diff --git a/changelog/security/2023-09-28-weekly-updates.md b/changelog/security/2023-09-28-weekly-updates.md
new file mode 100644
index 00000000000..e53e24ac546
--- /dev/null
+++ b/changelog/security/2023-09-28-weekly-updates.md
@@ -0,0 +1,4 @@
+- curl ([CVE-2023-38039](https://nvd.nist.gov/vuln/detail/CVE-2023-38039))
+- lua ([CVE-2022-33099](https://nvd.nist.gov/vuln/detail/CVE-2022-33099))
+- mit-krb5 ([CVE-2023-36054](https://nvd.nist.gov/vuln/detail/CVE-2023-36054))
+- procps ([CVE-2023-4016](https://nvd.nist.gov/vuln/detail/CVE-2023-4016))
diff --git a/changelog/updates/2023-09-28-weekly-updates.md b/changelog/updates/2023-09-28-weekly-updates.md
new file mode 100644
index 00000000000..ca852d351ed
--- /dev/null
+++ b/changelog/updates/2023-09-28-weekly-updates.md
@@ -0,0 +1,8 @@
+- bind-tools ([9.16.42](https://bind9.readthedocs.io/en/v9.16.42/notes.html#notes-for-bind-9-16-42))
+- curl ([8.3.0](https://curl.se/changes.html#8_3_0))
+- gcc ([13.2](https://gcc.gnu.org/gcc-13/changes.html))
+- gzip ([1.13](https://savannah.gnu.org/news/?id=10501))
+- libgcrypt ([1.10.2](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob;f=NEWS;h=c9a239615f8070427a96688b1be40a81e59e9b8a;hb=1c5cbacf3d88dded5063e959ee68678ff7d0fa56))
+- lua ([5.4.6](https://www.lua.org/manual/5.4/readme.html#changes))
+- mit-krb5 ([1.21.2](http://web.mit.edu/kerberos/krb5-1.21/))
+- procps ([4.0.4](https://gitlab.com/procps-ng/procps/-/releases/v4.0.4) (includes [4.0.3](https://gitlab.com/procps-ng/procps/-/releases/v4.0.3) and [4.0.0](https://gitlab.com/procps-ng/procps/-/releases/v4.0.0)))
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
index 41d13bb2c6d..c6f276fe7c4 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords
@@ -10,6 +10,9 @@
 # Needed by arm64-native SDK.
 =app-crypt/efitools-1.9.2 ~arm64
 
+# Needed to fix CVE-2023-36054.
+=app-crypt/mit-krb5-1.21.2 ~amd64 ~arm64
+
 # Needed to address CVE-2023-2609 and CVE-2023-2610.
 =app-editors/vim-9.0.1678 ~amd64 ~arm64
 =app-editors/vim-core-9.0.1678 ~amd64 ~arm64
@@ -39,9 +42,10 @@
 # Keep versions on both arches in sync.
 =dev-libs/ding-libs-0.6.1-r1 ~arm64
 =dev-libs/libdnet-1.16.2 ~arm64
-=dev-libs/libgcrypt-1.10.1-r3 ~arm64
+=dev-libs/libgcrypt-1.10.2 ~arm64
 =dev-python/lxml-4.9.3-r1 ~arm64
 =dev-util/bpftool-6.3 ~arm64
+=net-dns/bind-tools-9.16.42 ~arm64
 =net-firewall/conntrack-tools-1.4.6-r1 ~arm64
 
 # Required for addressing CVE-2023-0361.
@@ -51,8 +55,8 @@
 =net-libs/libnetfilter_cthelper-1.0.0-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.0-r1 ~arm64
 
-# Required for addressing CVE-2023-32001.
-=net-misc/curl-8.2.1 ~amd64 ~arm64
+# Required for addressing CVE-2023-38039.
+=net-misc/curl-8.3.0 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-nds/openldap-2.6.4-r1 ~amd64
@@ -70,6 +74,7 @@
 
 # Keep versions on both arches in sync.
 =sys-devel/automake-1.16.5-r1 ~arm64
+=sys-devel/gcc-13.2.1_p20230826 ~arm64
 =sys-firmware/edk2-aarch64-18.02 **
 
 # Needed for a cross-compilation fix.
@@ -90,5 +95,8 @@
 # ?
 =sys-power/acpid-2.0.33 ~amd64 ~arm64
 
+# Needed to fix CVE-2023-4016.
+=sys-process/procps-4.0.4 ~amd64 ~arm64
+
 # Accept unstable host Rust compilers.
 =virtual/rust-1.72.1 ~amd64 ~arm64
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13.ebuild
index 808d9bc4e88..e707630cfc1 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.13.ebuild
@@ -31,7 +31,7 @@ fi
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ ${PV} != *_p* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="pic static"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
index 34ff66da5d1..0784c5c3e79 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest
@@ -1,2 +1,4 @@
 DIST libarchive-3.7.1.tar.xz 5254260 BLAKE2B 1a6fa4f5027effea3df1cfcd2d99b8b126fe03d727412b0a4529d6b2157c2c29490bcce206d0f771256c5ed6dec9612608c2c54c4861647f4e2892e0f5548adb SHA512 24380b9aa24434dfe39929ec85ede33580291023b20b7cdf03990ce62578eaeb389f5ca5680245a84c7aad51574c85a1fa3fad5254ec5395eadac1cb2130a936
 DIST libarchive-3.7.1.tar.xz.asc 659 BLAKE2B 5e72732d2e5a4f5f04f3510b3d81a148f23dffa10a3ebe709e816388c5a6e68c08ee2bbe36d81141d5ffa94ed64df3e4ca05994cda651c09589fda69a6a95e90 SHA512 6f6f6e5780c609bd9c6c359c210656f26afb585bda46988687e19d1e55f4f3260ea80bf11bfba1213fb3a3e1514c5c096692b4b9e96ffbadf06f85eb1227250a
+DIST libarchive-3.7.2.tar.xz 5237056 BLAKE2B 7221db4811a965ee61d879a2603480363628a19995a351b572d099be9f35576d76f0b0822f9a5a47d9929bc094d4444fd8eafcb4a073e39bb3aa797d4b926ca5 SHA512 a21bebb27b808cb7d2ed13a70739904a1b7b55661d8dea83c9897a0129cf71e20c962f13666c571782ff0f4f753ca885619c2097d9e7691c2dee4e6e4b9a2971
+DIST libarchive-3.7.2.tar.xz.asc 659 BLAKE2B 7141baf007b89b7ee38ec817b648cef5efb4d694953fcd49f6ed2dc95cf4da2d9259262b9eb4f01ff5d4ecee1257b266a8c6687a8e8ef8790121048229f1ad22 SHA512 c2ce850088245d7723720737d74d1cc1819984d01b3f9e4ed96b0757f4c6d6d511b78792181a12400c563632d74edcd0c2c3a4b7527cba40ada7ef74488078fc
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.2-32bit-test.patch b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.2-32bit-test.patch
new file mode 100644
index 00000000000..5f43c262673
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/files/libarchive-3.7.2-32bit-test.patch
@@ -0,0 +1,29 @@
+From 3bd918d92f8c34ba12de9c6604d96f9e262a59fc Mon Sep 17 00:00:00 2001
+From: Martin Matuska <martin@matuska.de>
+Date: Tue, 12 Sep 2023 08:54:47 +0200
+Subject: [PATCH] tests: fix zstd long option test for 32-bit architectures
+
+Fixes #1968
+---
+ libarchive/test/test_write_filter_zstd.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/libarchive/test/test_write_filter_zstd.c b/libarchive/test/test_write_filter_zstd.c
+index 3cdbd812a..c9731f1b6 100644
+--- a/libarchive/test/test_write_filter_zstd.c
++++ b/libarchive/test/test_write_filter_zstd.c
+@@ -161,8 +161,12 @@ DEFINE_TEST(test_write_filter_zstd)
+ 	    archive_write_set_filter_option(a, NULL, "max-frame-size", "1048576"));
+ #endif
+ #if ZSTD_VERSION_NUMBER >= MINVER_LONG
+-	assertEqualIntA(a, ARCHIVE_OK,
+-	    archive_write_set_filter_option(a, NULL, "long", "27"));
++	if ((int)(sizeof(size_t) == 4))
++		assertEqualIntA(a, ARCHIVE_OK,
++		    archive_write_set_filter_option(a, NULL, "long", "26"));
++	else
++		assertEqualIntA(a, ARCHIVE_OK,
++		    archive_write_set_filter_option(a, NULL, "long", "27"));
+ 	assertEqualIntA(a, ARCHIVE_FAILED,
+ 	    archive_write_set_filter_option(a, NULL, "long", "-1")); /* negative */
+ #endif
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2.ebuild
new file mode 100644
index 00000000000..cc8d80504e1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.7.2.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle static-libs xattr zstd"
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/libarchive.org.asc
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv[${MULTILIB_USEDEP}] )
+	kernel_linux? (
+		xattr? ( sys-apps/attr[${MULTILIB_USEDEP}] )
+	)
+	dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:0=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:0=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/1968
+	"${FILESDIR}/${P}-32bit-test.patch"
+)
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild
index 48e447b2f78..e31b35df0c5 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/tar/tar-1.35.ebuild
@@ -20,7 +20,7 @@ SRC_URI="
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ -z "$(ver_cut 3)" || "$(ver_cut 3)" -lt 90 ]] ; then
-	KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 ~arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="acl minimal nls selinux xattr"
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
index 11ddc15f918..1ab617815a9 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild
@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs usr-ldscript
+inherit flag-o-matic libtool multilib multilib-minimal preserve-libs usr-ldscript
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -100,6 +100,10 @@ multilib_src_configure() {
 		myconf+=( --disable-path-for-script )
 	fi
 
+	# ifunc is incompatible w/ asan
+	# https://github.com/tukaani-project/xz/issues/62#issuecomment-1719489932
+	is-flagq -fsanitize=address && myconf+=( --disable-ifunc )
+
 	ECONF_SOURCE="${S}" econf "${myconf[@]}"
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
index 89d58c30ecf..784731db0e4 100644
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest
@@ -1,4 +1 @@
-DIST zstd-1.4.9.tar.gz 1834843 BLAKE2B 907f492bd023db9459bdc292a0bc4d1b6336d92dd7041eb2b36668589c20fcb98c411b85d78f92cd16d9b4a000d9c4125b5f966a5ca777034ae78210e639315b SHA512 f529db9c094f9ae26428bf1fdfcc91c6d783d400980e0f0d802d2cf13c2be2931465ef568907e03841ff76a369a1447e7371f8799d8526edb9a513ba5c6db133
-DIST zstd-1.5.2.tar.gz 1950967 BLAKE2B 9d474e9fdcf7e5eb09d1f606712b05ca3001e8f6f7451254d8dba3f429101048532fd9c84a5b9083ae90d0457e9e1b1d48256581a1697e7db19b09d73595f070 SHA512 e107508a41fca50845cc2494e64adaba93efb95a2fa486fc962510a8ba4b2180d93067cae9870f119e88e5e8b28a046bc2240b0b23cdd8933d1fb1a6a9668c1e
-DIST zstd-1.5.4.gh.tar.gz 2161536 BLAKE2B ffc5fcbbdf4ab04bc14b5037308bf4e879d4cbaaf863462ea1e8af3f1b86b935ee6036e49298c83ac42b00472c003e32c263c977f0ae7d64f31d9ae63c5c28cb SHA512 2896a6dd6b60cc251720356babcbab6018c874eb2149121b26e28041496fc355a9cb5fd1b39c91558fcfbafb789b3d721264a0f9b5734f893d5f3cdf97016394
 DIST zstd-1.5.5.tar.gz 2368543 BLAKE2B 7680e27a0adacfb809d9fc81e06d3f99bf74df30374d3b5cb2d58f667dd1b7d5c41697e608592709e17c0e32277f20a6d615edee409b5d7cdcb15da2799a2350 SHA512 99109ec0e07fa65c2101c9cb36be56b672bbd0ee69d265f924718e61f9192ae8385c8d9e4d0c318be9edfa6d849fd3d60e5f164fa120961449429ea3c5dab6b6
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-crash-no-directory.patch b/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-crash-no-directory.patch
deleted file mode 100644
index d64e1c1d34f..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-crash-no-directory.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-https://github.com/facebook/zstd/issues/3523
-https://github.com/facebook/zstd/pull/3541
-
-From 50e8f55e7d5928af9c3411afdb4fbedb4d8f770d Mon Sep 17 00:00:00 2001
-From: "W. Felix Handte" <w@felixhandte.com>
-Date: Thu, 9 Mar 2023 12:46:37 -0500
-Subject: [PATCH 1/3] Fix Python 3.6 Incompatibility in CLI Tests
-
---- a/tests/cli-tests/run.py
-+++ b/tests/cli-tests/run.py
-@@ -535,7 +535,8 @@ def _run_script(self, script: str, cwd: str) -> None:
-             subprocess.run(
-                 args=[script],
-                 stdin=subprocess.DEVNULL,
--                capture_output=True,
-+                stdout=subprocess.PIPE,
-+                stderr=subprocess.PIPE,
-                 cwd=cwd,
-                 env=env,
-                 check=True,
-
-From c4c3e11958aed4dc99ec22e3d31c405217575a8c Mon Sep 17 00:00:00 2001
-From: "W. Felix Handte" <w@felixhandte.com>
-Date: Thu, 9 Mar 2023 12:47:40 -0500
-Subject: [PATCH 2/3] Avoid Calling `setvbuf()` on Null File Pointer
-
---- a/programs/fileio.c
-+++ b/programs/fileio.c
-@@ -644,18 +644,24 @@ FIO_openDstFile(FIO_ctx_t* fCtx, FIO_prefs_t* const prefs,
- #endif
-         if (f == NULL) {
-             DISPLAYLEVEL(1, "zstd: %s: %s\n", dstFileName, strerror(errno));
-+        } else {
-+            /* An increased buffer size can provide a significant performance
-+             * boost on some platforms. Note that providing a NULL buf with a
-+             * size that's not 0 is not defined in ANSI C, but is defined in an
-+             * extension. There are three possibilities here:
-+             * 1. Libc supports the extended version and everything is good.
