New version: stable-4459.2.4

Signed-off-by: Sayan Chowdhury <sayan.chowdhury2012@gmail.com>

.github/workflows/kernel-apply-patch.sh

@@ -28,23 +28,15 @@ fi
 extra_pkgs=(
     sys-kernel/coreos-modules
     sys-kernel/coreos-kernel
+    app-emulation/hv-daemons
 )
 
-for pkg in sources modules kernel; do
+for pkg in sys-kernel/coreos-{sources,modules,kernel} app-emulation/hv-daemons; do
-    pushd "sys-kernel/coreos-${pkg}"
+    pkg+=/${pkg##*/}
-    git mv "coreos-${pkg}"-*.ebuild "coreos-${pkg}-${VERSION_NEW}.ebuild"
+    git mv "${pkg}"-*.ebuild "${pkg}-${VERSION_NEW}.ebuild"
-    sed -i -e '/^COREOS_SOURCE_REVISION=/s/=.*/=""/' "coreos-${pkg}-${VERSION_NEW}.ebuild"
+    sed -i -e '/^COREOS_SOURCE_REVISION=/s/=.*/=""/' "${pkg}-${VERSION_NEW}.ebuild"
-    popd
 done
 
-if [[ -d app-emulation/hv-daemons ]]; then
-    # Update hyperv daemons ebuild soft-link to reflect new kernel version
-    find -D exec app-emulation/hv-daemons/ -type l -exec rm '{}' \;
-    ln --relative -s app-emulation/hv-daemons/hv-daemons-9999.ebuild \
-          app-emulation/hv-daemons/hv-daemons-${VERSION_NEW}.ebuild
-    extra_pkgs+=( app-emulation/hv-daemons )
-fi
-
 # Leave ebuild repo section of SDK
 popd
 

.github/workflows/portage-stable-packages-list

@@ -744,6 +744,7 @@ virtual/service-manager
 virtual/ssh
 virtual/tmpfiles
 virtual/udev
+virtual/zlib
 
 x11-drivers/nvidia-drivers
 

build_library/qemu_template.sh

@@ -247,8 +247,8 @@ else
             ;;
         amd64-usr+*)
             set -- -machine q35 -cpu kvm64 -smp 1 -nographic "$@" ;;
-        arm64-usr+aarch64)
+        arm64-usr+aarch64|arm64-usr+arm64)
-            set -- -machine virt,accel=kvm,gic-version=3 -cpu host -smp "${VM_NCPUS}" -nographic "$@" ;;
+            set -- -machine virt,accel=kvm:hvf:tcg,gic-version=3 -cpu host -smp "${VM_NCPUS}" -nographic "$@" ;;
         arm64-usr+*)
             if test "${VM_NCPUS}" -gt 4 ; then
                 VM_NCPUS=4

build_library/vm_image_util.sh

@@ -43,6 +43,7 @@ VALID_IMG_TYPES=(
     vmware_ova
     vmware_raw
     xen
+    nutanix
 )
 
 #list of oem package names, minus the oem- prefix
@@ -353,6 +354,13 @@ IMG_proxmoxve_OEM_PACKAGE=common-oem-files
 IMG_proxmoxve_OEM_USE=proxmoxve
 IMG_proxmoxve_OEM_SYSEXT=oem-proxmoxve
 
+## nutanix
+IMG_nutanix_DISK_FORMAT=qcow2
+IMG_nutanix_DISK_LAYOUT=vm
+IMG_nutanix_OEM_USE=nutanix
+IMG_nutanix_OEM_PACKAGE=common-oem-files
+IMG_nutanix_OEM_SYSEXT=oem-nutanix
+
 ###########################################################
 
 # Print the default vm type for the specified board

changelog/bugfixes/2025-09-19-kernel-config-memcg-v1.md

@@ -0,0 +1 @@
+- Enabled `CONFIG_MEMCG_V1` to mitigate cgroupsv1 removal (e.g JVM) ([Flatcar#1884](https://github.com/flatcar/Flatcar/issues/1884))

changelog/bugfixes/2025-10-08-macos-hvf-accel.md

@@ -0,0 +1 @@
+- Fixed the QEMU launcher script to include HVF acceleration on arm64-based Macs for faster performance ([Flatcar#1901](https://github.com/flatcar/Flatcar/issues/1901))

changelog/bugfixes/2025-10-10-flatcar-extensions.md

@@ -0,0 +1 @@
+- Fixed that the needed Flatcar extensions don't get removed on update which caused a re-download ([update_engine#51](https://github.com/flatcar/update_engine/pull/51))

changelog/bugfixes/2025-10-20-microcode-updates.md

@@ -0,0 +1 @@
+- Fixed Intel microcode updates which were broken in recent Alpha and Beta releases by switching back to built-in extra firmware instead of early cpio inclusion ([Flatcar#1909](https://github.com/flatcar/Flatcar/issues/1909))

changelog/bugfixes/2025-10-27-tun-interface-exclusion.md

@@ -0,0 +1 @@
+- Excluded TUN/TAP interfaces from the default DHCP network configuration to solve conflicts with the programs that created them ([Flatcar#1933](https://github.com/flatcar/Flatcar/issues/1933))

changelog/bugfixes/2025-11-05-fix-modprobe-via-udevd.md

@@ -0,0 +1 @@
+- Fixed the loading of kernel modules from system extensions via udev (e.g. at boot time). ([flatcar/scripts#3367](https://github.com/flatcar/scripts/pull/3367))

changelog/changes/2025-09-16-scaleway.md

@@ -0,0 +1,2 @@
+- Scaleway: The hostname is now set _via_ Afterburn ([scripts#3277](https://github.com/flatcar/scripts/pull/3277))
+- Scaleway: SSH keys are now fetched _via_ Afterburn ([scripts#3277](https://github.com/flatcar/scripts/pull/3277))

changelog/changes/2025-10-20-scaleway.md

@@ -0,0 +1 @@
+- Scaleway: The Linux console is now attached to the correct console port. ([scripts#3383](https://github.com/flatcar/scripts/pull/3383))

changelog/changes/2025-11-05-nutanix.md

@@ -0,0 +1 @@
+- Added Nutanix images ([flatcar/scripts#3311](https://github.com/flatcar/scripts/pull/3311))

changelog/security/2025-11-07-runc-containerd.md

@@ -0,0 +1,2 @@
+- containerd ([CVE-2024-25621](https://www.cve.org/CVERecord?id=CVE-2024-25621), [CVE-2025-64329](https://www.cve.org/CVERecord?id=CVE-2025-64329))
+- runc ([CVE-2025-31133](https://www.cve.org/CVERecord?id=CVE-2025-31133), [CVE-2025-52565](https://www.cve.org/CVERecord?id=CVE-2025-52565), [CVE-2025-52881](https://www.cve.org/CVERecord?id=CVE-2025-52881))

changelog/security/2026-02-12-openssh.md

@@ -0,0 +1 @@
+- openssh ([CVE-2025-61984](https://www.cve.org/CVERecord?id=CVE-2025-61984), [CVE-2025-61985](https://www.cve.org/CVERecord?id=CVE-2025-61985))

changelog/updates/2025-09-20-linux-6.12.48-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.48](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.48))

changelog/updates/2025-09-22-ca-certificates-3.116-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.116](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_116.html))

changelog/updates/2025-10-06-ca-certificates-3.117-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.117](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_117.html))

changelog/updates/2025-10-07-linux-6.12.51-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.51](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.51) (includes [6.12.50](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.50), [6.12.49](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.49)))

changelog/updates/2025-10-20-linux-6.12.54-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.54](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.54) (includes [6.12.53](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.53), [6.12.52](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.52)))

changelog/updates/2025-11-07-runc-containerd.md

@@ -0,0 +1,2 @@
+- runc ([1.3.3](https://github.com/opencontainers/runc/releases/tag/v1.3.3) (includes [1.3.2](https://github.com/opencontainers/runc/releases/tag/v1.3.2), [1.3.1](https://github.com/opencontainers/runc/releases/tag/v1.3.1), [1.3.0](https://github.com/opencontainers/runc/releases/tag/v1.3.0)))
+- containerd ([2.0.7](https://github.com/containerd/containerd/releases/tag/v2.0.7) (includes [2.0.6](https://github.com/containerd/containerd/releases/tag/v2.0.6)))

changelog/updates/2025-11-14-linux-6.12.58-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.58](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.58) (includes [6.12.57](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.57), [6.12.56](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.56), [6.12.55](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.55)))

changelog/updates/2025-11-24-ca-certificates-3.118.1-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.118.1](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_118_1.html))

changelog/updates/2025-11-25-linux-6.12.59-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.59](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.59))

changelog/updates/2025-12-02-linux-6.12.60-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.60](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.60))

changelog/updates/2025-12-07-linux-6.12.61-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.61](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.61))

changelog/updates/2025-12-08-ca-certificates-3.119-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.119](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_119.html))

changelog/updates/2025-12-13-linux-6.12.62-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.62](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.62))

changelog/updates/2026-01-09-linux-6.12.64-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.64](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.64) (includes [6.12.63](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.63)))

changelog/updates/2026-01-12-ca-certificates-3.120-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.120](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_120.html))

changelog/updates/2026-01-12-linux-6.12.65-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.65](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.65))

changelog/updates/2026-01-18-linux-6.12.66-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.66](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.66))

changelog/updates/2026-01-28-openssl.md

@@ -0,0 +1 @@
+- OpenSSL ([3.4.4](https://github.com/openssl/openssl/blob/openssl-3.4/CHANGES.md#changes-between-343-and-344-27-jan-2026) (includes [3.4.3](https://github.com/openssl/openssl/blob/openssl-3.4/CHANGES.md#changes-between-342-and-343-30-sep-2025)))

changelog/updates/2026-02-12-openssh.md

@@ -0,0 +1 @@
+- base, dev: openssh ([10.2_p1](https://www.openssh.com/txt/release-10.2) (includes [10.1](https://www.openssh.com/txt/release-10.1)))

changelog/updates/2026-02-16-ca-certificates-3.120.1-update.md

@@ -0,0 +1 @@
+- ca-certificates ([3.120.1](https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_120_1.html))

changelog/updates/2026-02-17-linux-6.12.73-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.73](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.73) (includes [6.12.72](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.72), [6.12.71](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.71), [6.12.70](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.70), [6.12.69](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.69), [6.12.68](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.68), [6.12.67](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.67)))

changelog/updates/2026-02-20-linux-6.12.74-update.md

@@ -0,0 +1 @@
+- Linux ([6.12.74](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tag/?h=v6.12.74))

ci-automation/ci-config.env

@@ -9,10 +9,9 @@
 #  - http and https (WITHOUT auto-redirect)
 #  - ssh for BUILDCACHE_USER
 BUILDCACHE_SERVER="${BUILDCACHE_SERVER:-bincache.flatcar-linux.net}"
-BUILDCACHE_PATH_PREFIX="/srv/bincache"
+BUILDCACHE_PATH_PREFIX="/mnt/buckets/linode-bincache"
 BUILDCACHE_USER="bincache"
 
-RELEASES_SERVER="mirror.release.flatcar-linux.net"
 CONTAINER_REGISTRY="ghcr.io/flatcar"
 RELEASES_JSON_FEED="https://www.flatcar.org/releases-json/releases.json"
 
@@ -82,26 +81,6 @@ QEMU_DEVCONTAINER_URL="${QEMU_DEVCONTAINER_URL:-}"
 QEMU_DEVCONTAINER_BINHOST_URL="${QEMU_DEVCONTAINER_BINHOST_URL:-}"
 QEMU_DEVCONTAINER_FILE="${QEMU_DEVCONTAINER_FILE:-}"
 
