08754780d282695525348342ab9c9931

sdk_container/src/third_party/portage-stable/dev-python/platformdirs/platformdirs-4.0.0.ebuild

@@ -0,0 +1,49 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="A small Python module for determining appropriate platform-specific dirs"
+HOMEPAGE="
+	https://pypi.org/project/platformdirs/
+	https://github.com/platformdirs/platformdirs/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+
+BDEPEND="
+	test? (
+		dev-python/appdirs[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+src_configure() {
+	grep -q 'build-backend = "hatchling' pyproject.toml ||
+		die "Upstream changed build-backend, recheck"
+	# write a custom pyproject.toml to ease setuptools bootstrap
+	cat > pyproject.toml <<-EOF || die
+		[build-system]
+		requires = ["flit_core >=3.2,<4"]
+		build-backend = "flit_core.buildapi"
+
+		[project]
+		name = "${PN}"
+		version = "${PV}"
+		description = 'A small Python package for determining appropriate platform-specific dirs, e.g. a "user data dir".'
+	EOF
+	# sigh
+	cat > src/platformdirs/version.py <<-EOF || die
+		__version__ = version = '${PV}'
+		__version_tuple__ = version_tuple = (${PV//./, })
+	EOF
+}

sdk_container/src/third_party/portage-stable/dev-python/pygments/Manifest

@@ -1 +1,4 @@
 DIST Pygments-2.16.1.tar.gz 4872980 BLAKE2B 57ec4f52f2bca3d9df993f583434d61ad0adbc2719f2d0b4ac84160672a3a57ec144509c520f2724a15f0222548abfbe0e743fa31a8dac64d54111b2d7393ae4 SHA512 9b66c79c03e7ecd36cc00efd428a0a6b372e70dbccdcaae26eff4d56c07a17e2e00d2cf0291eb6624ffd1c896b797789b973e80ccbca4240d56daad95eacfd80
+DIST pygments-2.17.0.tar.gz 4827657 BLAKE2B 53ab36177bb88a3a19cd14a86bedab5aecf3286e2b08432f643d31d22179c4bf7e938dc8fffc3a5ecfcfead747d26085730dd611d050ae649cea62353639941e SHA512 b385f58bb7dba6b193e6c9715e0a34a883d810d2ee919a24268d7b9fffaf7501c0964c8d84aa26edcb503141330e6b752fe52d11b3d146177d42ecd3ab9211de
+DIST pygments-2.17.1.tar.gz 4827687 BLAKE2B 71e5311b15ece8463a5062a4a83796b5e652b3d67ab2d4578cc03d139816fb3de9dff204c1d35ef9e959e502d57ef22b1507212d3ed477866757e596c6c488f4 SHA512 587f9d32bbb6c9bdbe53db2f5a24b93323905cd515acf3a0e73318c00bdbb71e109d9258de54ac45a1d85fe285ffdd1b9b0397b41391124754f41af4c9e02e4b
+DIST pygments-2.17.2.tar.gz 4827772 BLAKE2B 7e6db51ff35ec35981fcdd6f4a1f0a242c29e8b0947a5a3febdee35a0e4047414d49d6883b8fbf9de78b149323f0b3c86b315b03eaada557b4cd70e67917aab8 SHA512 a3408a21f4c0a9f1a81d4fae5c2924f66f1f17daf98a52c4379d6953625354f47bb8db3005e6ab09407627f592843efde12afb14e1271c1e685973eb4c238d89

sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.17.0.ebuild

@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYPI_PN=${PN^}
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 bash-completion-r1 pypi
+
+DESCRIPTION="Pygments is a syntax highlighting package written in Python"
+HOMEPAGE="
+	https://pygments.org/
+	https://github.com/pygments/pygments/
+	https://pypi.org/project/Pygments/
+"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/lxml[${PYTHON_USEDEP}]
+		dev-python/pillow[${PYTHON_USEDEP}]
+		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
+		virtual/ttf-fonts
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fuzzing tests, very slow
+	tests/test_basic_api.py::test_random_input
+	# incompatibility with python-ctags3, apparently
+	# https://github.com/pygments/pygments/issues/2486
+	tests/test_html_formatter.py::test_ctags
+)
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	newbashcomp external/pygments.bashcomp pygmentize
+}

sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.17.1.ebuild

@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYPI_PN=${PN^}
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 bash-completion-r1 pypi
+
+DESCRIPTION="Pygments is a syntax highlighting package written in Python"
+HOMEPAGE="
+	https://pygments.org/
+	https://github.com/pygments/pygments/
+	https://pypi.org/project/Pygments/
+"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/lxml[${PYTHON_USEDEP}]
+		dev-python/pillow[${PYTHON_USEDEP}]
+		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
+		virtual/ttf-fonts
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fuzzing tests, very slow
+	tests/test_basic_api.py::test_random_input
+	# incompatibility with python-ctags3, apparently
+	# https://github.com/pygments/pygments/issues/2486
+	tests/test_html_formatter.py::test_ctags
+)
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	newbashcomp external/pygments.bashcomp pygmentize
+}

sdk_container/src/third_party/portage-stable/dev-python/pygments/pygments-2.17.2.ebuild

@@ -0,0 +1,46 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=hatchling
+PYPI_PN=${PN^}
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 bash-completion-r1 pypi
+
+DESCRIPTION="Pygments is a syntax highlighting package written in Python"
+HOMEPAGE="
+	https://pygments.org/
+	https://github.com/pygments/pygments/
+	https://pypi.org/project/Pygments/
+"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/lxml[${PYTHON_USEDEP}]
+		dev-python/pillow[${PYTHON_USEDEP}]
+		dev-python/wcag-contrast-ratio[${PYTHON_USEDEP}]
+		virtual/ttf-fonts
+	)
+"
+
+EPYTEST_DESELECT=(
+	# fuzzing tests, very slow
+	tests/test_basic_api.py::test_random_input
+	# incompatibility with python-ctags3, apparently
+	# https://github.com/pygments/pygments/issues/2486
+	tests/test_html_formatter.py::test_ctags
+)
+
+EPYTEST_XDIST=1
+distutils_enable_tests pytest
+
+src_install() {
+	distutils-r1_src_install
+	newbashcomp external/pygments.bashcomp pygmentize
+}

sdk_container/src/third_party/portage-stable/dev-python/pyparsing/Manifest

@@ -1,3 +1,2 @@
-DIST pyparsing-3.1.0.tar.gz 882565 BLAKE2B 8ed2e15e2422ded9a558b866a5cbbdc0fb6c7ce42962710e42cfd751aae7b48bacd3d6201084189a940d262fb7b142ea37b897bae23f97a175f6152c19adb5c9 SHA512 0ad2e8fff93708426b3675e2d41da12b3f09531bf272799db4095ee618bbaa0f4b90e527ff09dda2acbdb923d59117678fbb28b82a7cfd2b395d686f47b61850
 DIST pyparsing-3.1.1.tar.gz 884814 BLAKE2B d5a2b74181d2d93575e9be43285a7156c3b796d58993397c2ed8df10467d54ef193d1f82bbdac0cecd97fb20d1cb64d79f8502b02d8886511ca90c02ac3739bb SHA512 59ae01e13277e25cabd1a1ea41a27aac9235c09746f54c0eaac53d0aae488309fe2044b3b31e1105cb8207ad3326828ec32bdd5e904cceee8b0d032740679628
 DIST pyparsing_3.0.9.gh.tar.gz 967771 BLAKE2B c13c74661b9e0d53b4886c9949b01951d220991f916362a13ce0c32c0ab05a6b1cab4d5e5a626acb7563c0ec1716348ede205cb67bf22c0710904f07404ad82a SHA512 1158f27e31f8eced540217b7234b09005eac416fad74faf59678fdae93fe2f76e0e3b5f4adfd3ceb42c8aef19150950293e989c9a5189741175073eb7a03cd6d