-+             * 2. Libc ignores the size when buf is NULL, in which case
-+             *    everything will continue as if we didn't call `setvbuf()`.
-+             * 3. We fail the call and execution continues but a warning
-+             *    message might be shown.
-+             * In all cases due execution continues. For now, I believe that
-+             * this is a more cost-effective solution than managing the buffers
-+             * allocations ourselves (will require an API change).
-+             */
-+            if (setvbuf(f, NULL, _IOFBF, 1 MB)) {
-+                DISPLAYLEVEL(2, "Warning: setvbuf failed for %s\n", dstFileName);
-+            }
-         }
--        /* An increased buffer size can provide a significant performance boost on some platforms.
--         * Note that providing a NULL buf with a size that's not 0 is not defined in ANSI C, but is defined
--         * in an extension. There are three possibilities here -
--         * 1. Libc supports the extended version and everything is good.
--         * 2. Libc ignores the size when buf is NULL, in which case everything will continue as if we didn't
--         *    call `setvbuf`.
--         * 3. We fail the call and execution continues but a warning message might be shown.
--         * In all cases due execution continues. For now, I believe that this is a more cost-effective
--         * solution than managing the buffers allocations ourselves (will require an API change). */
--        if(setvbuf(f, NULL, _IOFBF, 1 MB))
--            DISPLAYLEVEL(2, "Warning: setvbuf failed for %s\n", dstFileName);
-         return f;
-     }
- }
-
-From 957a0ae52d0f49eccd260a22ceb5f5dfed064e9f Mon Sep 17 00:00:00 2001
-From: "W. Felix Handte" <w@felixhandte.com>
-Date: Thu, 9 Mar 2023 12:48:11 -0500
-Subject: [PATCH 3/3] Add CLI Test
-
---- /dev/null
-+++ b/tests/cli-tests/file-stat/compress-file-to-dir-without-write-perm.sh
-@@ -0,0 +1,12 @@
-+#!/bin/sh
-+
-+# motivated by issue #3523
-+
-+datagen > file
-+mkdir out
-+chmod 000 out
-+
-+zstd file -q --trace-file-stat -o out/file.zst
-+zstd -tq out/file.zst
-+
-+chmod 777 out
---- /dev/null
-+++ b/tests/cli-tests/file-stat/compress-file-to-dir-without-write-perm.sh.stderr.exact
-@@ -0,0 +1,26 @@
-+Trace:FileStat: > UTIL_isLink(file)
-+Trace:FileStat: < 0
-+Trace:FileStat: > UTIL_isConsole(2)
-+Trace:FileStat: < 0
-+Trace:FileStat: > UTIL_getFileSize(file)
-+Trace:FileStat:  > UTIL_stat(-1, file)
-+Trace:FileStat:  < 1
-+Trace:FileStat: < 65537
-+Trace:FileStat: > UTIL_stat(-1, file)
-+Trace:FileStat: < 1
-+Trace:FileStat: > UTIL_isDirectoryStat()
-+Trace:FileStat: < 0
-+Trace:FileStat: > UTIL_stat(-1, file)
-+Trace:FileStat: < 1
-+Trace:FileStat: > UTIL_isSameFile(file, out/file.zst)
-+Trace:FileStat:  > UTIL_stat(-1, file)
-+Trace:FileStat:  < 1
-+Trace:FileStat:  > UTIL_stat(-1, out/file.zst)
-+Trace:FileStat:  < 0
-+Trace:FileStat: < 0
-+Trace:FileStat: > UTIL_isRegularFile(out/file.zst)
-+Trace:FileStat:  > UTIL_stat(-1, out/file.zst)
-+Trace:FileStat:  < 0
-+Trace:FileStat: < 0
-+zstd: out/file.zst: Permission denied
-+zstd: can't stat out/file.zst : Permission denied -- ignored 
-
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-fix-no-zlib-build.patch b/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-fix-no-zlib-build.patch
deleted file mode 100644
index c6e65cbe2b1..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-fix-no-zlib-build.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-https://bugs.gentoo.org/894058
-https://github.com/facebook/zstd/pull/3497
-
-From cc94fac7c879c47984bba7d60d5ce0c9834ff4c7 Mon Sep 17 00:00:00 2001
-From: "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
-Date: Fri, 10 Feb 2023 19:30:30 -0500
-Subject: [PATCH] Use correct types in LZMA comp/decomp
-
-Bytef and uInt are zlib types, not available when zlib is disabled
-
-Fixes: 1598e6c634ac ("Async write for decompression")
-Fixes: cc0657f27d81 ("AsyncIO compression part 2 - added async read and asyncio to compression code (#3022)")
----
- programs/fileio.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/programs/fileio.c b/programs/fileio.c
-index 9a8300cdd8..d3ed9217d5 100644
---- a/programs/fileio.c
-+++ b/programs/fileio.c
-@@ -1173,8 +1173,8 @@ FIO_compressLzmaFrame(cRess_t* ress,
-     }
- 
-     writeJob =AIO_WritePool_acquireJob(ress->writeCtx);
--    strm.next_out = (Bytef*)writeJob->buffer;
--    strm.avail_out = (uInt)writeJob->bufferSize;
-+    strm.next_out = (BYTE*)writeJob->buffer;
-+    strm.avail_out = writeJob->bufferSize;
-     strm.next_in = 0;
-     strm.avail_in = 0;
- 
-@@ -1201,7 +1201,7 @@ FIO_compressLzmaFrame(cRess_t* ress,
-                 writeJob->usedBufferSize = compBytes;
-                 AIO_WritePool_enqueueAndReacquireWriteJob(&writeJob);
-                 outFileSize += compBytes;
--                strm.next_out = (Bytef*)writeJob->buffer;
-+                strm.next_out = (BYTE*)writeJob->buffer;
-                 strm.avail_out = writeJob->bufferSize;
-         }   }
-         if (srcFileSize == UTIL_FILESIZE_UNKNOWN)
-@@ -2316,8 +2316,8 @@ FIO_decompressLzmaFrame(dRess_t* ress,
-     }
- 
-     writeJob = AIO_WritePool_acquireJob(ress->writeCtx);
--    strm.next_out = (Bytef*)writeJob->buffer;
--    strm.avail_out = (uInt)writeJob->bufferSize;
-+    strm.next_out = (BYTE*)writeJob->buffer;
-+    strm.avail_out = writeJob->bufferSize;
-     strm.next_in = (BYTE const*)ress->readCtx->srcBuffer;
-     strm.avail_in = ress->readCtx->srcBufferLoaded;
- 
-@@ -2345,7 +2345,7 @@ FIO_decompressLzmaFrame(dRess_t* ress,
-                 writeJob->usedBufferSize = decompBytes;
-                 AIO_WritePool_enqueueAndReacquireWriteJob(&writeJob);
-                 outFileSize += decompBytes;
--                strm.next_out = (Bytef*)writeJob->buffer;
-+                strm.next_out = (BYTE*)writeJob->buffer;
-                 strm.avail_out = writeJob->bufferSize;
-         }   }
-         if (ret == LZMA_STREAM_END) break;
-
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-tests-no-programs.patch b/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-tests-no-programs.patch
deleted file mode 100644
index ec1fc325920..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/files/zstd-1.5.4-tests-no-programs.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-https://github.com/facebook/zstd/pull/3490
-
-From 183a18a45c1d69f8c42b9fcd25e6d28f9b3d75bb Mon Sep 17 00:00:00 2001
-From: Eli Schwartz <eschwartz@archlinux.org>
-Date: Fri, 10 Feb 2023 00:28:47 -0500
-Subject: [PATCH 1/2] meson: correctly specify the dependency relationship for
- playtests
-
-It depends on the zstd program being built, and passes it as an env
-variable. Just like datagen. But for datagen, we explicitly depend on
-it, while for zstd, we assume it's built as part of "all".
-
-This can be wrong in two cases:
-- when running individual tests, meson can (re)build just what is needed
-  for that one test
-- a later patch will handle building zstd but not by default
---- a/tests/meson.build
-+++ b/tests/meson.build
-@@ -162,7 +162,7 @@ if host_machine_os != os_windows
-       playTests_sh,
-       args: opt,
-       env: ['ZSTD_BIN=' + zstd.full_path(), 'DATAGEN_BIN=./datagen'],
--      depends: [datagen],
-+      depends: [datagen, zstd],
-       suite: suite,
-       workdir: meson.current_build_dir(),
-       timeout: 2800) # Timeout should work on HDD drive
-
-From 97ab0e2ab60fdda78f610032408df104de20b9f1 Mon Sep 17 00:00:00 2001
-From: Eli Schwartz <eschwartz@archlinux.org>
-Date: Thu, 9 Feb 2023 23:55:09 -0500
-Subject: [PATCH 2/2] meson: always build the zstd binary when tests are
- enabled
-
-We need to run it for the tests, even if programs are disabled. So if
-they are disabled, create a build rule for the program, but don't
-install it. Just make it available for the test itself.
---- a/meson.build
-+++ b/meson.build
-@@ -132,7 +132,7 @@ endif
- 
- subdir('lib')
- 
--if bin_programs
-+if bin_programs or bin_tests
-   subdir('programs')
- endif
- 
---- a/programs/meson.build
-+++ b/programs/meson.build
-@@ -72,7 +72,14 @@ zstd = executable('zstd',
-   c_args: zstd_c_args,
-   dependencies: zstd_deps,
-   export_dynamic: export_dynamic_on_windows, # Since Meson 0.45.0
--  install: true)
-+  build_by_default: bin_programs,
-+  install: bin_programs)
-+
-+if not bin_programs
-+  # we generate rules to build the programs, but don't install anything
-+  # so do not continue to installing scripts and manpages
-+  subdir_done()
-+endif
- 
- zstd_frugal_sources = [join_paths(zstd_rootdir, 'programs/zstdcli.c'),
-   join_paths(zstd_rootdir, 'programs/timefn.c'),
-
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.4.9.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.4.9.ebuild
deleted file mode 100644
index 82fba5d4693..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.4.9.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic multilib-minimal toolchain-funcs
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-SRC_URI="https://github.com/facebook/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="lz4 static-libs +threads"
-
-RDEPEND="app-arch/xz-utils
-	lz4? ( app-arch/lz4 )"
-DEPEND="${RDEPEND}"
-
-src_prepare() {
-	default
-	multilib_copy_sources
-
-	# Workaround #713940 / https://github.com/facebook/zstd/issues/2045
-	# where upstream build system does not add -pthread for Makefile-based
-	# build system.
-	use threads && append-flags $(test-flags-CCLD -pthread)
-}
-
-mymake() {
-	emake \
-		CC="$(tc-getCC)" \
-		CXX="$(tc-getCXX)" \
-		AR="$(tc-getAR)" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		"${@}"
-}
-
-multilib_src_compile() {
-	local libzstd_targets=( libzstd{,.a}$(usex threads '-mt' '') )
-
-	mymake -C lib ${libzstd_targets[@]} libzstd.pc
-
-	if multilib_is_native_abi ; then
-		mymake HAVE_LZ4="$(usex lz4 1 0)" zstd
-
-		mymake -C contrib/pzstd
-	fi
-}
-
-multilib_src_install() {
-	mymake -C lib DESTDIR="${D}" install
-
-	if multilib_is_native_abi ; then
-		mymake -C programs DESTDIR="${D}" install
-
-		mymake -C contrib/pzstd DESTDIR="${D}" install
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use static-libs; then
-		find "${ED}" -name "*.a" -delete || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.2-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.2-r3.ebuild
deleted file mode 100644
index ce92fbcf49e..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.2-r3.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit multilib-minimal toolchain-funcs usr-ldscript
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-SRC_URI="https://github.com/facebook/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="lz4 static-libs"
-
-RDEPEND="
-	app-arch/xz-utils
-	sys-libs/zlib
-	lz4? ( app-arch/lz4 )
-"
-DEPEND="${RDEPEND}"
-
-src_prepare() {
-	default
-	multilib_copy_sources
-}
-
-mymake() {
-	emake \
-		CC="$(tc-getCC)" \
-		CXX="$(tc-getCXX)" \
-		AR="$(tc-getAR)" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		V=1 \
-		"${@}"
-}
-
-multilib_src_compile() {
-	local libzstd_targets=( libzstd{,.a}-mt )
-
-	mymake -C lib ${libzstd_targets[@]} libzstd.pc
-
-	if multilib_is_native_abi ; then
-		mymake HAVE_LZ4="$(usex lz4 1 0)" zstd
-
-		mymake -C contrib/pzstd
-	fi
-}
-
-multilib_src_install() {
-	mymake -C lib DESTDIR="${D}" install
-
-	if multilib_is_native_abi ; then
-		mymake -C programs DESTDIR="${D}" install
-		gen_usr_ldscript -a zstd
-
-		mymake -C contrib/pzstd DESTDIR="${D}" install
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	if ! use static-libs; then
-		find "${ED}" -name "*.a" -delete || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r2.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r2.ebuild
deleted file mode 100644
index c133ba97ff5..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r2.ebuild
+++ /dev/null
@@ -1,79 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit meson-multilib usr-ldscript
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-# Drop .gh on next bump (>1.5.4), it's only here as we switched to release
-# tarball.