-# -- Equinix Metal --
-EQUINIXMETAL_PARALLEL="${PARALLEL_TESTS:-4}"
-# Metro is a set of Equinix Metal regions
-EQUINIXMETAL_amd64_METRO="${EQUINIXMETAL_amd64_METRO:-SV}"
-EQUINIXMETAL_arm64_METRO="${EQUINIXMETAL_arm64_METRO:-DC}"
-# Name of the Equinix Metal image
-EQUINIXMETAL_IMAGE_NAME="flatcar_production_packet_image.bin.bz2"
-# Storage URL required to store user-data
-EQUINIXMETAL_STORAGE_URL="${EQUINIXMETAL_STORAGE_URL:-gs://flatcar-jenkins/mantle/packet}"
-# Equinix Metal default AMD64 instance type
-EQUINIXMETAL_amd64_INSTANCE_TYPE="${EQUINIXMETAL_amd64_INSTANCE_TYPE:-c3.small.x86}"
-# Space separated list of instance types. On those instances the
-# cl.internet kola test will be run if this test is selected to run.
-EQUINIXMETAL_amd64_MORE_INSTANCE_TYPES="m3.small.x86 c3.medium.x86 m3.large.x86 s3.xlarge.x86 n2.xlarge.x86"
-# Equinix Metal default ARM64 instance type
-EQUINIXMETAL_arm64_INSTANCE_TYPE="c3.large.arm"
-# Space separated list of instance types. On those instances the
-# cl.internet kola test will be run if this test is selected to run.
-EQUINIXMETAL_arm64_MORE_INSTANCE_TYPES=""
-
 # -- PXE --
 PXE_KERNEL_NAME="flatcar_production_pxe.vmlinuz"
 PXE_IMAGE_NAME="flatcar_production_pxe_image.cpio.gz"
@@ -168,7 +147,7 @@ BRIGHTBOX_PARALLEL="${PARALLEL_TESTS:-1}"
 
 # -- Hetzner --
 : ${HETZNER_IMAGE_NAME:='flatcar_production_hetzner_image.bin.bz2'}
-: ${HETZNER_amd64_INSTANCE_TYPE:="cpx11"}
+: ${HETZNER_amd64_INSTANCE_TYPE:="cpx22"}
 : ${HETZNER_arm64_INSTANCE_TYPE:="cax11"}
 : ${HETZNER_arm64_LOCATION:="fsn1"}
 : ${HETZNER_amd64_LOCATION:="hel1"}
@@ -179,3 +158,11 @@ HETZNER_PARALLEL="${PARALLEL_TESTS:-1}"
 AKAMAI_PARALLEL="${PARALLEL_TESTS:-1}"
 AKAMAI_REGION="us-ord"
 AKAMAI_INSTANCE_TYPE="g6-standard-2"
+
+# -- STACKIT --
+STACKIT_PARALLEL="${PARALLEL_TESTS:-1}"
+STACKIT_IMAGE_NAME="flatcar_production_stackit_image.img"
+: ${STACKIT_amd64_INSTANCE_TYPE:="c2i.2"}
+: ${STACKIT_arm64_INSTANCE_TYPE:="g1r.4d"}
+: ${STACKIT_arm64_LOCATION:="eu01-2"}
+: ${STACKIT_amd64_LOCATION:="eu01-2"}

ci-automation/garbage_collect.sh

@@ -258,11 +258,11 @@ function _garbage_collect_impl() {
       --env AWS_ACCESS_KEY_ID --env AWS_SECRET_ACCESS_KEY \
       --env AWS_CREDENTIALS \
       --env DIGITALOCEAN_TOKEN_JSON \
-      --env EQUINIXMETAL_KEY --env EQUINIXMETAL_PROJECT \
       --env GCP_JSON_KEY \
       --env VMWARE_ESX_CREDS \
       --env BRIGHTBOX_CLIENT_ID --env BRIGHTBOX_CLIENT_SECRET \
       --env AKAMAI_TOKEN \
+      --env STACKIT_SERVICE_ACCOUNT \
       -w /work -v "$PWD":/work "${mantle_ref}" /work/ci-automation/garbage_collect_cloud.sh
 
     echo

ci-automation/garbage_collect_cloud.sh

@@ -5,12 +5,12 @@ timeout --signal=SIGQUIT 60m ore aws gc --access-id "${AWS_ACCESS_KEY_ID}" --sec
 timeout --signal=SIGQUIT 60m ore do gc --config-file=<(echo "${DIGITALOCEAN_TOKEN_JSON}" | base64 --decode)
 timeout --signal=SIGQUIT 60m ore gcloud gc --json-key <(echo "${GCP_JSON_KEY}" | base64 --decode)
 timeout --signal=SIGQUIT 60m ore azure gc --duration 6h
-timeout --signal=SIGQUIT 60m ore equinixmetal gc --duration 6h \
-  --project="${EQUINIXMETAL_PROJECT}" --gs-json-key=<(echo "${GCP_JSON_KEY}" | base64 --decode) --api-key="${EQUINIXMETAL_KEY}"
 timeout --signal=SIGQUIT 60m ore brightbox gc --duration 6h \
   --brightbox-client-id="${BRIGHTBOX_CLIENT_ID}" --brightbox-client-secret="${BRIGHTBOX_CLIENT_SECRET}"
 timeout --signal=SIGQUIT 60m ore akamai gc --duration 6h \
   --akamai-token="${AKAMAI_TOKEN}"
+timeout --signal=SIGQUIT 60m ore stackit gc --duration 6h \
+  --stackit-service-account-key-path=<(echo "${STACKIT_SERVICE_ACCOUNT}" | base64 --decode)
 secret_to_file aws_credentials_config_file "${AWS_CREDENTIALS}"
 for channel in alpha beta stable lts; do
   for arch in amd64 arm64; do

ci-automation/release.sh

@@ -91,8 +91,6 @@ function _inside_mantle() {
     secret_to_file gcp_json_key_path "${GCP_JSON_KEY}"
     google_release_credentials_file=""
     secret_to_file google_release_credentials_file "${GOOGLE_RELEASE_CREDENTIALS}"
-    rclone_configuration_file=""
-    secret_to_file rclone_configuration_file "${RCLONE_CONFIGURATION_FILE}"
 
     for platform in aws azure; do
       for arch in amd64 arm64; do
@@ -164,9 +162,41 @@ function copy_from_bincache_to_bucket() {
     local arch="${2}"
     local version="${3}"
 
-    rclone --config "${RCLONE_CONFIGURATION_FILE}" \
+    rclone_configuration_file="$(mktemp)"
-      sync \
+    chmod 600 "${rclone_configuration_file}"
-      --http-url "https://${BUILDCACHE_SERVER}/images/${arch}/${version}" :http: "r2:flatcar/${channel}/${arch}/${version}"
+
+    (
+    trap "rm -f ${rclone_configuration_file}" EXIT
+    echo "${RCLONE_CONFIGURATION_FILE}" | base64 --decode > "${rclone_configuration_file}"
+
+    echo "Copying the images from bincache to CloudFlare bucket"
+    docker run --rm --net host \
+      -v "${rclone_configuration_file}:/opt/rclone.conf:ro" \
+      docker.io/rclone/rclone:1.71.1 \
+        --config "/opt/rclone.conf" \
+        sync \
+        --http-url "https://${BUILDCACHE_SERVER}/images/${arch}/${version}" :http: "r2:flatcar/${channel}/${arch}-usr/${version}" || { echo "ERROR: Skipping images copy to bucket due to failure" ; }
+
+    echo "Copying the binary packages from bincache to CloudFlare bucket"
+    docker run --rm --net host \
+      -v "${rclone_configuration_file}:/opt/rclone.conf:ro" \
+      docker.io/rclone/rclone:1.71.1 \
+        --config "/opt/rclone.conf" \
+        sync \
+        --http-url "https://${BUILDCACHE_SERVER}/boards/${arch}-usr/${version}" :http: "r2:flatcar/mirror/boards/${arch}-usr/${version}" || { echo "ERROR: Skipping binary packages copy to bucket due to failure" ; }
+
+    # Only copy once the 'containers' artifacts
+    if [ "${arch}" = "amd64" ]; then
+      echo "Copying SDK and packages containers from bincache to CloudFlare bucket"
+      docker run --rm --net host \
+        -v "${rclone_configuration_file}:/opt/rclone.conf:ro" \
+        docker.io/rclone/rclone:1.71.1 \
+          --config "/opt/rclone.conf" \
+          sync \
+          --http-url "https://${BUILDCACHE_SERVER}/containers/${version}" :http: "r2:flatcar/mirror/containers/${version}" || { echo "ERROR: Skipping containers copy (SDK / packages) to bucket due to failure" ; }
+    fi
+
+    )
 }
 
 function publish_sdk() {
@@ -190,6 +220,22 @@ function publish_sdk() {
       docker_image_from_registry_or_buildcache "${sdk_name}" "${docker_sdk_vernum}"
       docker push "${sdk_container_common_registry}/flatcar-sdk-${a}:${docker_sdk_vernum}"
     done
+
+    rclone_configuration_file="$(mktemp)"
+    chmod 600 "${rclone_configuration_file}"
+
+    (
+    trap "rm -f ${rclone_configuration_file}" EXIT
+    echo "${RCLONE_CONFIGURATION_FILE}" | base64 --decode > "${rclone_configuration_file}"
+
+    echo "Copying the SDK from bincache to CloudFlare bucket"
+    docker run --rm --net host \
+      -v "${rclone_configuration_file}:/opt/rclone.conf:ro" \
+      docker.io/rclone/rclone:1.71.1 \
+        --config "/opt/rclone.conf" \
+        sync \
+        --http-url "https://${BUILDCACHE_SERVER}/sdk/amd64/${docker_sdk_vernum}" :http: "r2:flatcar/mirror/sdk/amd64/${docker_sdk_vernum}" || { echo "ERROR: Skipping SDK copy to bucket due to failure" ; }
+    )
 }
 
 function _release_build_impl() {
@@ -206,6 +252,8 @@ function _release_build_impl() {
     local vernum="${FLATCAR_VERSION}"
     local docker_vernum=""
     docker_vernum="$(vernum_to_docker_image_version "${vernum}")"
+    local channel=
+    channel="$(get_git_channel)"
 
     local container_name="flatcar-publish-${docker_vernum}"
     local mantle_ref
@@ -222,6 +270,7 @@ function _release_build_impl() {
       create_digests "${SIGNER}" "aws-${arch}/flatcar_production_ami_"*txt "aws-${arch}/flatcar_production_ami_"*json
       sign_artifacts "${SIGNER}" "aws-${arch}/flatcar_production_ami_"*txt "aws-${arch}/flatcar_production_ami_"*json
       copy_to_buildcache "images/${arch}/${vernum}/" "aws-${arch}/flatcar_production_ami_"*txt* "aws-${arch}/flatcar_production_ami_"*json*
+      copy_from_bincache_to_bucket "${channel}" "${arch}" "${vernum}"
     done
     if [ "${vernum}" = "${sdk_version}" ]; then
       publish_sdk "${docker_sdk_vernum}"
@@ -230,16 +279,14 @@ function _release_build_impl() {
     echo "Done, now you can copy the images to Origin"
     echo "===="
 
-    echo "Experimental (i.e ignore if it fails) - copy the images to CloudFlare bucket for Alpha channel"
-    [[ "${CHANNEL}" != "alpha" ]] && exit 0
-    copy_from_bincache_to_bucket "${CHANNEL}" "${arch}" "${vernum}"
 
-    # Future: trigger copy to Origin in a secure way
     # Future: trigger update payload signing
+
+    # In separate unified pipeline with sub jobs per channel?
     # Future: trigger website update
     # Future: trigger release email sending
     # Future: trigger push to nebraska
-    # Future: trigger Origin symlink switch
+    # Future: trigger Origin current-release.txt switch
 }
 
 TEMPLATE='

ci-automation/tapfile_helper_lib.sh

@@ -279,18 +279,18 @@ __md_print_test_verdict() {
     local failed_vendors="$4"
 
 
-    v="![${verdict}](https://via.placeholder.com/50x20/00ff00/000000?text=PASS)"
+    v="🟢 ${verdict}"
     if [ "${verdict}" = "not ok" ] ; then
-        v="![${verdict}](https://via.placeholder.com/50x20/ff0000/ffffff?text=FAIL)"
+        v="❌ ${verdict}"
     fi
 
     echo
     echo -n "${v} **${name}**"
     if [ -n "${succeded_vendors}" ] ; then
-        echo -n " 🟢 Succeeded: ${succeded_vendors}"
+        echo -n "; Succeeded: ${succeded_vendors}"
     fi
     if [ -n "${failed_vendors}" ] ; then
-        echo -n " ❌ Failed: ${failed_vendors}"
+        echo -n "; Failed: ${failed_vendors}"
     fi
     echo
     if    [ "${verdict}" = "not ok" ] \

ci-automation/vendor-testing/equinix_metal.sh

@@ -1,65 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2021 The Flatcar Maintainers.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-set -euo pipefail
-
-# Test execution script for the Equinix Metal vendor image.
-# This script is supposed to run in the mantle container.
-# This script requires the PXE images to be built.
-
-source ci-automation/vendor_test.sh
-
-# Equinix Metal ARM server are not yet hourly available in the default `SV` metro
-equinixmetal_metro_var="EQUINIXMETAL_${CIA_ARCH}_METRO"
-equinixmetal_metro="${!equinixmetal_metro_var}"
-
-EQUINIXMETAL_INSTANCE_TYPE_VAR="EQUINIXMETAL_${CIA_ARCH}_INSTANCE_TYPE"
-EQUINIXMETAL_INSTANCE_TYPE="${!EQUINIXMETAL_INSTANCE_TYPE_VAR}"
-MORE_INSTANCE_TYPES_VAR="EQUINIXMETAL_${CIA_ARCH}_MORE_INSTANCE_TYPES"
-MORE_INSTANCE_TYPES=( ${!MORE_INSTANCE_TYPES_VAR} )
-
-# The maximum is 6h coming from the ore GC duration parameter
-timeout=6h
-
-BASE_URL="http://${BUILDCACHE_SERVER}/images/${CIA_ARCH}/${CIA_VERNUM}"
-
-run_kola_tests() {
-    local instance_type="${1}"; shift
-    local instance_tapfile="${1}"; shift
-
-    timeout --signal=SIGQUIT "${timeout}" \
-        kola run \
-          --board="${CIA_ARCH}-usr" \
-          --basename="ci-${CIA_VERNUM/+/-}-${CIA_ARCH}" \
-          --platform=equinixmetal \
-          --tapfile="${instance_tapfile}" \
-          --parallel="${EQUINIXMETAL_PARALLEL}" \
-          --equinixmetal-image-url="${BASE_URL}/${EQUINIXMETAL_IMAGE_NAME}" \
-          --equinixmetal-installer-image-kernel-url="${BASE_URL}/${PXE_KERNEL_NAME}" \
-          --equinixmetal-installer-image-cpio-url="${BASE_URL}/${PXE_IMAGE_NAME}" \
-          --equinixmetal-metro="${equinixmetal_metro}" \
-          --equinixmetal-plan="${instance_type}" \
-          --equinixmetal-project="${EQUINIXMETAL_PROJECT}" \
-          --equinixmetal-storage-url="${EQUINIXMETAL_STORAGE_URL}" \
-          --gce-json-key=<(set +x; echo "${GCP_JSON_KEY}" | base64 --decode) \
-          --equinixmetal-api-key="${EQUINIXMETAL_KEY}" \
-          --image-version "${CIA_VERNUM}" \
-          "${@}"
-}
-
-query_kola_tests() {
-    shift; # ignore the instance type
-    kola list --platform=equinixmetal --filter "${@}"
-}
-
-run_kola_tests_on_instances \
-    "${EQUINIXMETAL_INSTANCE_TYPE}" \
-    "${CIA_TAPFILE}" \
-    "${CIA_FIRST_RUN}" \
-    "${MORE_INSTANCE_TYPES[@]}" \
-    '--' \
-    'cl.internet' \
-    '--' \
-    "${@}"

ci-automation/vendor-testing/stackit.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Copyright (c) 2025 The Flatcar Maintainers.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+set -euo pipefail
+
+# Test execution script for STACKIT vendor.
+# This script is supposed to run in the mantle container.
+
+source ci-automation/vendor_test.sh
+
+stackit_instance_type_var="STACKIT_${CIA_ARCH}_INSTANCE_TYPE"
+stackit_instance_type="${!stackit_instance_type_var}"
+
+stackit_location_var="STACKIT_${CIA_ARCH}_LOCATION"
+stackit_location="${!stackit_location_var}"
+
+copy_from_buildcache "images/${CIA_ARCH}/${CIA_VERNUM}/${STACKIT_IMAGE_NAME}" .
+
+kola_test_basename="ci-${CIA_VERNUM//[+.]/-}"
+
+# Upload the image on STACKIT.
+IMAGE_ID=$(ore stackit \
+  --stackit-service-account-key-path=<(echo "${STACKIT_SERVICE_ACCOUNT}" | base64 --decode) \
+  --stackit-project-id="${STACKIT_PROJECT_ID}" \
+  create-image \
+  --board "${CIA_ARCH}-usr" \
+  --name "${kola_test_basename}" \
+  --file="${STACKIT_IMAGE_NAME}"
+)
+
+set -x
+
+timeout --signal=SIGQUIT 2h kola run \
+  --board="${CIA_ARCH}-usr" \
+  --parallel="${STACKIT_PARALLEL}" \
+  --tapfile="${CIA_TAPFILE}" \
+  --channel="${CIA_CHANNEL}" \
+  --basename="${kola_test_basename}" \
+  --platform=stackit \
+  --stackit-service-account-key-path=<(echo "${STACKIT_SERVICE_ACCOUNT}" | base64 --decode) \
+  --stackit-project-id="${STACKIT_PROJECT_ID}" \
+  --stackit-image-id="${IMAGE_ID}" \
+  --stackit-type="${stackit_instance_type}" \
+  --stackit-availability-zone="${stackit_location}" \
+  --image-version "${CIA_VERNUM}" \
+  "${@}"
+
+set +x

sdk_container/.repo/manifests/mantle-container

@@ -1 +1 @@
-ghcr.io/flatcar/mantle:git-03c3e3d8e8d132a6753c2e9cb205d32ff31564df
+ghcr.io/flatcar/mantle:git-80a351a1411fa6fcc14071f2ea287cab5fa08c73

sdk_container/.repo/manifests/version.txt

@@ -1,4 +1,4 @@
-FLATCAR_VERSION=4455.0.0+nightly-20250911-2100
+FLATCAR_VERSION=4459.2.4
-FLATCAR_VERSION_ID=4455.0.0
+FLATCAR_VERSION_ID=4459.2.4
-FLATCAR_BUILD_ID="nightly-20250911-2100"
+FLATCAR_BUILD_ID=""
-FLATCAR_SDK_VERSION=4455.0.0+nightly-20250911-2100
+FLATCAR_SDK_VERSION=4459.0.0

sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.47.ebuild

@@ -1 +0,0 @@
-hv-daemons-9999.ebuild

sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.74.ebuild

@@ -0,0 +1,27 @@
+# Copyright 2025 The Flatcar Maintainers
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit coreos-kernel savedconfig systemd
+
+DESCRIPTION="HyperV guest support daemons"
+KEYWORDS="amd64 arm64"
+
+src_compile() {
+	# Build hv_vss_daemon, hv_kvp_daemon, hv_fcopy_daemon
+	kmake tools/hv
+}
+
+src_install() {
+	local -a HV_DAEMONS=(hv_vss_daemon hv_kvp_daemon hv_fcopy_daemon hv_fcopy_uio_daemon)
+	local HV_DAEMON
+	for HV_DAEMON in "${HV_DAEMONS[@]}"
+	do
+		if [ -f "${S}/build/tools/hv/${HV_DAEMON}" ]; then
+			dobin "${S}/build/tools/hv/${HV_DAEMON}"
+			systemd_dounit "${FILESDIR}/${HV_DAEMON}.service"
+			systemd_enable_service "multi-user.target" "${HV_DAEMON}.service"
+		fi
+	done
+}

sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild

@@ -1,31 +0,0 @@
-# Copyright 2044-2016 The Flatcar Maintainers
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit coreos-kernel savedconfig systemd
-
-DESCRIPTION="HyperV guest support daemons."
-KEYWORDS="amd64 arm64"
-
-if [[ "${PV}" == 9999 ]]; then
-    KEYWORDS="~amd64 ~arm64"
-fi
-
-src_compile() {
-    # Build hv_vss_daemon, hv_kvp_daemon, hv_fcopy_daemon
-    kmake tools/hv
-}
-
-src_install() {
-    local -a HV_DAEMONS=(hv_vss_daemon hv_kvp_daemon hv_fcopy_daemon hv_fcopy_uio_daemon)
-    local HV_DAEMON
-    for HV_DAEMON in "${HV_DAEMONS[@]}"
-    do
-        if [ -f "${S}/build/tools/hv/${HV_DAEMON}" ]; then
-            dobin "${S}/build/tools/hv/${HV_DAEMON}"
-            systemd_dounit "${FILESDIR}/${HV_DAEMON}.service"
-            systemd_enable_service "multi-user.target" "${HV_DAEMON}.service"
-        fi
-    done
-}

sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest

@@ -1 +1 @@
-DIST nss-3.115.1.tar.gz 76656855 BLAKE2B ce0ddb2eb17b079131210bbf82c6d614b5efe0b6d6fefb88461ae59518afd870011f278480ec14cbaafab88d715833acb3ae4e56347fb413516d5fceb547c9e1 SHA512 c75ab9bdddeda40d0e50837f47539b370b342216aeabf82614285485b50461600623e9a506e6026cf0928f6b0ada05a02ac1a060fca7938049b3471ac418a008
+DIST nss-3.120.1.tar.gz 77895555 BLAKE2B 01ef3591010cd33dd61962d58442c6d4eee553d38101d65f9f20a50b576f1ceef0fb9f674b2caf1eadcbef63b12d23c5e494112397cc8f546f7d48dc65ed8b47 SHA512 9eb9aaae7070f0c92612e75922d3c4646f26e989a5c4d935258cc1201ceeb72accc43cbe6af83609457991a9d1d4cb67429dc8a3f3ffeaccf15cca32689921bc

sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild

@@ -9,11 +9,11 @@ inherit python-any-r1 systemd tmpfiles
 RTM_NAME="NSS_${PV//./_}_RTM"
 MY_PN="nss"
 MY_P="${MY_PN}-${PV}"
-S="${WORKDIR}"
+S="${WORKDIR}/${MY_PN}-${RTM_NAME}"
 
 DESCRIPTION="Mozilla's CA Certificate Store"
 HOMEPAGE="http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/"
-SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${MY_P}.tar.gz"
+SRC_URI="https://github.com/nss-dev/nss/archive/refs/tags/${RTM_NAME}.tar.gz -> ${MY_P}.tar.gz"
 
 # NSS is licensed under the MPL, files/certdata2pem.py is GPL
 LICENSE="MPL-2.0 GPL-2"
@@ -72,7 +72,7 @@ gen_tmpfiles() {
 }
 
 src_compile() {
-	local certdata="${MY_P}/nss/lib/ckfw/builtins/certdata.txt"
+	local certdata="${S}/lib/ckfw/builtins/certdata.txt"
 	${PYTHON} "${FILESDIR}/certdata2pem.py" "${certdata}" certs || die
 
 	cd certs || die

sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/common-oem-files-0-r11.ebuild

@@ -50,6 +50,7 @@ AMD64_ONLY_OEMIDS=(
     gce
     hyperv
     vmware
+    nutanix
 )
 