-SRC_URI="https://github.com/facebook/zstd/releases/download/v${PV}/${P}.tar.gz -> ${P}.gh.tar.gz"
-S="${WORKDIR}"/${P}/build/meson
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+lzma lz4 static-libs test zlib"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	lzma? ( app-arch/xz-utils )
-	lz4? ( app-arch/lz4:= )
-	zlib? ( sys-libs/zlib )
-"
-DEPEND="${RDEPEND}"
-
-MESON_PATCHES=(
-	# Workaround until Valgrind bugfix lands
-	"${FILESDIR}"/${PN}-1.5.4-no-find-valgrind.patch
-	# Allow building tests w/o programs (useful for multilib)
-	"${FILESDIR}"/${PN}-1.5.4-tests-no-programs.patch
-)
-
-PATCHES=(
-	# Fix build w/o zlib, bug #894058
-	"${FILESDIR}"/${P}-fix-no-zlib-build.patch
-)
-
-src_prepare() {
-	cd "${WORKDIR}"/${P} || die
-	default
-
-	cd "${S}" || die
-	eapply "${MESON_PATCHES[@]}"
-}
-
-multilib_src_configure() {
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# This replaces the no-find-valgrind patch once bugfix lands in a meson
-	# release + we can BDEPEND on it (https://github.com/mesonbuild/meson/pull/11372)
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	valgrind='valgrind-falseified'
-	EOF
-
-	local emesonargs=(
-		-Ddefault_library=$(multilib_native_usex static-libs both shared)
-
-		$(meson_native_true bin_programs)
-		$(meson_native_true bin_contrib)
-		$(meson_use test bin_tests)
-
-		$(meson_native_use_feature zlib)
-		$(meson_native_use_feature lzma)
-		$(meson_native_use_feature lz4)
-
-		--native-file "${native_file}"
-	)
-
-	meson_src_configure
-}
-
-multilib_src_install() {
-	meson_src_install
-
-	multilib_is_native_abi && gen_usr_ldscript -a zstd
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r3.ebuild b/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r3.ebuild
deleted file mode 100644
index b42b244708a..00000000000
--- a/sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.4-r3.ebuild
+++ /dev/null
@@ -1,80 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit meson-multilib usr-ldscript
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-# Drop .gh on next bump (>1.5.4), it's only here as we switched to release
-# tarball.
-SRC_URI="https://github.com/facebook/zstd/releases/download/v${PV}/${P}.tar.gz -> ${P}.gh.tar.gz"
-S="${WORKDIR}"/${P}/build/meson
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+lzma lz4 static-libs test zlib"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	lzma? ( app-arch/xz-utils )
-	lz4? ( app-arch/lz4:= )
-	zlib? ( sys-libs/zlib )
-"
-DEPEND="${RDEPEND}"
-
-MESON_PATCHES=(
-	# Workaround until Valgrind bugfix lands
-	"${FILESDIR}"/${PN}-1.5.4-no-find-valgrind.patch
-	# Allow building tests w/o programs (useful for multilib)
-	"${FILESDIR}"/${PN}-1.5.4-tests-no-programs.patch
-)
-
-PATCHES=(
-	# Fix build w/o zlib, bug #894058
-	"${FILESDIR}"/${P}-fix-no-zlib-build.patch
-	"${FILESDIR}"/${P}-crash-no-directory.patch
-)
-
-src_prepare() {
-	cd "${WORKDIR}"/${P} || die
-	default
-
-	cd "${S}" || die
-	eapply "${MESON_PATCHES[@]}"
-}
-
-multilib_src_configure() {
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# This replaces the no-find-valgrind patch once bugfix lands in a meson
-	# release + we can BDEPEND on it (https://github.com/mesonbuild/meson/pull/11372)
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	valgrind='valgrind-falseified'
-	EOF
-
-	local emesonargs=(
-		-Ddefault_library=$(multilib_native_usex static-libs both shared)
-
-		$(meson_native_true bin_programs)
-		$(meson_native_true bin_contrib)
-		$(meson_use test bin_tests)
-
-		$(meson_native_use_feature zlib)
-		$(meson_native_use_feature lzma)
-		$(meson_native_use_feature lz4)
-
-		--native-file "${native_file}"
-	)
-
-	meson_src_configure
-}
-
-multilib_src_install() {
-	meson_src_install
-
-	multilib_is_native_abi && gen_usr_ldscript -a zstd
-}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
index 76f90e7c8da..aeb71908b5d 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest
@@ -3,10 +3,13 @@ DIST qemu-7.2.0.tar.xz 122408576 BLAKE2B 415ff621356c59f88b29cfe3ef5db1e282b26bb
 DIST qemu-7.2.1.tar.xz 122400592 BLAKE2B bae1df5d332beaca313c4bac88f06dd5992988d7c1b6fdc6ced4043d858f437339cd7d0009ae667f9e66705117697bee7ee44ec4e911cc203d34eecc3d8f139b SHA512 e286dc66c923a5df77eb02d69235d048e80a7cced638fae52fbed385b4c3cd736cfea66bb3c9843bebf0a33e81ea141fc015e0bd82108df304f148ce59d9ae8a
 DIST qemu-7.2.3.tar.xz 122395692 BLAKE2B 4e65cac7505a56da85c1d98dc6029d516dd4f07f0211ea5213724d231d448d9b49cc91a3058a2a89908608078854d97da480e6f0bc7ce47d9555c2bb1177fbdc SHA512 09523d456175da47d58d8d56fe9a95416ee3e6fd8aa7766383033396a1e5bd10f7758832f7f2b8662068ef94b21ab6a3a351c9158fb6bde0e1d7d5fb393bf6c7
 DIST qemu-7.2.4.tar.xz 121849100 BLAKE2B a9c5ffce9ff0fac4e2d1fa4be1a1dcee2f5d7f793ddf726871c5ae9a68c22f7ba03692a8a5096de3051030d3c2f34e46697d5af2d66c34984b8161ae3bb07b42 SHA512 fa765673833a1f2cbecdb9d47dc7dc29d7613be5a5c8fc63925ae70e1f5aafb4f9f02e45b212a329f17b689351b8a9cdf5f5235ab6adb71bb40e41868898d95b
+DIST qemu-7.2.6.tar.xz 121322888 BLAKE2B c3f51cc1647f5c75774513f624c2e1a1e4badd7275c9f9a64a175809daf17d0b3c58eab0c36fa98fc46834d4d79f8552d1c9f34e840ee21ddd049cc3adba480a SHA512 534fffe2d751a707a7cf15db8d5b9eddc2468fd7fe875715e79ee879fb20d7370553588384d345b586eeaddf9284de36f2d0d69f747380ee55161cc6eb09bf30
 DIST qemu-8.0.0-docs.tar.xz 3218024 BLAKE2B b764a625024e78a39470048355471e12cfb57ab3c34e764dc4200fdf5c1aea635d26095ec961979bf46f177101c5bd38618bacf7e98e04bd64688ab5e29591aa SHA512 d9dfe191372e105fe16fe8f66f41ed793ade4c89b5ab1d84b39459f3419a1ca61bd49422a83981965cc257c05eca7fd49054703f58f179f5c7b656e9473a1054
 DIST qemu-8.0.0.tar.xz 127835148 BLAKE2B 9b54aae10fe09691a26e68374723ded5fdda6409673b4de9461a25ee060cfd03968a16ddeadc21d48b9262e53aa6d4e5eb645376969f97c65807fad19607b04f SHA512 1f31d1e653dec2d35f1b7a5468ee3f471553b48eca8c8afafffcf9243c6b2260e78a5b73da3fe567f9b85d4133573eebd397747b3aec501fb24076263eb07b27
 DIST qemu-8.0.2.tar.xz 126707132 BLAKE2B f2b1a63e10c42aabfe39722c7732d0f04818ad367b769b3deb29c5bf9adcabc3aca1706f3c40fafeeb57ac1f7a61ded5066de32134c483e2fd27bc65b4b7d30a SHA512 4e915d33a662bf55b09247fb85150be376c92270d3764e3d6470c452cb70cc558f54e84de5610dd60a9eb3ea02d5d4277b1ec75c9804967d278fa8361c7f9b9a
 DIST qemu-8.0.3.tar.xz 126710536 BLAKE2B 071cc1a35209a02e8c5dd4f43cb112f110b4655adb0f870a04fdf9a6e2c761699574e8c9426f70f60787a99acf252d7a64d94a8e837cdfeda93d89428d7866f3 SHA512 18b2ccb65f7ec2ae92f0e04406539620c881e2b75f63816588c86043a07464bb99d16a83e792ed9508de393f4b694c46d52f4d07edf52741e85224c8b8d5d5c3
 DIST qemu-8.0.4.tar.xz 126179324 BLAKE2B dfb98964c629b251f0004b4630ae4500a52465579417d6f5c7dbbb1f672e10d8d7ffb98a4b00e26fb98b3c867208146dbdca026e4d30cbf1752ac733c4d9b915 SHA512 bd5ed682d51f974abd4be93f949701f9b5bfb87fd9929e31df130534da2f2c03b99adc9f924b3efd47d3b254e0e3c0046f4e69fbe9f6d0c4ac1f6babecb29449
+DIST qemu-8.0.5.tar.xz 126175064 BLAKE2B 1d1f78c185ab64b4ca946a44ad04d0bbb6ea48de058037e4ba18176abeb0f0528754c6e832f742f93227182bbce145544eca5b908a366006e7ee58876aca0bda SHA512 ec9679473dda84a2f56ae8ee0039ec4dafb056414bfc5a3a147b2b6bb45ae3b130dd80f6385e8567b5d18f4be94f3536bc8acc45c61eddf40c9678b46cb8bddc
 DIST qemu-8.1.0-docs.tar.xz 2129912 BLAKE2B 8aaf7b748538afdb5bcb6da15dbd96572d086824377c4b0e93f1ddc695f9a4775471e360a9616d2d481dbf8113e91d2601c69d92cef565fb90b65ffacfdb304e SHA512 905515742bb56a439fc8117ec48ea668e7b2bf0244587673e4352d9e8e49911eb84ff093596ff566e44787197cf9789ec8950e3d75fb7a670c5546394a322ac9
 DIST qemu-8.1.0.tar.xz 123550284 BLAKE2B b0fd87a19b13d4bbc6526caa46533073cb4dee6004df5d4fbbef204ee3bc8c2f10ec1eaff554adbb25c9f3143dd68abd09d4a0519c4766299a3ff261d03c73f2 SHA512 c5f5e7ce2d8e3c93a02012b136c866e8577df07da4705a0045916c71caeaa21fa1b2d59a4b22a660789a4159b192e12a443e7cbb0724ee85fea258251731724c
+DIST qemu-8.1.1.tar.xz 123558860 BLAKE2B 71220fad7c9f74bed6211879f01566ac1e52835feb3d45eaa1b2fe1d5f95d9fa5db53b7aec72b4ef098c03d0c4070076c907fb3e6b839002de6f56ee5ab44340 SHA512 199db58f9a413cbe4449ff557bc362e666c6c0291f9963cb74e5542e8abd1edcd65001fa1fd453b850a376de455f93258707ce6feee5a44bf40753b12a2e956c
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.6.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.6.ebuild
new file mode 100644
index 00000000000..2218435d4f6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.6.ebuild
@@ -0,0 +1,972 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=ajak
+QEMU_DOCS_VERSION="7.2.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{9,10,11} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	sys-libs/libcap-ng[static-libs(+)]
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( media-libs/libpng:0=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.12.3
+		>=app-emulation/spice-0.12.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-util/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	!static? (
+		${ALL_DEPEND//\[static-libs(+)]}
+		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	)
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static? (
+		${ALL_DEPEND}
+		${SOFTMMU_TOOLS_DEPEND}
+	)
+	static-user? ( ${ALL_DEPEND} )"
+RDEPEND="${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-6.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-7.2.0-linux-headers-6.2-glibc-2.36.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-blobs
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="static"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--disable-blobs
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="static"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.5.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.5.ebuild
new file mode 100644
index 00000000000..438e63f95e5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.0.5.ebuild
@@ -0,0 +1,970 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+QEMU_DOCS_VERSION="8.0.0"
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		ui/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/cairo
+		x11-libs/gdk-pixbuf:2
+		x11-libs/gtk+:3
+		x11-libs/libX11
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	dev-util/meson
+	sys-apps/texinfo
+	virtual/pkgconfig
+	doc? (
+		dev-python/sphinx[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-8.0.0-make.patch
+	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-8.0.0-remove-python-meson-check.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
+	# this setting (-U then -D..=2) will prevent us from trying out 3, so
+	# drop it. No change to level of protection b/c we patch our toolchain.