 OEMIDS=(

sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/scaleway/grub.cfg.frag

@@ -0,0 +1 @@
+set linux_console="console=ttyS0,115200n8 earlycon=ttyS0,115200"

sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild

@@ -8,7 +8,8 @@ EGIT_REPO_URI="https://github.com/flatcar/init.git"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	EGIT_COMMIT="dd9cbe449efb7134f885b07b16425eb51fb808a8" # flatcar-master
+	EGIT_BRANCH="flatcar-4459-backport"
+	EGIT_COMMIT="e4a70e49b97fbcc427f8e2bea5f8406c10bebeac" # flatcar-4459-backport
 	KEYWORDS="amd64 arm arm64 x86"
 fi
 

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-nutanix/oem-nutanix-0.0.1.ebuild

@@ -0,0 +1,15 @@
+# Copyright (c) 2020 Kinvolk GmbH. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="OEM suite for Nutanix"
+HOMEPAGE="https://www.nutanix.com/"
+SRC_URI=""
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64"
+IUSE=""
+
+OEM_NAME="Nutanix"

sdk_container/src/third_party/coreos-overlay/coreos-base/update_engine/update_engine-9999.ebuild

@@ -7,7 +7,7 @@ EGIT_REPO_URI="https://github.com/flatcar/update_engine.git"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	EGIT_COMMIT="aa31b3ea36b2c4d585406ab13dbdf2c4e8959a99" # main
+	EGIT_COMMIT="3a44be455f7c6978e99f9e3d4f01401d80301c40" # main
 	KEYWORDS="amd64 arm64"
 fi
 

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd

@@ -11,3 +11,16 @@ After=ensure-sysext.service
 EOF
   popd
 }
+
+cros_post_src_install_udev() {
+  insinto "$(systemd_get_systemunitdir)/systemd-udevd.service.d"
+  newins - flatcar.conf <<EOF
+# In Flatcar we are using modprobe helpers that run depmod in temporary
+# overlay. systemd-udevd.service may try to load drivers for some block devices
+# (e.g. ZFS), which ends up calling our helpers, which invoke mount command.
+# The mount syscalls are forbidden by the default systemd-udevd syscall filter.
+
+[Service]
+SystemCallFilter=@mount
+EOF
+}

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -92,6 +92,9 @@ dev-cpp/azure-security-keyvault-keys
 =net-misc/ntp-4.2.8_p18-r1 ~arm64
 =net-nds/rpcbind-1.2.8 ~arm64
 
+# CVE-2025-61984, CVE-2025-61985
+=net-misc/openssh-10.2_p1 ~amd64 ~arm64
+
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
 # latest version of the package with the unstable keywords.

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask

@@ -26,3 +26,7 @@
 # who knows.
 =sys-firmware/intel-microcode-20250512_p20250513
 =sys-firmware/intel-microcode-20250812_p20250813
+
+# Make sure that we stay on version 3.4.x for OpenSSL on this branch
+# even if `::portage-stable` holds more recent version (3.5.x)
+>=dev-libs/openssl-3.5

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use

@@ -157,12 +157,9 @@ sys-libs/libsemanage -python
 sys-fs/zfs minimal -rootfs
 
 # Do not tinker with /boot partition at installation time.
+sys-firmware/intel-microcode -initramfs
 sys-fs/zfs-kmod -initramfs
 
-# Only needed for direct loading by the kernel, which is dangerous, and we
-# include all the microcode in the initrd anyway.
-sys-firmware/intel-microcode -split-ucode
-
 # For sys-auth/sssd
 net-dns/bind       gssapi
 net-dns/bind-tools gssapi

sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild

@@ -7,7 +7,7 @@ EGIT_REPO_URI="https://github.com/flatcar/bootengine.git"
 if [[ "${PV}" == 9999 ]]; then
 	KEYWORDS="~amd64 ~arm ~arm64 ~x86"
 else
-	EGIT_COMMIT="31ba2964ce5e77ae5553eb0a3624afcc7078bb09" # flatcar-master
+	EGIT_COMMIT="daf43bf9c1ca45bf1a43566c3a6f96ec0cb44a36" # flatcar-master
 	KEYWORDS="amd64 arm arm64 x86"
 fi
 

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12

@@ -467,6 +467,7 @@ CONFIG_MEGARAID_MM=m
 CONFIG_MEGARAID_NEWGEN=y
 CONFIG_MEGARAID_SAS=m
 CONFIG_MEMCG=y
+CONFIG_MEMCG_V1=y
 CONFIG_MEMORY_HOTPLUG=y
 CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_MEMTEST=y

sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest

@@ -1,2 +1,2 @@
 DIST linux-6.12.tar.xz 147906904 BLAKE2B b2ec2fc69218cacabbbe49f78384a5d259ca581b717617c12b000b16f4a4c59ee348ea886b37147f5f70fb9a7a01c1e2c8f19021078f6b23f5bc62d1c48d5e5e SHA512 a37b1823df7b4f72542f689b65882634740ba0401a42fdcf6601d9efd2e132e5a7650e70450ba76f6cd1f13ca31180f2ccee9d54fe4df89bc0000ade4380a548
-DIST patch-6.12.47.xz 2896968 BLAKE2B 4064af2ae029d13d63a0a6cfb9e4121266ab33622c03e088ad3544a0f5bf443d75a2ff2f7c35b58d7cc8669acb0eac93165cd3bfe5d8567f332516850bc9f7a4 SHA512 19bb9e9e235fa408e3b37dd6fe475f1dc7690bd09274dcdcb722ccc9733da9169dbaa97dffb15e0b32da6a62cd89b2da8cad32b4d2f16f2fbbd9d023b5ebae9b
+DIST patch-6.12.74.xz 3867664 BLAKE2B 1bebcfc1bdaafcfb9205870d72c815fcd69225ae6216ef859be09dab8798842559bcd9c725c039909e605085f2bf3e67ab56d2cd0baca01c475d0bc4bbd5419d SHA512 aca0c0c0ce0f2cc427aecbe55867297d013af298b3d10cafed5695166185a6933fdffec76fd3bb90a172591fbca9924ec5abd3d6b32bdf5d3eaee16a32abe76b

sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest

@@ -2,5 +2,7 @@ DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46
 DIST containerd-2.0.3.tar.gz 10450757 BLAKE2B 5dec56a40dc2874fb0b6fd4d72704f6417858eefd983c8ec5dfb2c9ef8be1e9e309cff83395e03c2d5fef30ed5c0561329ffbcd3dfba91e40d8017f7a605771b SHA512 9528a65d9d9f13d15d861f7ce71ab483958020bda83947d18868b477204e9e2e33eccc69280502c54b2be9ce577724e3e2b1772229c99636099b04bac1079ac1
 DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9da8e33b1140c0b5866dcc61e17fe1040f31ef09bdb07ad98a52def5e9eb12cfeb635e96b2c5f64fdb4d8cfb6c84b885 SHA512 f84e0cc0b82313df010b95989faf56e81ebfbbc321585b968c8c706917b91a9f0d895692fa5046f24f1c370de7a74b50daf83da617fe0595e5a8ff69ed658727
 DIST containerd-2.0.5.tar.gz 10452563 BLAKE2B bf03316c9211eaa17a3b40b1fc9f9aca42fe3e621e086e612eb07c286c6b62bc7a0a2426ce7b6742dce2924d570ab599aefb43463c4fa6be277e562bad79668f SHA512 af89a5c9ad5f931c5fee33c75c13c296fc9ec966f2c64ec244897695eebb365bcb542f6b431e60d4ef7213f0ea11d3a8896d1b7f033ed445e6b521b7ddbffe6f
+DIST containerd-2.0.7.tar.gz 10465656 BLAKE2B 656787c91e913fee32af282bfe82dd78a2732b113ff06adb157787efd5ddca31d13e7acf26e5e59ef51d233ecdee8b89200a9a8048e8422b6d4bd272a047c1ac SHA512 393e6f6357806367b7e007da7f2a951fb4330750d4e16c8e612f49c9b5d62a9f6a2b866dc12317da11dc75f2f2cd7e2e9b5118a3f07e5a68d3475d0449844a4f
 DIST containerd-2.1.0.tar.gz 10610618 BLAKE2B 147c21b4650543af9b0e533e381a0505ba927d6e9270b9b03a09016eb3ccf29875db7fa274944fea2ff7b029b6a05a17d14c61e24b5f3426b31f320831eeb46a SHA512 e9bb128917bb6b2e21a8e05344af3fdcdda8620be20e54407bc2c73046278a88a77bcbed6ef7a59099c9ee3303283db46b90b71afdd45236d3c534749ba844e0
 DIST containerd-2.1.1.tar.gz 10610787 BLAKE2B acc2d769752c783643795d228c0d267b0802e09166dc783e84087da0029a822a64688f5e59c047c47b25f50ca2a1ccb7f5b6216ad6beeb4489df308e525e9716 SHA512 542f7cae61e1ef2e1b529b0bea66d7ad9016d4605de73de9c9c8a738e50ec6f470b939d1546482320515b77424bffe1cf24b721173ac0c0ecd0100c92817cfb1
+DIST containerd-2.1.4.tar.gz 10614131 BLAKE2B b8f4007b4bb368a1fa04c913d606f65d2ea4a17a6419ce12f2b6112eee2574d7a09fb8e2500d1c2f21bef8792dc047df4d63446211ae006662e616facda91f24 SHA512 a9f84784e917621ee5ea38ad20b8106e642fbf463a00d319b73a1a8e4d1fdd5be2fba0789b6a5d31107ef239d3713eced99ce979d4b2764714271a63c0936c15

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.0.7.ebuild

@@ -0,0 +1,90 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=4ac6c20c7bbf8177f29e46bbdc658fec02ffb8ad
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.3[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.4.ebuild

@@ -0,0 +1,94 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=75cb2b7193e4e490e9fbdc236c0e811ccaba3376
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}

sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest

@@ -1,4 +1,7 @@
 DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
 DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
 DIST runc-1.2.6.tar.gz 2763135 BLAKE2B d5e40e95f8c0069073d0010d120aca1828e585b103ecd671fca072138ef3528a316414cfac5ca725f45cb84f23ab4216d9e6f466beb118fb2813ab4be3a18e92 SHA512 9a89295e001914726dfc1040729301f62ad6b630943c65f7ade6ed460ef4a2f5f35cf40662730a9e8a6c6d0301a3c9959a85973097ceb8db05c043f9c1a86248
+DIST runc-1.2.8.tar.gz 2834651 BLAKE2B 5f76e40ee8bda4668758dce318625af1dbb13c0d33a17c9c872bc68aefd6311cac570ed934a69b92b4a327c6084ff6d6d55f8914b105513f9484bbc903107a4d SHA512 8d29a2ca179320f9a01c37383506f10aea1764e18b3321c507787556e3a531e23221f8369696d8caaf30124a523a68d0ad3609bae5ab06aa6c519e644d54d4ef
 DIST runc-1.3.0.tar.gz 2858199 BLAKE2B c9402a074b816b9452763267a7ffdc69af6c0cd4cf54fbdfdc91ccbd8bbc5daa783259176775e90f6266fa6a02bf0bad7fbb8eb879b5764309f7f9cd2f246086 SHA512 63422501f6189d0d47f6b2f59565de572bc68b138a65c7dbcc8b5ad42dbc37245ee66e2683ab61971a84c076a15f54f484c37fde4a30815ee19edc9a0d97e9f4
+DIST runc-1.3.1.tar.gz 2860795 BLAKE2B 5711881488dc3d52182377dc09690436aff142552d35728b10c221874a1dafc3b1fe78972891ebfc53e232465aec97eacc78318a453b030c052ca2218c61438d SHA512 0a3007d046fe9711541e29ca07fd72515f19b220c8c79b9df9164f7b88a6b9077ba7a11607593b641823b9e99c0f2e96500a57e2a16e11501bbb7c4690870183
+DIST runc-1.3.3.tar.gz 2929410 BLAKE2B 1feddc154836eff606a685a0c0d606c1bbcd5a1a1ec8a288233581a88e0b3b6a95f446125688a8dca5efd5a275bf22931553cb9ab894f6aa0826d5a1274b6f91 SHA512 9ce0af1b79163c44913979c0483322247b154109871a113726163f64c6354141e7cefb5fb6e1225eaa4bb48a1e33ba9a6049cb45cb2af8793134647dad18c8dc