+	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
+
+	# Remove bundled modules
+	rm -r dtc meson roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--with-git-submodules=ignore
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS docs/specs/pci-ids.txt
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0-r1.ebuild
similarity index 99%
rename from sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0.ebuild
rename to sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0-r1.ebuild
index e46b8dd200c..785f98ee128 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.0-r1.ebuild
@@ -609,6 +609,7 @@ qemu_src_configure() {
 			# Note: backend order matters here: #716202
 			# We iterate from higher-level to lower level.
 			$(usex pulseaudio pa "")
+			$(usev pipewire)
 			$(usev jack)
 			$(usev sdl)
 			$(usev alsa)
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.1.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.1.ebuild
new file mode 100644
index 00000000000..321b56dd29d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.1.1.ebuild
@@ -0,0 +1,967 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
+# Set to 1 if prebuilt, 0 if not
+# (the construct below is to allow overriding from env for script)
+QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
+QEMU_DOCS_PREBUILT_DEV=sam
+#QEMU_DOCS_VERSION=$(ver_cut 1-3)
+QEMU_DOCS_VERSION=8.1.0
+# Default to generating docs (inc. man pages) if no prebuilt; overridden later
+# bug #830088
+QEMU_DOC_USEFLAG="+doc"
+
+PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_REQ_USE="ncurses,readline"
+
+FIRMWARE_ABI_VERSION="7.2.0"
+
+inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
+		pax-utils xdg-utils
+
+if [[ ${PV} == *9999* ]]; then
+	QEMU_DOCS_PREBUILT=0
+
+	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
+	EGIT_SUBMODULES=(
+		tests/fp/berkeley-softfloat-3
+		tests/fp/berkeley-testfloat-3
+		subprojects/keycodemapdb
+	)
+	inherit git-r3
+	SRC_URI=""
+else
+	MY_P="${PN}-${PV/_rc/-rc}"
+	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
+
+	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
+	fi
+
+	S="${WORKDIR}/${MY_P}"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
+HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
+
+LICENSE="GPL-2 LGPL-2 BSD-2"
+SLOT="0"
+
+[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
+
+IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
+	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
+	jack jemalloc +jpeg
+	lzo multipath
+	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs pipewire
+	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
+	+slirp
+	smartcard snappy spice ssh static-user systemtap test udev usb
+	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
+	zstd"
+
+COMMON_TARGETS="
+	aarch64
+	alpha
+	arm
+	cris
+	hppa
+	i386
+	loongarch64
+	m68k
+	microblaze
+	microblazeel
+	mips
+	mips64
+	mips64el
+	mipsel
+	nios2
+	or1k
+	ppc
+	ppc64
+	riscv32
+	riscv64
+	s390x
+	sh4
+	sh4eb
+	sparc
+	sparc64
+	x86_64
+	xtensa
+	xtensaeb
+"
+IUSE_SOFTMMU_TARGETS="
+	${COMMON_TARGETS}
+	avr
+	rx
+	tricore
+"
+IUSE_USER_TARGETS="
+	${COMMON_TARGETS}
+	aarch64_be
+	armeb
+	hexagon
+	mipsn32
+	mipsn32el
+	ppc64le
+	sparc32plus
+"
+
+use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
+use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
+IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
+
+RESTRICT="!test? ( test )"
+
+# Allow no targets to be built so that people can get a tools-only build.
+# Block USE flag configurations known to not work.
+REQUIRED_USE="
+	${PYTHON_REQUIRED_USE}
+	qemu_softmmu_targets_arm? ( fdt )
+	qemu_softmmu_targets_microblaze? ( fdt )
+	qemu_softmmu_targets_mips64el? ( fdt )
+	qemu_softmmu_targets_ppc64? ( fdt )
+	qemu_softmmu_targets_ppc? ( fdt )
+	qemu_softmmu_targets_riscv32? ( fdt )
+	qemu_softmmu_targets_riscv64? ( fdt )
+	qemu_softmmu_targets_x86_64? ( fdt )
+	sdl-image? ( sdl )
+	static-user? ( !plugins )
+	virgl? ( opengl )
+	virtfs? ( xattr )
+	vnc? ( gnutls )
+	vte? ( gtk )
+	multipath? ( udev )
+	plugins? ( !static-user )
+"
+for smname in ${IUSE_SOFTMMU_TARGETS} ; do
+	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( kernel_linux? ( seccomp ) )"
+done
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# and user/softmmu targets (qemu-*, qemu-system-*).
+#
+# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
+#
+# The attr lib isn't always linked in (although the USE flag is always
+# respected).  This is because qemu supports using the C library's API
+# when available rather than always using the external library.
+ALL_DEPEND="
+	dev-libs/glib:2[static-libs(+)]
+	sys-libs/zlib[static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	systemtap? ( dev-util/systemtap )
+	xattr? ( sys-apps/attr[static-libs(+)] )
+"
+
+# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
+# softmmu targets (qemu-system-*).
+SOFTMMU_TOOLS_DEPEND="
+	>=x11-libs/pixman-0.28.0[static-libs(+)]
+	accessibility? (
+		app-accessibility/brltty[api]
+		app-accessibility/brltty[static-libs(+)]
+	)
+	aio? ( dev-libs/libaio[static-libs(+)] )
+	alsa? ( >=media-libs/alsa-lib-1.0.13 )
+	bpf? ( dev-libs/libbpf:= )
+	bzip2? ( app-arch/bzip2[static-libs(+)] )
+	capstone? ( dev-libs/capstone:=[static-libs(+)] )
+	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
+	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
+	gnutls? (
+		>=net-libs/gnutls-3.0:=[static-libs(+)]
+		dev-libs/nettle:=[static-libs(+)]
+	)
+	gtk? (
+		x11-libs/gtk+:3
+		vte? ( x11-libs/vte:2.91 )
+	)
+	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
+	iscsi? ( net-libs/libiscsi )
+	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
+	jack? ( virtual/jack )
+	jemalloc? ( dev-libs/jemalloc )
+	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
+	kernel_linux? ( sys-libs/libcap-ng[static-libs(+)] )
+	lzo? ( dev-libs/lzo:2[static-libs(+)] )
+	multipath? ( sys-fs/multipath-tools )
+	ncurses? (
+		sys-libs/ncurses:=[unicode(+)]
+		sys-libs/ncurses:=[static-libs(+)]
+	)
+	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
+	numa? ( sys-process/numactl[static-libs(+)] )
+	opengl? (
+		virtual/opengl
+		media-libs/libepoxy[static-libs(+)]
+		media-libs/mesa[static-libs(+)]
+		media-libs/mesa[egl(+),gbm(+)]
+	)
+	pam? ( sys-libs/pam )
+	pipewire? ( >=media-video/pipewire-0.3.60 )
+	png? ( >=media-libs/libpng-1.6.34:=[static-libs(+)] )
+	pulseaudio? ( media-libs/libpulse )
+	rbd? ( sys-cluster/ceph )
+	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
+	sdl? (
+		media-libs/libsdl2[video]
+		media-libs/libsdl2[static-libs(+)]
+	)
+	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
+	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
+	slirp? ( net-libs/libslirp[static-libs(+)] )
+	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
+	snappy? ( app-arch/snappy:= )
+	spice? (
+		>=app-emulation/spice-protocol-0.14.0
+		>=app-emulation/spice-0.14.0[static-libs(+)]
+	)
+	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
+	udev? ( virtual/libudev:= )
+	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
+	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
+	vde? ( net-misc/vde[static-libs(+)] )
+	virgl? ( media-libs/virglrenderer[static-libs(+)] )
+	virtfs? ( sys-libs/libcap )
+	xen? ( app-emulation/xen-tools:= )
+	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
+"
+
+EDK2_OVMF_VERSION="202202"
+SEABIOS_VERSION="1.16.0"
+
+X86_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		~sys-firmware/sgabios-0.1_pre10[binary]
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/edk2-ovmf-${EDK2_OVMF_VERSION}
+			>=sys-firmware/edk2-ovmf-bin-${EDK2_OVMF_VERSION}
+		)
+		sys-firmware/ipxe[qemu]
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+		sys-firmware/sgabios
+	)
+"
+PPC_FIRMWARE_DEPEND="
+	pin-upstream-blobs? (
+		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
+	)
+	!pin-upstream-blobs? (
+		|| (
+			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
+			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
+		)
+	)
+"
+
+# See bug #913084 for pip dep
+BDEPEND="
+	$(python_gen_impl_dep)
+	dev-lang/perl
+	>=dev-util/meson-0.63.0
+	dev-python/pip[${PYTHON_USEDEP}]
+	virtual/pkgconfig
+	doc? (
+		>=dev-python/sphinx-1.6.0[${PYTHON_USEDEP}]
+		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
+	)
+	gtk? ( nls? ( sys-devel/gettext ) )
+	test? (
+		dev-libs/glib[utils]
+		sys-devel/bc
+	)
+"
+CDEPEND="
+	${ALL_DEPEND//\[static-libs(+)]}
+	${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
+	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
+	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
+"
+DEPEND="
+	${CDEPEND}
+	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
+	static-user? ( ${ALL_DEPEND} )
+"
+RDEPEND="
+	${CDEPEND}
+	acct-group/kvm
+	selinux? (
+		sec-policy/selinux-qemu
+		sys-libs/libselinux
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-8.0.0-disable-keymap.patch
+	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
+	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
+	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+)
+
+QA_PREBUILT="
+	usr/share/qemu/hppa-firmware.img
+	usr/share/qemu/openbios-ppc
+	usr/share/qemu/openbios-sparc64
+	usr/share/qemu/openbios-sparc32
+	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
+	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
+	usr/share/qemu/palcode-clipper
+	usr/share/qemu/s390-ccw.img
+	usr/share/qemu/s390-netboot.img
+	usr/share/qemu/u-boot.e500
+"
+
+QA_WX_LOAD="
+	usr/bin/qemu-i386
+	usr/bin/qemu-x86_64
+	usr/bin/qemu-alpha
+	usr/bin/qemu-arm
+	usr/bin/qemu-cris
+	usr/bin/qemu-m68k
+	usr/bin/qemu-microblaze
+	usr/bin/qemu-microblazeel
+	usr/bin/qemu-mips
+	usr/bin/qemu-mipsel
+	usr/bin/qemu-or1k
+	usr/bin/qemu-ppc
+	usr/bin/qemu-ppc64
+	usr/bin/qemu-sh4
+	usr/bin/qemu-sh4eb
+	usr/bin/qemu-sparc
+	usr/bin/qemu-sparc64
+	usr/bin/qemu-armeb
+	usr/bin/qemu-sparc32plus
+	usr/bin/qemu-s390x
+	usr/bin/qemu-unicore32
+"
+
+DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
+kernel module loaded before running kvm. The easiest way to ensure that the
+kernel module is loaded is to load it on boot.
+	For AMD CPUs the module is called 'kvm-amd'.
+	For Intel CPUs the module is called 'kvm-intel'.
+Please review /etc/conf.d/modules for how to load these.
+
+Make sure your user is in the 'kvm' group. Just run
+	$ gpasswd -a <USER> kvm
+then have <USER> re-login.
+
+For brand new installs, the default permissions on /dev/kvm might not let
+you access it.  You can tell udev to reset ownership/perms:
+	$ udevadm trigger -c add /dev/kvm
+
+If you want to register binfmt handlers for qemu user targets:
+For openrc:
+	# rc-update add qemu-binfmt
+For systemd:
+	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
+
+pkg_pretend() {
+	if use kernel_linux && kernel_is lt 2 6 25; then
+		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
+	elif use kernel_linux; then
+		if ! linux_config_exists; then
+			eerror "Unable to check your kernel for KVM support"
+		else
+			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
+			ERROR_KVM="You must enable KVM in your kernel to continue"
+			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
+			ERROR_KVM_AMD+=" your kernel configuration."
+			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
+			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
+			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
+			ERROR_TUN+=" into your kernel or loaded as a module to use the"
+			ERROR_TUN+=" virtual network device if using -net tap."
+			ERROR_BRIDGE="You will also need support for 802.1d"
+			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
+			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
+			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
+			ERROR_VHOST_NET+=" support"
+
+			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
+				if grep -q AuthenticAMD /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_AMD"
+				elif grep -q GenuineIntel /proc/cpuinfo; then
+					CONFIG_CHECK+=" ~KVM_INTEL"
+				fi
+			fi
+
+			use python && CONFIG_CHECK+=" ~DEBUG_FS"
+			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
+
+			# Now do the actual checks setup above
+			check_extra_config
+		fi
+	fi
+
+	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
+		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
+		eerror "instances are still pointing to it.  Please update your"
+		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
+		eerror "and the right system binary (e.g. qemu-system-x86_64)."
+		die "update your virt configs to not use qemu-kvm"
+	fi
+}
+
+# Sanity check to make sure target lists are kept up-to-date.
+check_targets() {
+	local var=$1 mak=$2
+	local detected sorted
+
+	pushd "${S}"/configs/targets/ >/dev/null || die
+
+	# Force C locale until glibc is updated. #564936
+	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
+	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
+	if [[ ${sorted} != "${detected}" ]] ; then
+		eerror "The ebuild needs to be kept in sync."
+		eerror "${var}: ${sorted}"
+		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
+		die "sync ${var} to the list of targets"
+	fi
+
+	popd >/dev/null
+}
+
+src_prepare() {
+	check_targets IUSE_SOFTMMU_TARGETS softmmu
+	check_targets IUSE_USER_TARGETS linux-user
+
+	default
+
+	# Use correct toolchain to fix cross-compiling
+	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
+	export WINDRES=${CHOST}-windres
+
+	# Verbose builds
+	MAKEOPTS+=" V=1"
+
+	# Remove bundled modules
+	rm -r subprojects/dtc roms/*/ || die
+}
+
+##
+# configures qemu based on the build directory and the build type
+# we are using.
+#
+qemu_src_configure() {
+	debug-print-function ${FUNCNAME} "$@"
+
+	local buildtype=$1
+	local builddir="${S}/${buildtype}-build"
+
+	mkdir "${builddir}" || die
+
+	local conf_opts=(
+		--prefix=/usr
+		--sysconfdir=/etc
+		--bindir=/usr/bin
+		--libdir=/usr/$(get_libdir)
+		--datadir=/usr/share
+		--docdir=/usr/share/doc/${PF}/html
+		--mandir=/usr/share/man
+		--localstatedir=/var
+		--disable-bsd-user
+		--disable-containers # bug #732972
+		--disable-guest-agent
+		--disable-strip
+		--disable-download
+
+		# bug #746752: TCG interpreter has a few limitations:
+		# - it does not support FPU
+		# - it's generally slower on non-self-modifying code
+		# It's advantage is support for host architectures
+		# where native codegeneration is not implemented.
+		# Gentoo has qemu keyworded only on targets with
+		# native code generation available. Avoid the interpreter.
+		--disable-tcg-interpreter
+
+		--disable-werror
+		# We support gnutls/nettle for crypto operations.  It is possible
+		# to use gcrypt when gnutls/nettle are disabled (but not when they
+		# are enabled), but it's not really worth the hassle.  Disable it
+		# all the time to avoid automatically detecting it. #568856
+		--disable-gcrypt
+		--cc="$(tc-getCC)"
+		--cxx="$(tc-getCXX)"
+		--objcc="$(tc-getCC)"
+		--host-cc="$(tc-getBUILD_CC)"
+
+		$(use_enable alsa)
+		$(use_enable debug debug-info)
+		$(use_enable debug debug-tcg)
+		$(use_enable jack)
+		$(use_enable nls gettext)
+		$(use_enable oss)
+		$(use_enable pipewire)
+		$(use_enable plugins)
+		$(use_enable pulseaudio pa)
+		$(use_enable selinux)
+		$(use_enable xattr attr)
+	)
+
+	# Disable options not used by user targets. This simplifies building
+	# static user targets (USE=static-user) considerably.
+	conf_notuser() {
+		if [[ ${buildtype} == "user" ]] ; then
+			echo "--disable-${2:-$1}"
+		else
+			use_enable "$@"
+		fi
+	}
+	# Enable option only for softmmu build, but not 'user' or 'tools'
+	conf_softmmu() {
+		if [[ ${buildtype} == "softmmu" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Enable option only for tools build, but not 'user' or 'softmmu'
+	conf_tools() {
+		if [[ ${buildtype} == "tools" ]] ; then
+			use_enable "$@"
+		else
+			echo "--disable-${2:-$1}"
+		fi
+	}
+	# Special case for the malloc flag, because the --disable flag does
+	# not exist and trying like above will break configuring.
+	conf_malloc() {
+		if [[ ! ${buildtype} == "user" ]] ; then
+			usex "${1}" "--enable-malloc=${1}" ""
+		fi
+	}
+	conf_opts+=(
+		$(conf_notuser accessibility brlapi)
+		$(conf_notuser aio linux-aio)
+		$(conf_softmmu bpf)
+		$(conf_notuser bzip2)
+		$(conf_notuser capstone)
+		$(conf_notuser curl)
+		$(conf_tools doc docs)
+		$(conf_notuser fdt)
+		$(conf_notuser fuse)
+		$(conf_notuser glusterfs)
+		$(conf_notuser gnutls)
+		$(conf_notuser gnutls nettle)
+		$(conf_notuser gtk)
+		$(conf_notuser infiniband rdma)
+		$(conf_notuser iscsi libiscsi)
+		$(conf_notuser io-uring linux-io-uring)
+		$(conf_malloc jemalloc)
+		$(conf_notuser jpeg vnc-jpeg)
+		$(conf_notuser kernel_linux kvm)
+		$(conf_notuser lzo)
+		$(conf_notuser multipath mpath)
+		$(conf_notuser ncurses curses)
+		$(conf_notuser nfs libnfs)
+		$(conf_notuser numa)
+		$(conf_notuser opengl)
+		$(conf_notuser pam auth-pam)
+		$(conf_notuser png)
+		$(conf_notuser rbd)
+		$(conf_notuser sasl vnc-sasl)
+		$(conf_notuser sdl)
+		$(conf_softmmu sdl-image)
+		$(conf_notuser seccomp)
+		$(conf_notuser slirp)
+		$(conf_notuser smartcard)
+		$(conf_notuser snappy)
+		$(conf_notuser spice)
+		$(conf_notuser ssh libssh)
+		$(conf_notuser udev libudev)
+		$(conf_notuser usb libusb)
+		$(conf_notuser usbredir usb-redir)
+		$(conf_notuser vde)
+		$(conf_notuser vhost-net)
+		$(conf_notuser virgl virglrenderer)
+		$(conf_softmmu virtfs)
+		$(conf_notuser vnc)
+		$(conf_notuser vte)
+		$(conf_notuser xen)
+		$(conf_notuser xen xen-pci-passthrough)
+		# use prebuilt keymaps, bug #759604
+		--disable-xkbcommon
+		$(conf_notuser zstd)
+	)
+
+	if [[ ! ${buildtype} == "user" ]] ; then
+		# audio options
+		local audio_opts=(
+			# Note: backend order matters here: #716202
+			# We iterate from higher-level to lower level.
+			$(usex pulseaudio pa "")
+			$(usev pipewire)
+			$(usev jack)
+			$(usev sdl)
+			$(usev alsa)
+			$(usev oss)
+		)
+		conf_opts+=(
+			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
+		)
+	fi
+
+	case ${buildtype} in
+	user)
+		conf_opts+=(
+			--enable-linux-user
+			--disable-system
+			--disable-tools
+			--disable-cap-ng
+			--disable-seccomp
+		)
+		local static_flag="static-user"
+		;;
+	softmmu)
+		conf_opts+=(
+			--disable-linux-user
+			--enable-system
+			--disable-tools
+			--enable-cap-ng
+			--enable-seccomp
+		)
+		local static_flag="none"
+		;;
+	tools)
+		conf_opts+=(
+			--disable-linux-user
+			--disable-system
+			--enable-tools
+			--enable-cap-ng
+		)
+		local static_flag="none"
+		;;
+	esac
+
+	local targets="${buildtype}_targets"
+	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
+
+	# Add support for SystemTAP
+	use systemtap && conf_opts+=( --enable-trace-backends="dtrace" )
+
+	# We always want to attempt to build with PIE support as it results
+	# in a more secure binary. But it doesn't work with static or if
+	# the current GCC doesn't have PIE support.
+	if [[ ${static_flag} != "none" ]] && use ${static_flag}; then
+		conf_opts+=( --static --disable-pie )
+	else
+		tc-enables-pie && conf_opts+=( --enable-pie )
+	fi
+
+	# Meson will not use a cross-file unless cross_prefix is set.
+	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
+
+	# Plumb through equivalent of EXTRA_ECONF to allow experiments
+	# like bug #747928.
+	conf_opts+=( ${EXTRA_CONF_QEMU} )
+
+	echo "../configure ${conf_opts[*]}"
+	cd "${builddir}"
+	../configure "${conf_opts[@]}" || die "configure failed"
+}
+
+src_configure() {
+	local target
+
+	python_setup
+
+	softmmu_targets= softmmu_bins=()
+	user_targets= user_bins=()
+
+	for target in ${IUSE_SOFTMMU_TARGETS} ; do
+		if use "qemu_softmmu_targets_${target}"; then
+			softmmu_targets+=",${target}-softmmu"
+			softmmu_bins+=( "qemu-system-${target}" )
+		fi
+	done
+
+	for target in ${IUSE_USER_TARGETS} ; do
+		if use "qemu_user_targets_${target}"; then
+			user_targets+=",${target}-linux-user"
+			user_bins+=( "qemu-${target}" )
+		fi
+	done
+
+	softmmu_targets=${softmmu_targets#,}
+	user_targets=${user_targets#,}
+
+	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
+	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
+	qemu_src_configure "tools"
+}
+
+src_compile() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build" || die
+		default
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		default
+	fi
+
+	cd "${S}/tools-build" || die
+	default
+}
+
+src_test() {
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build" || die
+		pax-mark m */qemu-system-* #515550
+		emake check
+	fi
+}
+
+qemu_python_install() {
+	python_domodule "${S}/python/qemu"
+
+	python_doscript "${S}/scripts/kvm/vmxcap"
+	python_doscript "${S}/scripts/qmp/qmp-shell"
+	python_doscript "${S}/scripts/qmp/qemu-ga-client"
+}
+
+# Generate binfmt support files.
+#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
+#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
+generate_initd() {
+	local out="${T}/qemu-binfmt"
+	local out_systemd="${T}/qemu.conf"
+	local d="${T}/binfmt.d"
+
+	einfo "Generating qemu binfmt scripts and configuration files"
+
+	# Generate the debian fragments first.
+	mkdir -p "${d}"
+	"${S}"/scripts/qemu-binfmt-conf.sh \
+		--debian \
+		--exportdir "${d}" \
+		--qemu-path "${EPREFIX}/usr/bin" \
+		|| die
+	# Then turn the fragments into a shell script we can source.
+	sed -E -i \
+		-e 's:^([^ ]+) (.*)$:\1="\2":' \
+		"${d}"/* || die
+
+	# Generate the init.d script by assembling the fragments from above.
+	local f qcpu package interpreter magic mask
+	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
+	for f in "${d}"/qemu-* ; do
+		source "${f}"
+
+		# Normalize the cpu logic like we do in the init.d for the native cpu.
+		qcpu=${package#qemu-}
+		case ${qcpu} in
+		arm*)   qcpu="arm";;
+		mips*)  qcpu="mips";;
+		ppc*)   qcpu="ppc";;
+		s390*)  qcpu="s390";;
+		sh*)    qcpu="sh";;
+		sparc*) qcpu="sparc";;
+		esac
+
+		# we use 'printf' here to be portable across 'sh'
+		# implementations: #679168
+		cat <<EOF >>"${out}"
+	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
+		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
+	fi
+EOF
+
+		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
+
+	done
+	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
+}
+
+src_install() {
+	if [[ -n ${user_targets} ]]; then
+		cd "${S}/user-build"
+		emake DESTDIR="${ED}" install
+
+		# Install binfmt handler init script for user targets.
+		generate_initd
+		doinitd "${T}/qemu-binfmt"
+
+		# Install binfmt/qemu.conf.
+		insinto "/usr/share/qemu/binfmt.d"
+		doins "${T}/qemu.conf"
+	fi
+
+	if [[ -n ${softmmu_targets} ]]; then
+		cd "${S}/softmmu-build"
+		emake DESTDIR="${ED}" install
+
+		# This might not exist if the test failed. #512010
+		[[ -e check-report.html ]] && dodoc check-report.html
+
+		if use kernel_linux; then
+			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
+		fi
+
+		if use python; then
+			python_foreach_impl qemu_python_install
+		fi
+	fi
+
+	cd "${S}/tools-build" || die
+	emake DESTDIR="${ED}" install
+
+	# If USE=doc, there'll be newly generated docs which we install instead.
+	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
+		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
+	fi
+
+	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
+	pushd "${ED}"/usr/bin >/dev/null || die
+	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
+	popd >/dev/null || die
+
+	# Install config file example for qemu-bridge-helper
+	insinto "/etc/qemu"
+	doins "${FILESDIR}/bridge.conf"
+
+	cd "${S}" || die
+	dodoc MAINTAINERS
+	newdoc pc-bios/README README.pc-bios
+
+	# Disallow stripping of prebuilt firmware files.