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.2.8.ebuild

@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=eeb7e6024f9ee43876301b1d23c353384fa6dcdd
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.1.ebuild

@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=e6457afc48eff1ce22dece664932395026a7105e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.3.ebuild

@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=d842d7719497cc3b774fd71620278ac9e17710e0
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/Manifest

@@ -3,23 +3,25 @@ DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1
 DIST openssl-1.0.2u.tar.gz 5355412 BLAKE2B b2ff2a10e5851af5aca4093422a9a072c794e87b997263826c1c35910c040f695fac63decac5856cb49399ed03d410f97701d9fd4e1ebfbcacd8f3a74ce8bf57 SHA512 c455bb309e20e2c2d47fdc5619c734d107d5c8c38c1409903ce979acc120b0d5fa0312917c0aa0d630e402d092a703d4249643f36078e8528a3cafc9dac6ab32
 DIST openssl-1.1.1w.tar.gz 9893384 BLAKE2B 2fdba6ca0188928ab2f74e606136afca66cfa0467170fa6298ef160b64ac6fdcad1e81e5dd14013ce0e9921d0f7417edec531cd0beaf1196fec704c2c6d48395 SHA512 b4c625fe56a4e690b57b6a011a225ad0cb3af54bd8fb67af77b5eceac55cc7191291d96a660c5b568a08a2fbf62b4612818e7cca1bb95b2b6b4fc649b0552b6d
 DIST openssl-1.1.1w.tar.gz.asc 833 BLAKE2B d990be69ed913509d52b78e7473668429d4485adb29ef03e4612dd0cadbac4f04c7289d8e5baf6f397bcedeaac9f802f18fc719964d882ae0514ed1ca16ae277 SHA512 0f3d7aa48b1cabf8dd43e8108aeed10a4dffb4f5a244d4da9c86ea358b0c8b90c46da561d21e01c567c2f5035d824ed82ec104aad1776b7f33a1be85990e98ef
-DIST openssl-3.0.16.tar.gz 15334967 BLAKE2B a1bcaf17c92beca6ff7f39857788120648904ef1dd25ffa2e43bd5477810e8c18751929d5ed270e7f429c569c5b5fdf069f1280646d8b4d1e879f15dfa03f7d9 SHA512 5eea2b0c60d870549fc2b8755f1220a57f870d95fbc8d5cc5abb9589f212d10945f355c3e88ff48540a7ee1c4db774b936023ca33d7c799ea82d91eef9c1c16d
+DIST openssl-3.0.18.tar.gz 15348046 BLAKE2B 2cb9cefecab790f6e857a63e2ade93e1b28fdfab7110e4ed6049c36c7cc2131e88454cb49e70e0802adf6f9317b3f21e950446a9152b58074f9ffb787732716a SHA512 6bdd16f33b83ae2a12777230c4ff00d0595bbc00253ac8c3ac31e1375e818fc74d7f491bd2e507ff33cab9f0498cfb28fa8690f75a98663568d40901523cdf3c
-DIST openssl-3.0.16.tar.gz.asc 833 BLAKE2B 5f288f4b1e3a85181a73f288c7cb2d2e6e54e09b3ba032a6074c207f1f53d2920f4cdbbc9143a60063b3426eaa0279af4b1ed59b6b909047051ce73caff03584 SHA512 8b9688ecf84cb61b2718fc898eb748a8eb1ad9125f4742b09552d81bce098753dcbc36cdee9a30adbe4127de30938d955a7af12f8619338bcf2e2e748c8e8c86
+DIST openssl-3.0.18.tar.gz.asc 833 BLAKE2B bfa698106e314bf8800c5bdf9ec892611a91a2bcb006b7e5f52afc5d0af64be65bf8512e042b37d36db041964aa83c17f4b1ee2f22dcb127d4e4665d3b6c9440 SHA512 cd4cd8afab68cbe0a5b034039112901cf8a25711c55556681f86b04e47389bcffae85a98f155a517156dd9fb29ceb82f627e371881feb928e887053f145bddfd
-DIST openssl-3.0.17.tar.gz 15344831 BLAKE2B 4f7df7867ece7043d8682b8ebfacd4611abb81d977bef36b1183dcae7fd136d1bf4ea7bf1d24a165211aaceba79895814b82586305177d3066b0cad729059882 SHA512 563546cfc0766b9a690c20bcc7df1afed843c3c57df4b8fa561d4c695e6f5cc3258a2cd95775f8fb5fd78005198ee20aa58c3fc19fdefbe5e60b8731390842c2
+DIST openssl-3.0.19.tar.gz 15280904 BLAKE2B 0d21fd9037b87c5d22c75e2201208394fa7d6a37ed7a44cc6ae760ab95ff6743a00d26b90141871ba5bd76a56500142df33d04219379e51b6f74e411e9d2b3af SHA512 6e602ac7217e1b4423793ee5c4c10745f70fcde3f9820d6c894ebeedb4f29566e2d0c3c590ae210484dcea4eb53db5bb8dbbfee14bbaca3e147406b1343c3cd7
-DIST openssl-3.0.17.tar.gz.asc 833 BLAKE2B 908b65ba1454915b767947003978b452feaa54e58c20dac6bf66c497de28213b3e06e73c55991fb09d584e6b2d9cb5db688e6927b5afc847f62c0a30a2b2ee43 SHA512 d07368696c698cb5f0f194be90f110c84d961c58c7d311106a3ef235ee3e1e1f8473a53e61add48aca7630ce010b5457e90c92da6fee4b576689d0a9ba59864c
+DIST openssl-3.0.19.tar.gz.asc 833 BLAKE2B f5ed372d80afc3fde1c4298166fabb512bb0f350725497d98a83575b98b049dd8ec3dc169043b11f9135702d37d762bb24afd98eab75d5a42b6554bec2064c8f SHA512 3ae5adb82d071658c3a839d7713c7d4fd09b13dc36860327d0347ca94cb0c712081f03d3e8251af2297b7d1792345a078e18ffa8b92e5f90fe6d5370152813e8
-DIST openssl-3.1.8.tar.gz 15706439 BLAKE2B 05d8ac054bc46ac6196470bd388ef8be2d2dd62c14bb22fff668ab8e8914bb8d89eb78119ba49839a364ca4c3683186299a9bfbf6a03d83a8630b54e668e5977 SHA512 faf066b207184a67387d4659b68de0bb89c4ec847b835998c8cc57ee4a8759f3fc3b7fe2db85f394bf8c54720ce044447168e0fa2fda6f0901c4d9a1697d9a6e
+DIST openssl-3.2.6.tar.gz 17805999 BLAKE2B 3c1410d8f8aea119828259cd88d6e8336d20b5176a4b0e1907c79d76fef5954f658bb5c7fd2b20985ed7ee5930842a39c6b1a9aa1a0944c00ead0f81f2c3603d SHA512 a183b9ecfcf75f1dbc7911d726adb26f9da83e307b593dbbd7ded5f46170b63bac44e403cef53d16daf2d8dc116f8c2eb820c9de50d073c75681ef8e5de01c05
-DIST openssl-3.1.8.tar.gz.asc 833 BLAKE2B b9f1f439ff373d4b3706cfd9d2518d84aca1744ae50a31c50cb7fd4aa9de1d4139fc314390353377391a99b3d6c9ea66b0160d7fed15bdf4c9a255e94654eb80 SHA512 0737d62b6971f311936908d7cf3eb6c01e1ae314709bc80cfdbe885d17c64337fd2378a1e93c932f870681efc992a8d0656625580e30cc9e3d397aa4ebb7c7e6
+DIST openssl-3.2.6.tar.gz.asc 833 BLAKE2B 9f332db499dea93760e1d2f881115cd5c8574141e42b86429d2b009ac6f698ef7341f1a5ff407803506c06fd59e3fe243387befb2ee68584ce88893364c09a17 SHA512 2bfbe94619349fa7af86109a7ad84588a033e690a45d5500e3f1332891e5cb39f18ee631a307b6c8aa5724f2c684b90f276d071a91556f01312bed83d7b30aa3
-DIST openssl-3.2.4.tar.gz 17782746 BLAKE2B 079a0eb15b960a8ec89a2b2ccfa1f5e216dac325cb0857e168119fb240b6cdd78ecf723802a53d1e62e0a534be60e5459f561de764d1987e38eab466e555f994 SHA512 24712cb722ed8daff51db9deec4db982256cccd1a537d3a8690a94a6fd41815fd85cab95e551212938f28a61ed658d285b07734f7b88d8a0b18a318602d424f2
+DIST openssl-3.3.5.tar.gz 18125182 BLAKE2B 377a9a2cbc1f97fb34f1f314789354e047e1bc875eddc4e2aa50578009a3352e196ea33b0d6f57ede199b16d4b0e6096782a0d70ea1a4d923d5543b1caf6ca02 SHA512 4fe2d51afefd21af4e50225bde6dfd2c12eb00ce2a144ee1aadba48463604cd180135b5f71fcea3908977b043ffceb7d2824fa30b969a017df016dccd8519aad
-DIST openssl-3.2.4.tar.gz.asc 833 BLAKE2B 27c55522889843a14133535d47ad1fc7b2eba7a6f7fd0f78a8be8f36492ff53932b1a50131e90a37c3c22ba60b188b9dff98717756c4a20f361b22d069482399 SHA512 a381b24bd47a2e00657a29af02aa890b22186de70ba3ac3776ff5d4fb40579e9fd8356aacb6ce230d40adb6765e906b8d9bda54f98cc8887e98069f9bfd10140
+DIST openssl-3.3.5.tar.gz.asc 833 BLAKE2B 7a6e93e68981436932bf3e019e9021863dfafd2699065959086ac1b1f2bda278b94965f5027794ee565e2a80d8c4c0b796b6e17063eccd38e5ec723cfb2411ba SHA512 b79526a5cf0326b63828d534a3ddd2cb5699a226a485345017c9a1ef34fe7610a62a2b6b90d171da8b4660a9937cdf7688c08b93d6e05629a8648627a928676c
-DIST openssl-3.2.5.tar.gz 17800797 BLAKE2B 6d1dad57e6700ac9e14912e6b96a486d40ac5fa2567d129c0f4d9bed8fbd408f65000a1d4fcd2ebc49ecd118bfa03a504cfb24da38bdf4530cd250046cf05de1 SHA512 a0662f8d35df9986ade5332d86c8d79bf9d98f4a92dbf63e177be2cf24bc633fbcb2758fdc5eab425aaafd48d9b6fdf32602c915e61f8278e1b78452d54dfc21
+DIST openssl-3.3.6.tar.gz 18035615 BLAKE2B 3cc0b33885449192863edc4600d144a98903d2c323f4a6f11e2aba8e6dfa5fa45a9d025d5de60c0511972cb42de9ef7fc81073d8abc5d1d2886b660089b9aaf5 SHA512 3c0840420f30f74404446a9d9fe9ee48222e867190ddc9e51e1c0f1f45c3c0caad6cb41068f65adc2be2aa5e0b8447c42ee821dd28e2ec60140cf004dc3493c1
-DIST openssl-3.2.5.tar.gz.asc 833 BLAKE2B 591629a5435de5b715b58c4758797bdfd99586dc8807cbaac0f80010b51adb755864ed5694e15a35f1716f905654632ff6c591c6923d5d67ced27d43a60964d6 SHA512 b3b7fa105caed32de357db55023a114ad9704324887f51979c2e10b305a91774026fad28dab37b733a57abaa941b2793fbd0ad333bf35d05b8a0b1cf03172d79
+DIST openssl-3.3.6.tar.gz.asc 833 BLAKE2B 93ea9f040912defd9a228309ce110b1dc535e219223afb0299eacbabb17c333bc282a7656bd870f3d01aa69856c409908d3d0610e541a56d919b1f204bd0b571 SHA512 90f7a392b1348f74e3617212fbad8974d92b8d48832a8d5c338ad792ae25a067ae102475ba935cd41d1a5d89e80458a5f05ef921e942279149d8534bf9ac01e6
-DIST openssl-3.3.3.tar.gz 18102481 BLAKE2B c2033e357963e339faaf3b35b18c660da48616a6228e802a3ef1c4a6a51a570db42970d973868c4d57afcd3953403c9ff047317cac49a865af628abde99c2ade SHA512 4f53d963c258305f0e926d2e56fc73359c3d62adb25bfce06889eef3278652d073b9e2a4100a884c0d8ee90cb924ba258a5de4e7be6d2c7c49765167e95430d7
+DIST openssl-3.4.3.tar.gz 18369414 BLAKE2B e74392b93696d4967d8ec1d0edc2f2d559e56cf6cb28207708d5288a3df2854b37e21b33c9a816829d4215a7575285dd91b65770d0333e966fcc800837bfe3d5 SHA512 84d73d8ee1032b911bd60c8c0c69cca14e37c80c57735789f23d49b968388c641a75add3b347b222228cbb629f0c10c17a2f6c139547bdd261f4bab4a78eb94c
-DIST openssl-3.3.3.tar.gz.asc 833 BLAKE2B dbb8436f7e8e015eca740ccddcbfc159884089c7540e47d03d65efcc607a28d29889f7eaf53412e50362d201941df3061e7877b6216215d4cab04bdb149d23a7 SHA512 2fde16310fc0a2985ea9df5b8485c17391a589297679687634b833b453e9c5d04ddb3b8b4f117259af9b13813ca0ea9ee6cec2d854dfc7e1add3dbb78962ccd0
+DIST openssl-3.4.3.tar.gz.asc 833 BLAKE2B 52c5c0753230812ce251b274e2e934e9746c51e11aeed73046a5408356d620a32d5703bffe3c0d8933ebc03c659b80d8b1d7d6a77d4876620d0fea3aa54b27ed SHA512 510fbbb693549b0aad3004739f001f8569ca17a859848b48a58afac3f1bd2f92aa2bac649a492fa32bad4e5d5c14f4a6e341253bc6cc9536428307be71daf516
-DIST openssl-3.3.4.tar.gz 18113350 BLAKE2B f4a2c050eef854212b4518e04f5746c65a0cf22437eba11a0eb095158113836f181e25891021f923700a939d792e537b71c650991b3346eb6ca0a5053f565409 SHA512 7f01240b745ee6b3af6935ec3fd3be700f7be243b092d3265f160f1da12d52efb562755fb2b41240bc12a22a2ec7440fb21d4c53183c6a91c4182e0e8a2adfb1
+DIST openssl-3.4.4.tar.gz 18278255 BLAKE2B 022d97f839120bdb21a8fa011b42cd1e0f732253f4b7e02172a8cfb5f6a60c855500ce542d49e256ff3cb6428a929487e921ee4834f74dd57d10165ec44924ab SHA512 2f75b045f0dddd2421ecd7b1817a4e5a7608293e797135eb945573d1115b2d89f0fd3706ee5e02c7de2e50b3bfc59ac73014e2cb6270ff6b9e1515691347dbb2
-DIST openssl-3.3.4.tar.gz.asc 833 BLAKE2B 75097d89f505070b4aeb0660c725726ae4fefd8d46becf786a75fe6c03727fbdb07c0699e1b6f002791cd2b791f53bc636c5e249ab25fcad2235ee6c3ff5a9d3 SHA512 76cc3eb3e09dbf3a22531ba1b5b945d41525850d74ce155a13a0b0955f51f857e7e7246b0fc24bfe9a9cb0dd45aee059faa22cabd7b0db862e537be0f4a043c5
+DIST openssl-3.4.4.tar.gz.asc 833 BLAKE2B c8c4e9338e5e6f4630701e894e551bd0606401462762755832e607d3145688624b61beba0c6128f6fbc632d50b8eac13da7c4530300e5579527ad4523251f521 SHA512 a599e8d77426de126a6358d159b46ab9d301962016fa85219f0294e6eb667733436ceeccb0de6017adb71c1b9cd52a496882919e9edd65e749a8ae95d5143cb4
-DIST openssl-3.4.1.tar.gz 18346056 BLAKE2B 328a2a4f0536b15ffe6421afc99bdb5dcdf3d29f44437fdd80bbf4089f5f2658ca10907e033eda2e04c6b862e49b150ea59d8ab1807d14a3dcf64e10c32e78af SHA512 1de6307c587686711f05d1e96731c43526fa3af51e4cd94c06c880954b67f6eb4c7db3177f0ea5937d41bc1f8cadcf5bce75025b5c1a46a469376960f1001c5f
+DIST openssl-3.5.4.tar.gz 53190367 BLAKE2B 07e02f88af05e189385eef28599b81bd16d242130975c79df46e565a0dd92f74e59807d4770a2b3316adf08f2ca6a0dd2bfc96ab2a88a8dfb5c0d19197fe8fbf SHA512 365aca6f2e59b5c8261fba683425d177874cf6024b0d216ca309112b879c1f4e8da78617e23c3c95d0b4a26b83ecd0d8348038b999d30e597d19f466c4761227
-DIST openssl-3.4.1.tar.gz.asc 833 BLAKE2B 321a5593ce5a1ff07553dcca722b0da0e9e9f3ef639176d663b6a92be2a32d3379536a788930f7f78dccc4e4d4922fe696f8d1bd65aa54f51c3c75accad34b1f SHA512 b007d5a35a7904d5d5e053e232a54b2ba75fb43f80bf1fe2175528e86e31cca8161da09d7417b50359008ce1955497e4d11c46794f15cc7c3220aa92eff99ccb
+DIST openssl-3.5.4.tar.gz.asc 833 BLAKE2B 837dfd4778073dbecdf5859dfe11b81dcecd9796a13c06c36c6dadfed04f9cee158759d96116ae8d0985ba29bcaefad874824b8f633f13c252b79a9e28fa7303 SHA512 7bf10c965e5f376979c8cd0a24560ba9d0169ee41d43c54f78642d50d9a27bf111c5553b1ee4c6c1b459b00d465681dea8ba983d0a0396ecc52b9e561769ffe5
-DIST openssl-3.4.2.tar.gz 18357346 BLAKE2B f773b8bd1bcfeae2c906c079598460cb87aaab5a39691b00ba27864b30261ae69af4314a28e0209707e1954b3ec2dfc920be4a21c96efae29e596b315d9821ab SHA512 5633659dd6ccad48a16ddbf3c0d35eb6df7d4ed2d1d99e5bf2fb7ba0b6ee955e14b671e9b3be3794151f35754b9969b4243317c28bae5b48e24d89930579cc31
+DIST openssl-3.5.5.tar.gz 53104821 BLAKE2B 5fe5f7e768ade2dcffdd90841875de3e3a463aac979d57462fa5c69ec5e7288063dfc35cd6b049db007cff9135089fa05956f715476e12efc58a7d6969f6d29a SHA512 7cf0eb91bac175f7fe0adcafef457790d43fe7f98e2d4bef681c2fd5ca365e1fa5b562c645a60ab602365adedf9d91c074624eea66d3d7e155639fc50d5861ec
-DIST openssl-3.4.2.tar.gz.asc 833 BLAKE2B d278d061c09896c6819e479092c96c371515fbae535f9c4848f79660a1c1a444737a17299873e6dfd190f1f11f4d662b78940ddddea2e2514a801765cd39f452 SHA512 c6df601904db0415ac100a496367e3c6cd59b3eda76cf0bfe3fc39805ff05dd717d87016a144391701f4bb141f303c88b9ddcf812db28858b8b9080126832afa
+DIST openssl-3.5.5.tar.gz.asc 833 BLAKE2B 122e9abcadb8559ef42dda7cc985c1457852243f8e8fb12e9a1d3b824853a56f311726252c6b1cfde47c3d5500bf36c18d8f7f19c42582c8f40d974dac22011f SHA512 82645f4fb427467b1e52f096ef6c6ccbdaa5aefcd28c8d3149a92f7c7711d0936e1e097f4168db6196809c19f83c1b85068d327cc1f0c5ad9f33d9d3686003d7
-DIST openssl-3.5.2.tar.gz 53180161 BLAKE2B fd6179457b85d7a2ae87ee432de4d9e0d5b5dba30b6b57d0f289a0d034c6d7de7c7166b1f69f00d822105c5119bfa44fd52bf5b9035a14aae21015ad3fe2d224 SHA512 db2c7a88bea432f96d867a98af15f850f371d4136c657338de93cb88a39a3578c025b5df7310e195a02fc715ad5a2422a319a44f0247c6a7e2ba8b36aad77651
+DIST openssl-3.6.0.tar.gz 54974351 BLAKE2B 4a0150aa9a78581e74119b338848458249630c94a43589a5b311d41c669b817b043007ddd13b3fb81233da10af3ccd455f3fbf3b09cf45016c475a8e2044e965 SHA512 866825a1cdf0b705b409402fbc7a713e7d9b8e7736c5126be57b354927954c148a341fc52b02c0629c1e015a889bfd40217f8e703b73235892e91da060909b76
-DIST openssl-3.5.2.tar.gz.asc 833 BLAKE2B f22883c76bc636f6d5916913486ef0873da91b0e29dd24569def0409e8573ebe23f28b9e3b3ed6120fb85afaa3181470b8fc83959b40389d8b1cd2dc4852f404 SHA512 2be00d03e5b246833f8e47f59bd7ca3dbaec519f2160fd9dfed3a7b2c65b9977703811c06662c17b301e456bbfc73477c76e3b444329741e99e2576005900580
+DIST openssl-3.6.0.tar.gz.asc 833 BLAKE2B 47e8aff0e9c0306213c0e3db689c16f7ee65d28a3d1201f317f184980237725598cec5256fc3453e48802ba28f0301867ab9e1413724d68773ead9125562d3c9 SHA512 1622ee1a099a1d2c5cac4de4c464574cd8b2d9c2bd565aa5f7a7efd6d4081849937d3d1b6d6e34254e0904f79a9c2477fb692c71599792092ceb09fc11a30d8d
+DIST openssl-3.6.1.tar.gz 54891951 BLAKE2B da949967d40ca9e17baf1bedded5080e37bce2dfc187f2a46f80ec01e708f9d550d055ef8557812135c4a1081b8f3477c5d4dbe46e0f39a9b696a7dbdc6b769a SHA512 492cd2e0a7506e085d9840a929ead994390409a35c24e47e0cf44987920711b61f1513f21b7eee50e56f226b26cd654cda6dbd1f6e439563a93a8f0e530fefb5
+DIST openssl-3.6.1.tar.gz.asc 833 BLAKE2B 3af3fc0b57503cf5d1a8c34a460d76fcde1823250c721ac10f523196f57ceb3e7ceb66332af3e10ec24eefa3e4acec145349bedf37fe29fe2dde787f3001ebb3 SHA512 a1feb4e309d5288ed33e9459cee24272b67321eb037e11effd8ac0626aca792be5b442cc8c5e0c1abd288a1c0d05c8af7927b8c4a08e7685c92a6561ad806659

sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.2

@@ -64,6 +64,7 @@ case ${CHOST} in
 	*-winnt*)        system="winnt";;
 	x86_64-*-mingw*) system="mingw64";;
 	*mingw*)         system="mingw";;
+	*-gnu*)          system="hurd";;
 	*)               exit 0;;
 esac
 
@@ -165,6 +166,13 @@ mingw*)
 	# special case ... no xxx-yyy style name
 	echo ${system}
 	;;
+hurd)
+	case ${chost_machine} in
+		i[0-9]86*)    machine=x86;;
+		x86_64*)      machine=x86_64;;
+		*)            machine=generic32;;
+	esac
+	;;
 esac
 
 

sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.4

@@ -65,6 +65,7 @@ case ${CHOST} in
 	*-winnt*)        system="winnt";;
 	x86_64-*-mingw*) system="mingw64";;
 	*mingw*)         system="mingw";;
+	*-gnu*)          system="hurd";;
 	*)               exit 0;;
 esac
 
@@ -179,6 +180,13 @@ mingw*)
 	# special case ... no xxx-yyy style name
 	echo ${system}
 	;;
+hurd)
+	case ${chost_machine} in
+		i[0-9]86*)    machine=x86;;
+		x86_64*)      machine=x86_64;;
+		*)            machine=generic32;;
+	esac
+	;;
 esac
 
 

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.0.2u-r1.ebuild

@@ -33,7 +33,7 @@ SRC_URI="mirror://openssl/source/${MY_P}.tar.gz
 
 LICENSE="openssl"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~x86-linux ~arm64-macos"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos"
 IUSE="+asm bindist gmp kerberos rfc3779 sctp cpu_flags_x86_sse2 sslv2 +sslv3 static-libs test tls-compression +tls-heartbeat vanilla"
 RESTRICT="!bindist? ( bindist )
 	!test? ( test )"
@@ -41,7 +41,7 @@ RESTRICT="!bindist? ( bindist )
 RDEPEND=">=app-misc/c_rehash-1.7-r1
 	gmp? ( >=dev-libs/gmp-5.1.3-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
 	kerberos? ( >=app-crypt/mit-krb5-1.11.4[${MULTILIB_USEDEP}] )
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )"
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.1.1w.ebuild

@@ -16,13 +16,13 @@ S="${WORKDIR}/${MY_P}"
 LICENSE="openssl"
 SLOT="0/1.1" # .so version of libssl/libcrypto
 if [[ ${PV} != *_pre* ]] ; then
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="+asm rfc3779 sctp cpu_flags_x86_sse2 sslv3 static-libs test tls-compression tls-heartbeat vanilla verify-sig weak-ssl-ciphers"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )"
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )"
 DEPEND="${RDEPEND}"
 BDEPEND="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.18.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -41,7 +41,7 @@ IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compre
 RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.19.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -41,7 +41,7 @@ IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compre
 RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -41,7 +41,7 @@ IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compre
 RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.8.ebuild

@@ -1,290 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
-inherit edo flag-o-matic linux-info toolchain-funcs
-inherit multilib multilib-minimal multiprocessing preserve-libs
-
-DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
-HOMEPAGE="https://openssl-library.org/"
-
-MY_P=${P/_/-}
-
-if [[ ${PV} == *9999 ]] ; then
-	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
-	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
-
-	inherit git-r3
-else
-	inherit verify-sig
-	SRC_URI="
-		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
-		verify-sig? (
-			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
-		)
-	"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="Apache-2.0"
-SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
-IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND="
-	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
-"
-BDEPEND+="
-	>=dev-lang/perl-5
-	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
-	test? (
-		sys-apps/diffutils
-		app-alternatives/bc
-		sys-process/procps
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-PDEPEND="app-misc/ca-certificates"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/openssl/configuration.h
-)
-
-pkg_setup() {
-	if use ktls ; then
-		if kernel_is -lt 4 18 ; then
-			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
-		else
-			CONFIG_CHECK="~TLS ~TLS_DEVICE"
-			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
-			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
-			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
-
-			linux-info_pkg_setup
-		fi
-	fi
-
-	[[ ${MERGE_TYPE} == binary ]] && return
-
-	# must check in pkg_setup; sysctl doesn't work with userpriv!
-	if use test && use sctp ; then
-		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
-		# if sctp.auth_enable is not enabled.
-		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
-		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
-			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Make sure we only ever touch Makefile.org and avoid patching a file
-	# that gets blown away anyways by the Configure script in src_configure
-	rm -f Makefile
-
-	if ! use vanilla ; then
-		PATCHES+=(
-			# Add patches which are Gentoo-specific customisations here
-		)
-	fi
-
-	default
-
-	if use test && use sctp && has network-sandbox ${FEATURES} ; then
-		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
-		rm test/recipes/80-test_ssl_new.t || die
-	fi
-
-	# Test fails depending on kernel configuration, bug #699134
-	rm test/recipes/30-test_afalg.t || die
-}
-
-src_configure() {
-	# Keep this in sync with app-misc/c_rehash
-	SSL_CNF_DIR="/etc/ssl"
-
-	# Quiet out unknown driver argument warnings since openssl
-	# doesn't have well-split CFLAGS and we're making it even worse
-	# and 'make depend' uses -Werror for added fun (bug #417795 again)
-	tc-is-clang && append-flags -Qunused-arguments
-
-	# We really, really need to build OpenSSL w/ strict aliasing disabled.
-	# It's filled with violations and it *will* result in miscompiled
-	# code. This has been in the ebuild for > 10 years but even in 2022,
-	# it's still relevant:
-	# - https://github.com/llvm/llvm-project/issues/55255
-	# - https://github.com/openssl/openssl/issues/12247
-	# - https://github.com/openssl/openssl/issues/18225
-	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
-	# Don't remove the no strict aliasing bits below!
-	filter-flags -fstrict-aliasing
-	append-flags -fno-strict-aliasing
-	# The OpenSSL developers don't test with LTO right now, it leads to various
-	# warnings/errors (which may or may not be false positives), it's considered
-	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
-	filter-lto
-
-	append-flags $(test-flags-CC -Wa,--noexecstack)
-
-	# bug #895308
-	append-atomic-flags
-	# Configure doesn't respect LIBS
-	export LDLIBS="${LIBS}"
-
-	# bug #197996
-	unset APPS
-	# bug #312551
-	unset SCRIPTS
-	# bug #311473
-	unset CROSS_COMPILE
-
-	tc-export AR CC CXX RANLIB RC
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
-
-	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
-
-	# See if our toolchain supports __uint128_t.  If so, it's 64bit
-	# friendly and can use the nicely optimized code paths, bug #460790.
-	#local ec_nistp_64_gcc_128
-	#
-	# Disable it for now though (bug #469976)
-	# Do NOT re-enable without substantial discussion first!
-	#
-	#echo "__uint128_t i;" > "${T}"/128.c
-	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
-	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
-	#fi
-
-	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
-	einfo "Using configuration: ${sslout:-(openssl knows best)}"
-
-	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
-	local myeconfargs=(
-		${sslout}
-
-		$(use cpu_flags_x86_sse2 || echo "no-sse2")
-		enable-camellia
-		enable-ec
-		enable-ec2m
-		enable-sm2
-		enable-srp
-		$(use elibc_musl && echo "no-async")
-		enable-idea
-		enable-mdc2
-		enable-rc5
-		$(use fips && echo "enable-fips")
-		$(use_ssl asm)
-		$(use_ssl ktls)
-		$(use_ssl rfc3779)
-		$(use_ssl sctp)
-		$(use test || echo "no-tests")
-		$(use_ssl tls-compression zlib)
-		$(use_ssl weak-ssl-ciphers)
-
-		--prefix="${EPREFIX}"/usr
-		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
-		--libdir=$(get_libdir)
-
-		shared
-		threads
-	)
-
-	edo perl "${S}/Configure" "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	emake build_sw
-
-	if multilib_is_native_abi; then
-		emake build_docs
-	fi
-}
-
-multilib_src_test() {
-	# VFP = show subtests verbosely and show failed tests verbosely
-	# Normal V=1 would show everything verbosely but this slows things down.
-	emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
-}
-
-multilib_src_install() {
-	# Only -j1 is supported for the install targets:
-	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
-	emake DESTDIR="${D}" -j1 install_sw
-	if use fips; then
-		emake DESTDIR="${D}" -j1 install_fips
-		# Regen this in pkg_preinst, bug 900625
-		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
-	fi
-
-	if multilib_is_native_abi; then
-		emake DESTDIR="${D}" -j1 install_ssldirs
-		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
-	fi
-
-	# This is crappy in that the static archives are still built even
-	# when USE=static-libs. But this is due to a failing in the openssl
-	# build system: the static archives are built as PIC all the time.
-	# Only way around this would be to manually configure+compile openssl
-	# twice; once with shared lib support enabled and once without.
-	if ! use static-libs ; then
-		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
-	fi
-}
-
-multilib_src_install_all() {
-	# openssl installs perl version of c_rehash by default, but
-	# we provide a shell version via app-misc/c_rehash
-	rm "${ED}"/usr/bin/c_rehash || die
-
-	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
-
-	# Create the certs directory
-	keepdir ${SSL_CNF_DIR}/certs
-
-	# bug #254521
-	dodir /etc/sandbox.d
-	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
-
-	diropts -m0700
-	keepdir ${SSL_CNF_DIR}/private
-}
-
-pkg_preinst() {
-	if use fips; then
-		# Regen fipsmodule.cnf, bug 900625
-		ebegin "Running openssl fipsinstall"
-		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
-			"${ED}/usr/bin/openssl" fipsinstall -quiet \
-			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
-			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
-		eend $?
-	fi
-
-	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}
-
-pkg_postinst() {
-	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
-	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
-	eend $?
-
-	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.1.9999.ebuild