+	dostrip -x ${QA_PREBUILT}
+
+	if [[ -n ${softmmu_targets} ]]; then
+		# Remove SeaBIOS since we're using the SeaBIOS packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
+		fi
+
+		# Remove vgabios since we're using the seavgabios packaged one
+		rm "${ED}/usr/share/qemu/vgabios.bin"
+		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
+		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
+		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
+		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
+		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
+
+		# PPC/PPC64 loads vgabios-stdvga
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
+			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
+			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
+			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
+			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
+			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
+			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
+		fi
+
+		# Remove sgabios since we're using the sgabios packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
+		fi
+
+		# Remove iPXE since we're using the iPXE packaged one
+		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
+			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
+			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
+			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
+			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
+			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
+			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
+		fi
+	fi
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_create_doc
+}
+
+firmware_abi_change() {
+	local pv
+	for pv in ${REPLACING_VERSIONS}; do
+		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
+			return 0
+		fi
+	done
+	return 1
+}
+
+pkg_postinst() {
+	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
+		udev_reload
+	fi
+
+	xdg_icon_cache_update
+
+	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
+		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
+
+	DISABLE_AUTOFORMATTING=true
+	readme.gentoo_print_elog
+
+	if use pin-upstream-blobs && firmware_abi_change; then
+		ewarn "This version of qemu pins new versions of firmware blobs:"
+
+		if has_version 'sys-firmware/edk2-ovmf-bin'; then
+			ewarn "	$(best_version sys-firmware/edk2-ovmf-bin)"
+		else
+			ewarn " $(best_version sys-firmware/edk2-ovmf)"
+		fi
+
+		if has_version 'sys-firmware/seabios-bin'; then
+			ewarn "	$(best_version sys-firmware/seabios-bin)"
+		else
+			ewarn " $(best_version sys-firmware/seabios)"
+		fi
+
+		ewarn "	$(best_version sys-firmware/ipxe)"
+		ewarn "	$(best_version sys-firmware/sgabios)"
+		ewarn "This might break resume of hibernated guests (started with a different"
+		ewarn "firmware version) and live migration to/from qemu versions with different"
+		ewarn "firmware. Please (cold) restart all running guests. For functional"
+		ewarn "guest migration ensure that all"
+		ewarn "hosts run at least"
+		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
+	fi
+}
+
+pkg_info() {
+	echo "Using:"
+	echo "  $(best_version app-emulation/spice-protocol)"
+
+	if has_version 'sys-firmware/edk2-ovmf-bin'; then
+		echo "  $(best_version sys-firmware/edk2-ovmf-bin)"
+	else
+		echo "  $(best_version sys-firmware/edk2-ovmf)"
+	fi
+
+	if has_version 'sys-firmware/seabios-bin'; then
+		echo "  $(best_version sys-firmware/seabios-bin)"
+	else
+		echo "  $(best_version sys-firmware/seabios)"
+	fi
+
+	echo "  $(best_version sys-firmware/ipxe)"
+	echo "  $(best_version sys-firmware/sgabios)"
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	udev_reload
+}
diff --git a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
index 6ca0885e7e5..6bc1056cfd1 100644
--- a/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild
@@ -613,6 +613,7 @@ qemu_src_configure() {
 			# Note: backend order matters here: #716202
 			# We iterate from higher-level to lower level.
 			$(usex pulseaudio pa "")
+			$(usev pipewire)
 			$(usev jack)
 			$(usev sdl)
 			$(usev alsa)
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
index 061a6b88e5c..81b50ebacaa 100644
--- a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/Manifest
@@ -1,4 +1,6 @@
 DIST sqlite-doc-3420000.zip 10665938 BLAKE2B 62aef59e6976101ecca60d1ee194e9e558009dd8bdb7cd911f9938f1256e50bc946f8ca554666b6c101f7024baac7857b83adf6e897164afb9b5c4d4917593d1 SHA512 d675ee2897323d468816bc713594c4e94cb5c15270b4f991758e2c82e2891ad724c5790f29b76bc9e5d6b3be04e95aee371c57ceb2d855c1057b4af62a5af162
 DIST sqlite-doc-3430000.zip 10663888 BLAKE2B 2bffca5a33c46183bf9d82042b89ad0968aa6061c7ccd5f6cd7a886ae48faa9a5356883b02048b66661f253401513d90f689f8a9f6debc0897cd25997c19ab4e SHA512 393c759e86a2fd6a7bbdc820c78289b84f984acd83879d7385c8627c73060562d376d66a9464887fdbccdea395025db677aa4c6f37aa32e99048fcde3561ae06
+DIST sqlite-doc-3430100.zip 10668827 BLAKE2B 66ae2abbe4e6f7e7922f55f90f0bdac150948b7d76c633299a4ce34dfaa050d7b0f7404938c3b39c2b117223a5bc57ca981e466d8fc1efef5d0a1892350e64c3 SHA512 62c107d716c3c656b12a08750f81db25ccb68c267795247307be88a44b3fe7ceb0f1563278a2f504b91cd985a83196a50e58de5f3240601c49a25b2b3e147d8c
 DIST sqlite-src-3420000.zip 13910252 BLAKE2B defe14bf0b5588775b2a2b17b3adbbaf39f1e95eac049cbd4868e2e59fbf50fb92b11c74ecf12fe0138521e7d4d3cc2a4bf45e7c83fd774abd7aa9ed7ee0f925 SHA512 509b7aa292870c927ef137469028e5e07ca74907414c5b295360cb10b377a42de7469d3afe79f8d9947d486ef74d676679c7f2d3b1caaeb8c949f27201180def
 DIST sqlite-src-3430000.zip 13927457 BLAKE2B dfa7311af66b76ca18001f98712f6187030d24e4ca679dbe1d30ef12d77f439056724087ae19640a77b075b35e3faeecc342ab8fcd5625ccd832f3e0fbe2b004 SHA512 56a16980bf10ba0d312ada183cabaa4123faf4ed531749d70349ca55ca11cc8a6733f473b2247f6cc0e500523f1b598ffee31efb81e07879c523957f0e3efa90
+DIST sqlite-src-3430100.zip 13928044 BLAKE2B dcd1927bc092b5b8a2eb244132a8c4d62a17ab2fe67c2c53c3c48159c9fa6055fd35627ac6339b95627da5fa5d374db43e0dfa4d2f733e5fa7ad0844e8208018 SHA512 90f320653069b5ba9caadc8fbc914c7e63e520b884dbf9267badb07f5c573141d7db903dbfbcc0a97f6a116d8c4edec0cfac70c3c6b8ffb2efbb808f559173e3
diff --git a/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.43.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.43.1.ebuild
new file mode 100644
index 00000000000..fb473fb1a98
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-db/sqlite/sqlite-3.43.1.ebuild
@@ -0,0 +1,428 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic multilib-minimal toolchain-funcs
+
+DESCRIPTION="SQL database engine"
+HOMEPAGE="https://sqlite.org/"
+
+# On version updates, make sure to read the forum (https://sqlite.org/forum/forum)
+# for hints regarding test failures, backports, etc.
+if [[ ${PV} == 9999 ]]; then
+	S="${WORKDIR}"/${PN}
+	PROPERTIES="live"
+else
+	printf -v SRC_PV "%u%02u%02u%02u" $(ver_rs 1- " ")
+	DOC_PV="${SRC_PV}"
+	#printf -v DOC_PV "%u%02u%02u00" $(ver_rs 1-3 " ")
+
+	SRC_URI="
+		https://sqlite.org/2023/${PN}-src-${SRC_PV}.zip
+		doc? ( https://sqlite.org/2023/${PN}-doc-${DOC_PV}.zip )
+	"
+	S="${WORKDIR}/${PN}-src-${SRC_PV}"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="public-domain"
+SLOT="3"
+IUSE="debug doc icu +readline secure-delete static-libs tcl test tools"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	icu? ( dev-libs/icu:=[${MULTILIB_USEDEP}] )
+	readline? ( sys-libs/readline:=[${MULTILIB_USEDEP}] )
+	tcl? ( dev-lang/tcl:=[${MULTILIB_USEDEP}] )
+	tools? ( dev-lang/tcl:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-lang/tcl-8.6:0[${MULTILIB_USEDEP}] )
+"
+BDEPEND=">=dev-lang/tcl-8.6:0"
+if [[ ${PV} == 9999 ]]; then
+	BDEPEND+=" dev-vcs/fossil"
+else
+	BDEPEND+=" app-arch/unzip"
+fi
+
+_fossil_fetch() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local repo_uri="${2}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	mkdir -p "${T}/fossil/${repo_id}" || die
+	pushd "${T}/fossil/${repo_id}" > /dev/null || die
+
+	if [[ -n "${EVCS_OFFLINE}" ]]; then
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			die "Network activity disabled using EVCS_OFFLINE and clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+		fi
+	else
+		if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+			einfo fossil clone --verbose "${repo_uri}" "${repo_id}.fossil"
+			fossil clone --verbose "${repo_uri}" "${repo_id}.fossil" || die
+			echo
+		else
+			cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" . || die
+			einfo fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}"
+			fossil pull --repository "${repo_id}.fossil" --verbose "${repo_uri}" || die
+			echo
+		fi
+
+		(
+			addwrite "${distdir}"
+			mkdir -p "${distdir}/fossil-src/${repo_id}" || die
+			cp -p "${repo_id}.fossil" "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" || die
+		)
+	fi
+
+	popd > /dev/null || die
+}
+
+_fossil_checkout() {
+	local distdir="${PORTAGE_ACTUAL_DISTDIR:-${DISTDIR}}"
+	local repo_id="${1}"
+	local branch_or_commit="${2}"
+	local target_directory="${3}"
+
+	local -x FOSSIL_HOME="${HOME}"
+
+	if [[ ! -f "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" ]]; then
+		die "Clone of repository missing: \"${distdir}/fossil-src/${repo_id}/${repo_id}.fossil\""
+	fi
+
+	if [[ ! -f "${T}/fossil/${repo_id}/${repo_id}.fossil" ]]; then
+		mkdir -p "${T}/fossil/${repo_id}" || die
+		cp -p "${distdir}/fossil-src/${repo_id}/${repo_id}.fossil" "${T}/fossil/${repo_id}" || die
+	fi
+
+	mkdir "${target_directory}" || die
+	pushd "${target_directory}" > /dev/null || die
+
+	einfo fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}"
+	fossil open --quiet "${T}/fossil/${repo_id}/${repo_id}.fossil" "${branch_or_commit}" || die
+	echo
+
+	popd > /dev/null || die
+}
+
+fossil_fetch() {
+	local repo_id="${1}"
+	local repo_uri="${2}"
+	local target_directory="${3}"
+
+	local branch_or_commit="${EFOSSIL_COMMIT:-${EFOSSIL_BRANCH:-trunk}}"
+
+	_fossil_fetch "${repo_id}" "${repo_uri}"
+	_fossil_checkout "${repo_id}" "${branch_or_commit}" "${target_directory}"
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]]; then
+		fossil_fetch sqlite https://sqlite.org/src "${WORKDIR}/${PN}"
+		if use doc; then
+			fossil_fetch sqlite-doc https://sqlite.org/docsrc "${WORKDIR}/${PN}-doc"
+		fi
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	eautoreconf
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	local -x CPPFLAGS="${CPPFLAGS}" CFLAGS="${CFLAGS}"
+	local options=()
+
+	options+=(
+		--enable-load-extension
+		--enable-threadsafe
+	)
+
+	# Support detection of misuse of SQLite API.
+	# https://sqlite.org/compile.html#enable_api_armor
+	append-cppflags -DSQLITE_ENABLE_API_ARMOR
+
+	# Support bytecode and tables_used virtual tables.
+	# https://sqlite.org/compile.html#enable_bytecode_vtab
+	# https://sqlite.org/bytecodevtab.html
+	append-cppflags -DSQLITE_ENABLE_BYTECODE_VTAB
+
+	# Support column metadata functions.
+	# https://sqlite.org/compile.html#enable_column_metadata
+	# https://sqlite.org/c3ref/column_database_name.html
+	append-cppflags -DSQLITE_ENABLE_COLUMN_METADATA
+
+	# Support sqlite_dbpage virtual table.
+	# https://sqlite.org/compile.html#enable_dbpage_vtab
+	# https://sqlite.org/dbpage.html
+	append-cppflags -DSQLITE_ENABLE_DBPAGE_VTAB
+
+	# Support dbstat virtual table.
+	# https://sqlite.org/compile.html#enable_dbstat_vtab
+	# https://sqlite.org/dbstat.html
+	append-cppflags -DSQLITE_ENABLE_DBSTAT_VTAB
+
+	# Support sqlite3_serialize() and sqlite3_deserialize() functions.
+	# https://sqlite.org/compile.html#enable_deserialize
+	# https://sqlite.org/c3ref/serialize.html
+	# https://sqlite.org/c3ref/deserialize.html
+	append-cppflags -DSQLITE_ENABLE_DESERIALIZE
+
+	# Support comments in output of EXPLAIN.
+	# https://sqlite.org/compile.html#enable_explain_comments
+	append-cppflags -DSQLITE_ENABLE_EXPLAIN_COMMENTS
+
+	# Support Full-Text Search versions 3, 4 and 5.
+	# https://sqlite.org/compile.html#enable_fts3
+	# https://sqlite.org/compile.html#enable_fts3_parenthesis
+	# https://sqlite.org/compile.html#enable_fts4
+	# https://sqlite.org/compile.html#enable_fts5
+	# https://sqlite.org/fts3.html
+	# https://sqlite.org/fts5.html
+	append-cppflags -DSQLITE_ENABLE_FTS3 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_FTS4
+	options+=( --enable-fts5 )
+
+	# Support hidden columns.
+	append-cppflags -DSQLITE_ENABLE_HIDDEN_COLUMNS
+
+	# Support memsys5 memory allocator.
+	# https://sqlite.org/compile.html#enable_memsys5
+	# https://sqlite.org/malloc.html#memsys5
+	append-cppflags -DSQLITE_ENABLE_MEMSYS5
+
+	# Support sqlite3_normalized_sql() function.
+	# https://sqlite.org/c3ref/expanded_sql.html
+	append-cppflags -DSQLITE_ENABLE_NORMALIZE
+
+	# Support sqlite_offset() function.
+	# https://sqlite.org/compile.html#enable_offset_sql_func
+	# https://sqlite.org/lang_corefunc.html#sqlite_offset
+	append-cppflags -DSQLITE_ENABLE_OFFSET_SQL_FUNC
+
+	# Support pre-update hook functions.
+	# https://sqlite.org/compile.html#enable_preupdate_hook
+	# https://sqlite.org/c3ref/preupdate_count.html
+	append-cppflags -DSQLITE_ENABLE_PREUPDATE_HOOK
+
+	# Support Resumable Bulk Update extension.
+	# https://sqlite.org/compile.html#enable_rbu
+	# https://sqlite.org/rbu.html
+	append-cppflags -DSQLITE_ENABLE_RBU
+
+	# Support R*Trees.
+	# https://sqlite.org/compile.html#enable_rtree
+	# https://sqlite.org/compile.html#enable_geopoly
+	# https://sqlite.org/rtree.html
+	# https://sqlite.org/geopoly.html
+	append-cppflags -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_GEOPOLY
+
+	# Support Session extension.
+	# https://sqlite.org/compile.html#enable_session
+	# https://sqlite.org/sessionintro.html
+	append-cppflags -DSQLITE_ENABLE_SESSION
+
+	# Support scan status functions.
+	# https://sqlite.org/compile.html#enable_stmt_scanstatus
+	# https://sqlite.org/c3ref/stmt_scanstatus.html
+	# https://sqlite.org/c3ref/stmt_scanstatus_reset.html
+	append-cppflags -DSQLITE_ENABLE_STMT_SCANSTATUS
+
+	# Support sqlite_stmt virtual table.
+	# https://sqlite.org/compile.html#enable_stmtvtab
+	# https://sqlite.org/stmt.html
+	append-cppflags -DSQLITE_ENABLE_STMTVTAB
+
+	# Support unknown() function.
+	# https://sqlite.org/compile.html#enable_unknown_sql_function
+	append-cppflags -DSQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
+
+	# Support unlock notification.
+	# https://sqlite.org/compile.html#enable_unlock_notify
+	# https://sqlite.org/c3ref/unlock_notify.html
+	# https://sqlite.org/unlock_notify.html
+	append-cppflags -DSQLITE_ENABLE_UNLOCK_NOTIFY
+
+	# Support LIMIT and ORDER BY clauses on DELETE and UPDATE statements.
+	# https://sqlite.org/compile.html#enable_update_delete_limit
+	# https://sqlite.org/lang_delete.html#optional_limit_and_order_by_clauses
+	# https://sqlite.org/lang_update.html#optional_limit_and_order_by_clauses
+	append-cppflags -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT
+
+	# Support soundex() function.
+	# https://sqlite.org/compile.html#soundex
+	# https://sqlite.org/lang_corefunc.html#soundex
+	append-cppflags -DSQLITE_SOUNDEX
+
+	# Support URI filenames.
+	# https://sqlite.org/compile.html#use_uri
+	# https://sqlite.org/uri.html
+	append-cppflags -DSQLITE_USE_URI
+
+	options+=( $(use_enable debug) )
+
+	if use icu; then
+		# Support ICU extension.
+		# https://sqlite.org/compile.html#enable_icu
+		append-cppflags -DSQLITE_ENABLE_ICU
+		sed -e "s/^TLIBS = @LIBS@/& -licui18n -licuuc/" -i Makefile.in || die "sed failed"
+	fi
+
+	options+=(
+		--disable-editline
+		$(use_enable readline)
+	)
+
+	if use readline; then
+		options+=( --with-readline-inc="-I${ESYSROOT}/usr/include/readline" )
+	fi
+
+	if use secure-delete; then
+		# Enable secure_delete pragma by default.
+		# https://sqlite.org/compile.html#secure_delete
+		# https://sqlite.org/pragma.html#pragma_secure_delete
+		append-cppflags -DSQLITE_SECURE_DELETE
+	fi
+
+	options+=( $(use_enable static-libs static) )
+
+	# tcl, test, tools USE flags.
+	if use tcl || use test || { use tools && multilib_is_native_abi; }; then
+		options+=(
+			--enable-tcl
+			--with-tcl="${ESYSROOT}/usr/$(get_libdir)"
+		)
+	else
+		options+=( --disable-tcl )
+	fi
+
+	if [[ "${ABI}" == "x86" ]]; then
+		if $(tc-getCC) ${CPPFLAGS} ${CFLAGS} -E -P -dM - < /dev/null 2> /dev/null | grep -q "^#define __SSE__ 1$"; then
+			append-cflags -mfpmath=sse
+		else
+			append-cflags -ffloat-store
+		fi
+
+		# Skip known-broken test for now
+		# https://sqlite.org/forum/forumpost/d97caf168f
+		# https://sqlite.org/forum/forumpost/50f136d91d
+		if use test ; then
+			rm test/atof1.test || die
+		fi
+	fi
+
+	econf "${options[@]}"
+}
+
+multilib_src_compile() {
+	emake HAVE_TCL="$(usev tcl 1)" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}"
+
+	if use tools && multilib_is_native_abi; then
+		emake changeset dbdump dbhash dbtotxt index_usage rbu scrub showdb showjournal showshm showstat4 showwal sqldiff sqlite3_analyzer sqlite3_checker sqlite3_expert sqltclsh
+	fi
+
+	if [[ ${PV} == 9999 ]] && use doc && multilib_is_native_abi; then
+		emake tclsqlite3.c
+
+		local build_directory="$(pwd)"
+		build_directory="${build_directory##*/}"
+
+		mkdir "${WORKDIR}/${PN}-doc-build" || die
+		pushd "${WORKDIR}/${PN}-doc-build" > /dev/null || die
+
+		emake -f "../${PN}-doc/Makefile" -j1 SRC="../${PN}" BLD="../${build_directory}" DOC="../${PN}-doc" CC="$(tc-getBUILD_CC)" TCLINC="" TCLFLAGS="$($(tc-getBUILD_PKG_CONFIG) --libs tcl) -ldl -lm" base doc
+		rmdir doc/matrix{/*,} || die
+
+		popd > /dev/null || die
+	fi
+}
+
+multilib_src_test() {
+	if [[ "${EUID}" -eq 0 ]]; then
+		ewarn "Skipping tests due to root permissions"
+		return
+	fi
+
+	local -x SQLITE_HISTORY="${T}/sqlite_history_${ABI}"
+
+	# e_uri.test tries to open files in /.
+	# bug #839798
+	local SANDBOX_PREDICT=${SANDBOX_PREDICT}
+	addpredict "/test.db:/ÿ.db"
+
+	emake -Onone HAVE_TCL="$(usex tcl 1 "")" $(usex debug 'fulltest' 'test')
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" HAVE_TCL="$(usex tcl 1 "")" TCLLIBDIR="${EPREFIX}/usr/$(get_libdir)/${P}" install
+
+	if use tools && multilib_is_native_abi; then
+		install_tool() {
+			if [[ -f ".libs/${1}" ]]; then
+				newbin ".libs/${1}" "${2}"
+			else
+				newbin "${1}" "${2}"
+			fi
+		}
+
+		install_tool changeset sqlite3-changeset
+		install_tool dbdump sqlite3-db-dump
+		install_tool dbhash sqlite3-db-hash
+		install_tool dbtotxt sqlite3-db-to-txt
+		install_tool index_usage sqlite3-index-usage
+		install_tool rbu sqlite3-rbu
+		install_tool scrub sqlite3-scrub
+		install_tool showdb sqlite3-show-db
+		install_tool showjournal sqlite3-show-journal
+		install_tool showshm sqlite3-show-shm
+		install_tool showstat4 sqlite3-show-stat4
+		install_tool showwal sqlite3-show-wal
+		install_tool sqldiff sqlite3-diff
+		install_tool sqlite3_analyzer sqlite3-analyzer
+		install_tool sqlite3_checker sqlite3-checker
+		install_tool sqlite3_expert sqlite3-expert
+		install_tool sqltclsh sqlite3-tclsh
+
+		unset -f install_tool
+	fi
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name "*.la" -delete || die
+
+	doman sqlite3.1
+
+	if use doc; then
+		if [[ ${PV} == 9999 ]]; then
+			pushd "${WORKDIR}/${PN}-doc-build/doc" > /dev/null || die
+		else
+			pushd "${WORKDIR}/${PN}-doc-${DOC_PV}" > /dev/null || die
+		fi
+
+		find "(" -name "*.db" -o -name "*.txt" ")" -delete || die
+		if [[ ${PV} != 9999 ]]; then
+			rm search search.d/admin || die
+			rmdir search.d || die
+			find -name "*~" -delete || die
+		fi
+
+		(
+			docinto html
+			dodoc -r *
+		)
+
+		popd > /dev/null || die
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/Manifest
index e6952505837..4b9f04e617b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/Manifest
@@ -1,5 +1,7 @@
 DIST go-darwin-amd64-bootstrap-1.18.6.tbz 145727291 BLAKE2B 3fa2efac8ff4b8527a946875af9bd5a2214bb97a7ec0cf24486b25eca964a19c47d8a5fd0c163efdeb24cd11eb3246eb3886b687a0009e96fdc9f5580c8e227c SHA512 b5b91d230ea80e852c251bc884327c398141962ea93a2e776f0d506a754e5006a47c429fc2fd019631cf5b82c1734c092af00b5260e4a41f05f00d7e59412a41
 DIST go-darwin-amd64-bootstrap-1.19.1.tbz 153199405 BLAKE2B d1da88b2d367fc8f014dea5c92ba39a8dbc0a43babc1f2ecc85405c8c4b9339bdb9058af77d986d40d54ea38665f2b02dcd64565d5616bdb22c183eb40df8329 SHA512 ab35caeb32503515b918f9313ba8dac5893fa8321a435e35eeda5624701098784b0072c2c789986a46c8fa8482fc8b2caa2b296e5bbddab5127942c24bc4e9a1
+DIST go-darwin-arm64-bootstrap-1.18.6.tbz 141953211 BLAKE2B 0a43d0eb592822cd68c3094fdf4a8062b3a3f4d7fe65ac2e6ae88a7ab0c6a31f2d7d4abc76207a38ee9c598a5c84177ed5f342eba314474222e08e7ef80394bf SHA512 47a0dadda88bdeec73d75b0039ca16d5736bd56767f7fa7231bfa0608d0a80dadf1efbdfa29ae0a1586e7e4dbd92b0b757eb1dc14a687a09f45d764675300cfb
+DIST go-darwin-arm64-bootstrap-1.19.1.tbz 148664884 BLAKE2B 46b637ff67dc2787242863e8d0edb7141ae1f4cef35b8a432d66f1de88c8f49d68491b14960cdfee4a90b8bfbdddb90fe2660ad07d8826dd55020b28c909ccae SHA512 09af12b2affc3ceb60455d331ff5e7816ab8e709a587b5e48037bfa4dc3634d5cf34175d0369ea64c8b46c468a9505c09eacde9ca0e3189468a9b794fa108599
 DIST go-linux-386-bootstrap-1.18.6.tbz 142678990 BLAKE2B 9dfd44ee127d822a91f48ecedb898583dfc7428e023b9adf78e2d44bfaef3d6126d2c87e455c3020dd71e23cef26fe683176037a07ba9e5931e8ce2979b90bcb SHA512 4d8ada5b623a9e804ac0a0fa47d0bc2551431114f8d7998d79037f9db6f6a091228e09a79c51b8ee0223970c00183a408aba2bb71aaf634ab92428022aebc35c
 DIST go-linux-386-bootstrap-1.19.1.tbz 150297103 BLAKE2B 3c3eb2ac2d7daaad42c95b061b24417fc50ff295f0d55e0051c5edd39a8e8070a76bd8bf7c39a945a9955b12c0cb75785717089cb45f37e8e6a1f0fa8c0bcabf SHA512 8017672ba9befaf466dc12cb460c9374a78fe420b3b8393e663f4db48c27d0318131c74db2fef9c9445a65c9aff931617f0bae32c55efeb00913bd7d3eaf3401
 DIST go-linux-amd64-bootstrap-1.18.6.tbz 143005294 BLAKE2B fdb4f31824b2cc37a9e96c6a77371543186636de5f4ab13468f2b9ee9bff84fdcd863b29340d48e85bb1ff15c4b03127997a08a631d959c14fe8e80fe713bebc SHA512 ffd31e523c1c3a576c67b623c99c96eec2598056a344c575d2fcf33e64fc84ed80cd54f35eb252754fa2d13ff2d25290ee5946433ce54557592e1a7d299bb4eb