@@ -1,290 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
-inherit edo flag-o-matic linux-info toolchain-funcs
-inherit multilib multilib-minimal multiprocessing preserve-libs
-
-DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
-HOMEPAGE="https://openssl-library.org/"
-
-MY_P=${P/_/-}
-
-if [[ ${PV} == *9999 ]] ; then
-	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
-	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
-
-	inherit git-r3
-else
-	inherit verify-sig
-	SRC_URI="
-		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
-		verify-sig? (
-			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
-		)
-	"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="Apache-2.0"
-SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
-IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND="
-	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
-"
-BDEPEND+="
-	>=dev-lang/perl-5
-	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
-	test? (
-		sys-apps/diffutils
-		app-alternatives/bc
-		sys-process/procps
-	)
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-PDEPEND="app-misc/ca-certificates"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/openssl/configuration.h
-)
-
-pkg_setup() {
-	if use ktls ; then
-		if kernel_is -lt 4 18 ; then
-			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
-		else
-			CONFIG_CHECK="~TLS ~TLS_DEVICE"
-			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
-			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
-			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
-
-			linux-info_pkg_setup
-		fi
-	fi
-
-	[[ ${MERGE_TYPE} == binary ]] && return
-
-	# must check in pkg_setup; sysctl doesn't work with userpriv!
-	if use test && use sctp ; then
-		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
-		# if sctp.auth_enable is not enabled.
-		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
-		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
-			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Make sure we only ever touch Makefile.org and avoid patching a file
-	# that gets blown away anyways by the Configure script in src_configure
-	rm -f Makefile
-
-	if ! use vanilla ; then
-		PATCHES+=(
-			# Add patches which are Gentoo-specific customisations here
-		)
-	fi
-
-	default
-
-	if use test && use sctp && has network-sandbox ${FEATURES} ; then
-		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
-		rm test/recipes/80-test_ssl_new.t || die
-	fi
-
-	# Test fails depending on kernel configuration, bug #699134
-	rm test/recipes/30-test_afalg.t || die
-}
-
-src_configure() {
-	# Keep this in sync with app-misc/c_rehash
-	SSL_CNF_DIR="/etc/ssl"
-
-	# Quiet out unknown driver argument warnings since openssl
-	# doesn't have well-split CFLAGS and we're making it even worse
-	# and 'make depend' uses -Werror for added fun (bug #417795 again)
-	tc-is-clang && append-flags -Qunused-arguments
-
-	# We really, really need to build OpenSSL w/ strict aliasing disabled.
-	# It's filled with violations and it *will* result in miscompiled
-	# code. This has been in the ebuild for > 10 years but even in 2022,
-	# it's still relevant:
-	# - https://github.com/llvm/llvm-project/issues/55255
-	# - https://github.com/openssl/openssl/issues/12247
-	# - https://github.com/openssl/openssl/issues/18225
-	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
-	# Don't remove the no strict aliasing bits below!
-	filter-flags -fstrict-aliasing
-	append-flags -fno-strict-aliasing
-	# The OpenSSL developers don't test with LTO right now, it leads to various
-	# warnings/errors (which may or may not be false positives), it's considered
-	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
-	filter-lto
-
-	append-flags $(test-flags-CC -Wa,--noexecstack)
-
-	# bug #895308
-	append-atomic-flags
-	# Configure doesn't respect LIBS
-	export LDLIBS="${LIBS}"
-
-	# bug #197996
-	unset APPS
-	# bug #312551
-	unset SCRIPTS
-	# bug #311473
-	unset CROSS_COMPILE
-
-	tc-export AR CC CXX RANLIB RC
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
-
-	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
-
-	# See if our toolchain supports __uint128_t.  If so, it's 64bit
-	# friendly and can use the nicely optimized code paths, bug #460790.
-	#local ec_nistp_64_gcc_128
-	#
-	# Disable it for now though (bug #469976)
-	# Do NOT re-enable without substantial discussion first!
-	#
-	#echo "__uint128_t i;" > "${T}"/128.c
-	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
-	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
-	#fi
-
-	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
-	einfo "Using configuration: ${sslout:-(openssl knows best)}"
-
-	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
-	local myeconfargs=(
-		${sslout}
-
-		$(use cpu_flags_x86_sse2 || echo "no-sse2")
-		enable-camellia
-		enable-ec
-		enable-ec2m
-		enable-sm2
-		enable-srp
-		$(use elibc_musl && echo "no-async")
-		enable-idea
-		enable-mdc2
-		enable-rc5
-		$(use fips && echo "enable-fips")
-		$(use_ssl asm)
-		$(use_ssl ktls)
-		$(use_ssl rfc3779)
-		$(use_ssl sctp)
-		$(use test || echo "no-tests")
-		$(use_ssl tls-compression zlib)
-		$(use_ssl weak-ssl-ciphers)
-
-		--prefix="${EPREFIX}"/usr
-		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
-		--libdir=$(get_libdir)
-
-		shared
-		threads
-	)
-
-	edo perl "${S}/Configure" "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	emake build_sw
-
-	if multilib_is_native_abi; then
-		emake build_docs
-	fi
-}
-
-multilib_src_test() {
-	# VFP = show subtests verbosely and show failed tests verbosely
-	# Normal V=1 would show everything verbosely but this slows things down.
-	emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
-}
-
-multilib_src_install() {
-	# Only -j1 is supported for the install targets:
-	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
-	emake DESTDIR="${D}" -j1 install_sw
-	if use fips; then
-		emake DESTDIR="${D}" -j1 install_fips
-		# Regen this in pkg_preinst, bug 900625
-		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
-	fi
-
-	if multilib_is_native_abi; then
-		emake DESTDIR="${D}" -j1 install_ssldirs
-		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
-	fi
-
-	# This is crappy in that the static archives are still built even
-	# when USE=static-libs. But this is due to a failing in the openssl
-	# build system: the static archives are built as PIC all the time.
-	# Only way around this would be to manually configure+compile openssl
-	# twice; once with shared lib support enabled and once without.
-	if ! use static-libs ; then
-		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
-	fi
-}
-
-multilib_src_install_all() {
-	# openssl installs perl version of c_rehash by default, but
-	# we provide a shell version via app-misc/c_rehash
-	rm "${ED}"/usr/bin/c_rehash || die
-
-	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
-
-	# Create the certs directory
-	keepdir ${SSL_CNF_DIR}/certs
-
-	# bug #254521
-	dodir /etc/sandbox.d
-	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
-
-	diropts -m0700
-	keepdir ${SSL_CNF_DIR}/private
-}
-
-pkg_preinst() {
-	if use fips; then
-		# Regen fipsmodule.cnf, bug 900625
-		ebegin "Running openssl fipsinstall"
-		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
-			"${ED}/usr/bin/openssl" fipsinstall -quiet \
-			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
-			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
-		eend $?
-	fi
-
-	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}
-
-pkg_postinst() {
-	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
-	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
-	eend $?
-
-	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.5.ebuild

@@ -1,297 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
-inherit edo flag-o-matic linux-info toolchain-funcs
-inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
-
-DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
-HOMEPAGE="https://openssl-library.org/"
-
-MY_P=${P/_/-}
-
-if [[ ${PV} == *9999 ]] ; then
-	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
-	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
-
-	inherit git-r3
-else
-	inherit verify-sig
-	SRC_URI="
-		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
-		verify-sig? (
-			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
-		)
-	"
-
-	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-	fi
-
-	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
-fi
-
-S="${WORKDIR}"/${MY_P}
-
-LICENSE="Apache-2.0"
-SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
-IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND="
-	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
-"
-BDEPEND+="
-	>=dev-lang/perl-5
-	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
-	test? (
-		sys-apps/diffutils
-		app-alternatives/bc
-		sys-process/procps
-	)
-	verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )
-"
-DEPEND="${COMMON_DEPEND}"
-RDEPEND="${COMMON_DEPEND}"
-PDEPEND="app-misc/ca-certificates"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/openssl/configuration.h
-)
-
-pkg_setup() {
-	if use ktls ; then
-		if kernel_is -lt 4 18 ; then
-			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
-		else
-			CONFIG_CHECK="~TLS ~TLS_DEVICE"
-			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
-			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
-			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
-
-			linux-info_pkg_setup
-		fi
-	fi
-
-	[[ ${MERGE_TYPE} == binary ]] && return
-
-	# must check in pkg_setup; sysctl doesn't work with userpriv!
-	if use test && use sctp ; then
-		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
-		# if sctp.auth_enable is not enabled.
-		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
-		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
-			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
-		fi
-	fi
-}
-
-src_prepare() {
-	# Make sure we only ever touch Makefile.org and avoid patching a file
-	# that gets blown away anyways by the Configure script in src_configure
-	rm -f Makefile
-
-	if ! use vanilla ; then
-		PATCHES+=(
-			# Add patches which are Gentoo-specific customisations here
-		)
-	fi
-
-	default
-
-	if use test && use sctp && has network-sandbox ${FEATURES} ; then
-		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
-		rm test/recipes/80-test_ssl_new.t || die
-	fi
-
-	# Test fails depending on kernel configuration, bug #699134
-	rm test/recipes/30-test_afalg.t || die
-}
-
-src_configure() {
-	# Keep this in sync with app-misc/c_rehash
-	SSL_CNF_DIR="/etc/ssl"
-
-	# Quiet out unknown driver argument warnings since openssl
-	# doesn't have well-split CFLAGS and we're making it even worse
-	# and 'make depend' uses -Werror for added fun (bug #417795 again)
-	tc-is-clang && append-flags -Qunused-arguments
-
-	# We really, really need to build OpenSSL w/ strict aliasing disabled.
-	# It's filled with violations and it *will* result in miscompiled
-	# code. This has been in the ebuild for > 10 years but even in 2022,
-	# it's still relevant:
-	# - https://github.com/llvm/llvm-project/issues/55255
-	# - https://github.com/openssl/openssl/issues/12247
-	# - https://github.com/openssl/openssl/issues/18225
-	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
-	# Don't remove the no strict aliasing bits below!
-	filter-flags -fstrict-aliasing
-	append-flags -fno-strict-aliasing
-	# The OpenSSL developers don't test with LTO right now, it leads to various
-	# warnings/errors (which may or may not be false positives), it's considered
-	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
-	filter-lto
-
-	append-flags $(test-flags-CC -Wa,--noexecstack)
-
-	# bug #895308 -- check inserts GNU ld-compatible arguments
-	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
-	# Configure doesn't respect LIBS
-	export LDLIBS="${LIBS}"
-
-	# bug #197996
-	unset APPS
-	# bug #312551
-	unset SCRIPTS
-	# bug #311473
-	unset CROSS_COMPILE
-
-	tc-export AR CC CXX RANLIB RC
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
-
-	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
-
-	# See if our toolchain supports __uint128_t.  If so, it's 64bit
-	# friendly and can use the nicely optimized code paths, bug #460790.
-	#local ec_nistp_64_gcc_128
-	#
-	# Disable it for now though (bug #469976)
-	# Do NOT re-enable without substantial discussion first!
-	#
-	#echo "__uint128_t i;" > "${T}"/128.c
-	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
-	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
-	#fi
-
-	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
-	einfo "Using configuration: ${sslout:-(openssl knows best)}"
-
-	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
-	local myeconfargs=(
-		${sslout}
-
-		$(use cpu_flags_x86_sse2 || echo "no-sse2")
-		enable-camellia
-		enable-ec
-		enable-ec2m
-		enable-sm2
-		enable-srp
-		$(use elibc_musl && echo "no-async")
-		enable-idea
-		enable-mdc2
-		enable-rc5
-		$(use fips && echo "enable-fips")
-		$(use_ssl asm)
-		$(use_ssl ktls)
-		$(use_ssl rfc3779)
-		$(use_ssl sctp)
-		$(use test || echo "no-tests")
-		$(use_ssl tls-compression zlib)
-		$(use_ssl weak-ssl-ciphers)
-
-		--prefix="${EPREFIX}"/usr
-		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
-		--libdir=$(get_libdir)
-
-		shared
-		threads
-	)
-
-	edo perl "${S}/Configure" "${myeconfargs[@]}"
-}
-
-multilib_src_compile() {
-	emake build_sw
-
-	if multilib_is_native_abi; then
-		emake build_docs
-	fi
-}
-
-multilib_src_test() {
-	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
-	#
-	# VFP = show subtests verbosely and show failed tests verbosely
-	# Normal V=1 would show everything verbosely but this slows things down.
-	#
-	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
-	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
-	# controls running the tests.
-	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
-}
-
-multilib_src_install() {
-	# Only -j1 is supported for the install targets:
-	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
-	emake DESTDIR="${D}" -j1 install_sw
-	if use fips; then
-		emake DESTDIR="${D}" -j1 install_fips
-		# Regen this in pkg_preinst, bug 900625
-		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
-	fi
-
-	if multilib_is_native_abi; then
-		emake DESTDIR="${D}" -j1 install_ssldirs
-		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
-	fi
-
-	# This is crappy in that the static archives are still built even
-	# when USE=static-libs. But this is due to a failing in the openssl
-	# build system: the static archives are built as PIC all the time.
-	# Only way around this would be to manually configure+compile openssl
-	# twice; once with shared lib support enabled and once without.
-	if ! use static-libs ; then
-		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
-	fi
-}
-
-multilib_src_install_all() {
-	# openssl installs perl version of c_rehash by default, but
-	# we provide a shell version via app-misc/c_rehash
-	rm "${ED}"/usr/bin/c_rehash || die
-
-	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
-
-	# Create the certs directory
-	keepdir ${SSL_CNF_DIR}/certs
-
-	# bug #254521
-	dodir /etc/sandbox.d
-	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
-
-	diropts -m0700
-	keepdir ${SSL_CNF_DIR}/private
-}
-
-pkg_preinst() {
-	if use fips; then
-		# Regen fipsmodule.cnf, bug 900625
-		ebegin "Running openssl fipsinstall"
-		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
-			"${ED}/usr/bin/openssl" fipsinstall -quiet \
-			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
-			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
-		eend $?
-	fi
-
-	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}
-
-pkg_postinst() {
-	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
-	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
-	eend $?
-
-	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
-		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
-}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.6.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.5.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -216,6 +216,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.6.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -216,6 +216,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -212,6 +212,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.3.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -212,6 +212,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.4.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -212,6 +212,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -212,6 +212,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.4.ebuild

@@ -0,0 +1,297 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.5.ebuild

@@ -0,0 +1,297 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}

sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild

@@ -27,7 +27,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 	fi
 
 	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20240920 )"
@@ -42,7 +42,7 @@ RESTRICT="!test? ( test )"
 
 COMMON_DEPEND="
 	!<net-misc/openssh-9.2_p1-r3
-	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
 "
 BDEPEND+="
 	>=dev-lang/perl-5
@@ -212,6 +212,9 @@ multilib_src_configure() {
 
 multilib_src_compile() {
 	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
 }
 
 multilib_src_test() {