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.18.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.18.6.ebuild
index 2714e2b396b..3d0eb5eb80f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.18.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.18.6.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2020-2022 Gentoo Authors
+# Copyright 2020-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -18,12 +18,13 @@ SRC_URI="
 	s390? ( ${BOOTSTRAP_DIST}/go-linux-s390x-bootstrap-${PV}.tbz )
 	x86? ( ${BOOTSTRAP_DIST}/go-linux-386-bootstrap-${PV}.tbz )
 	x64-macos? ( ${BOOTSTRAP_DIST}/go-darwin-amd64-bootstrap-${PV}.tbz )
+	arm64-macos? ( ${BOOTSTRAP_DIST}/go-darwin-arm64-bootstrap-${PV}.tbz )
 	x64-solaris? ( ${BOOTSTRAP_DIST}/go-solaris-amd64-bootstrap-${PV}.tbz )
 "
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="-* amd64 arm arm64 ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+KEYWORDS="-* amd64 arm arm64 ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="big-endian"
 RESTRICT="strip"
 QA_PREBUILT="*"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.19.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.19.1.ebuild
index fa9937e7540..200cc1937fd 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.19.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/go-bootstrap/go-bootstrap-1.19.1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2020-2022 Gentoo Authors
+# Copyright 2020-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -29,12 +29,13 @@ SRC_URI="
 	s390? ( ${BOOTSTRAP_DIST}/go-linux-s390x-bootstrap-${PV}.tbz )
 	x86? ( ${BOOTSTRAP_DIST}/go-linux-386-bootstrap-${PV}.tbz )
 	x64-macos? ( ${BOOTSTRAP_DIST}/go-darwin-amd64-bootstrap-${PV}.tbz )
+	arm64-macos? ( ${BOOTSTRAP_DIST}/go-darwin-arm64-bootstrap-${PV}.tbz )
 	x64-solaris? ( ${BOOTSTRAP_DIST}/go-solaris-amd64-bootstrap-${PV}.tbz )
 "
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~x64-macos ~x64-solaris"
+KEYWORDS="-* ~amd64 ~arm ~arm64 ~loong ~mips ~ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="abi_mips_n64 abi_mips_o32 big-endian"
 RESTRICT="strip"
 QA_PREBUILT="*"
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.4.6.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.4.6.ebuild
index f50b88fb7a7..c7fd1158877 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.4.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.4.6.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://dev.gentoo.org/~soap/distfiles/${P}.tar.xz"
 
 LICENSE="MIT"
 SLOT="5.4"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+deprecated readline"
 
 DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
index a26a0ebb9df..fe89c0bb6fb 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/Manifest
@@ -10,6 +10,8 @@ DIST Python-3.12.0rc1.tar.xz 20285264 BLAKE2B 2cbf77e9405426c58714506c14281a941b
 DIST Python-3.12.0rc1.tar.xz.asc 963 BLAKE2B 852298edf878c891e53e317d21a31a5fbd6876aa958aae715a77c0bd27a508844964ad69280d15d59428375a14a8f97c24ce9ef64ab101020bd541d5125e8676 SHA512 319ce9c5d935dcbb5ea12468c5127b4541c1b8af443aef210bdd26030fc3eee062639601fd72e70428cc18179fafb33ad2527a0c262650c4da678544fd06d0b9
 DIST Python-3.12.0rc2.tar.xz 20563748 BLAKE2B a6d474cab25fc50878539c214e5f80be59e4f5ab8a69432d4757db6add6ee9f5c04c08be01818b6bc4c6d4eb338eedb6ed350005e07b9af668c573bf10891146 SHA512 102fbce1db186e95df586eeb56e7a3c2c9dee388670aef9c9caf4eb652cad528291601186c8dee5653f064b2f606ccac37bcb81d5afe77853db768bc4291f8a4
 DIST Python-3.12.0rc2.tar.xz.asc 963 BLAKE2B 6746c9455e292c43d2984a81879145302f3cfe45f447ea586387e5d70f713a2d36fa7055b62f00dbd2ab277ce7f0cc90b66d76a6bcc12df7e56cea67413deffc SHA512 e5cd0952fe20f7b5022be3bc057eb83ae64304640f0761bbf08382be733ed7e6ed75c113b844e827903634c701641644298f26e2d6624857760eda1908382428
+DIST Python-3.12.0rc3.tar.xz 20566024 BLAKE2B b5f709eb80ceec58ced5bc7b0a4bd9649668a36e7705ab206946a878c952b15c8209af306aabf0365ff89fb6ad72be1c34848037bee41ca428f57de872d82d74 SHA512 a256147099add2da96f7dc97f965ec342317c0c021f4702ed38718e64d90a28356a266cd2786c10baab6d07bd9dc111f1c1d66ca7dc92e93674e339e990a8a83
+DIST Python-3.12.0rc3.tar.xz.asc 963 BLAKE2B 790b5c25ff5058d4d53c0c189ba82ba32b62cdfb100e658ca6171b2ade73bbfa155208a6c3053f498caf664852649d900b8a5173e48928f5c3c90d51a557877b SHA512 224d4402b96d6f5938d0eec83a3e494e25b4d883f9466c653788b86fc4ce5ab26ac8d9891f7aa20a6bd4766a5bc47fbe19afbc27db9148071b6b215bbdcc32f6
 DIST Python-3.8.18.tar.xz 20696952 BLAKE2B 45be712aeef8bb3ba04aa2bd7d0282aa5f817327749c620ede18ee307fcb432540db9062a8186b08b49467515c74f01eb6fa739f366cca76dfadedcb22858429 SHA512 0be1d85cafade25e99b8277ba51d7b9b3a3d2dbbcc52fd0d1c633c47982e5dd87fd7a0ca180a78d7801d79a8ecafa79bd9d501d544cd7b6da53ea409daa70adf
 DIST Python-3.8.18.tar.xz.asc 833 BLAKE2B bc4e989748d53c6be7040e78d9f1852227c6a76f4c63a68824f5139defd51d1ea7988df01f961ff5c77382e156ef45fead2bb97bddbb38b208ddfa9c709e4f34 SHA512 99a0fd74fe19144819fd9522836474e10c1593787eb464694bdc6224b2d4a9331e31d2ecafc35c2bbb9bf67f20186295b28f9374c1fdcd05ac13f5f400219489
 DIST Python-3.9.18.tar.xz 19673928 BLAKE2B 97da9bedaf29101e5df82199ac3ee12f1da74d5cc89de21ff1510c3f6d34d7f9194489e79855f1ab3c6f26768738e784cb7231c1a692fa746edd21d35558bc4e SHA512 aab155aca757d298394eddb91ff9a8f239665bd46feb495c6b6f735bbcb7489c05c858cc4cd08f1575c24f293b33492d763e9a140d92f0b2b0cc81a165a677c7
@@ -21,5 +23,6 @@ DIST python-gentoo-patches-3.12.0b4_p2.tar.xz 8132 BLAKE2B 4c1df7c8e1dda483724d8
 DIST python-gentoo-patches-3.12.0rc1_p5.tar.xz 348764 BLAKE2B 8f71d6172ca4e557c195f4226d548f10b888842a110824db6c73613016d5b1c900545a2a3331519cc35cd9cc740fba3970737f40cdb64bd4d48e23a2be9e8be6 SHA512 e05f6e51a0689f0b5bdc745518742aebc3ae9fe145cb82c5e43a1a048df0ea4f11711ac4850726f807a73e232f76cfdc09c62d513ad0007acea7d5d5420c8569
 DIST python-gentoo-patches-3.12.0rc1_p6.tar.xz 349384 BLAKE2B 975aae449a01a31c459b287a47bd4d1a2d8b0b39e594a1c976371acc4948765bcb4733dd9e10b70c87dfb9409d4db6b2492004841db61577576852634a40365c SHA512 f262d1a9291867e1bdc8f92c682338369b1b52f210d6db0c648c3bbabea68c6b596dfd8d13507f6d65de37d1b83beb336be3abff239d2a588054794b5bebeb81
 DIST python-gentoo-patches-3.12.0rc2_p1.tar.xz 5168 BLAKE2B 399ad4854c46e0a2bdc7c3028cc5ad1807a1d6566654a1a85bf9a8a1b205aa7b57ab1706d8ae478b93f0938a9c205374b291aaac0c3356c05d99c5955633f541 SHA512 61ac3191e0dabbc9eeef54595e4071523205def60dca9c86fdb58d72971423d6d4b37a0875562b8f1ec8627230062aea765c07b771a9ce002a1026cdaacd507e
+DIST python-gentoo-patches-3.12.0rc3.tar.xz 5168 BLAKE2B 66f132bb26c5ce36823897a6938c0f7018afd8f3c53cf738656929a944604de2764263c437c6ee4f81b617f02a33ef154d354998d14fcaef358b19b867da2937 SHA512 72fb6371871bb41ba59ddf711444fa17524fc7ac185db0ac762f6664c61cf086c73d13df10c0346094f603ed2d783bae201ee79de8d7d4cc339b74b26bd0a2f6
 DIST python-gentoo-patches-3.8.18.tar.xz 32424 BLAKE2B 2e0b6e1c8e3df666934ba283214ca1577b01140dea00513f6420b0255650002e4bc4cb142076620227cd430bc2547123fd392883285886e543ef72ca466f8ea6 SHA512 b005f1054b726fc8c82a50b006309de64fb7858fe5c22cc7b160687d059a7859ec9388706b74a0e6c1f42301bed071dc639eb8cfae0d7c5eef2f565c63cc2d29
 DIST python-gentoo-patches-3.9.18.tar.xz 25044 BLAKE2B 1d9ace5c5a0f1c15bc23595cc51d64b4c2b416552cdaaa960c3e34360aba3e7029a06e2a077212c68fa7aee4fd20f649a3b0926bd4ebb10e529e8350ab051e63 SHA512 bc180c3346dfae60a7db221d114146ee83409bc42092171eb05c83de528bf5f0e5654d1441f40ba839d0a98e866a5b43452fb7a72047c837497620a12097b8f5
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.13.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.13.ebuild
index e4e3da709ee..7c9b6e88f37 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.13.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.10.13.ebuild
@@ -132,6 +132,69 @@ src_prepare() {
 	eautoreconf
 }
 
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910 and bug #864911.
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross.
+		--without-lto
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS=disabled
+		MODULE__DBM=disabled
+		MODULE__GDBM=disabled
+		MODULE__DBM=disabled
+		MODULE__SQLITE3=disabled
+		MODULE__HASHLIB=disabled
+		MODULE__SSL=disabled
+		MODULE__CURSES=disabled
+		MODULE__CURSES_PANEL=disabled
+		MODULE_READLINE=disabled
+		MODULE__TKINTER=disabled
+		MODULE_PYEXPAT=disabled
+		MODULE_ZLIB=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the Python it was pointed to
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
 src_configure() {
 	# disable automagic bluetooth headers detection
 	if ! use bluetooth; then
@@ -243,69 +306,10 @@ src_configure() {
 	local -x OPT=
 
 	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910 and bug #864911.
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross.
-			--without-lto
-			--disable-optimizations
-		)
-
+		build_cbuild_python
 		# Point the imminent CHOST build to the Python we just
 		# built for CBUILD.
 		export PATH="${WORKDIR}/${P}-${CBUILD}:${PATH}"
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS=disabled
-			MODULE__DBM=disabled
-			MODULE__GDBM=disabled
-			MODULE__DBM=disabled
-			MODULE__SQLITE3=disabled
-			MODULE__HASHLIB=disabled
-			MODULE__SSL=disabled
-			MODULE__CURSES=disabled
-			MODULE__CURSES_PANEL=disabled
-			MODULE_READLINE=disabled
-			MODULE__TKINTER=disabled
-			MODULE_PYEXPAT=disabled
-			MODULE_ZLIB=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the Python it was pointed to
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
 	fi
 
 	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.5.ebuild
index db78c59ef0d..1740b9d9607 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.11.5.ebuild
@@ -137,6 +137,70 @@ src_prepare() {
 	eautoreconf
 }
 
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+	# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
+	# libdir correctly for cross.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" \
+		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Avoid as many dependencies as possible for the cross build.
+	cat >> Makefile <<-EOF || die
+		MODULE_NIS_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__GDBM_STATE=disabled
+		MODULE__DBM_STATE=disabled
+		MODULE__SQLITE3_STATE=disabled
+		MODULE__HASHLIB_STATE=disabled
+		MODULE__SSL_STATE=disabled
+		MODULE__CURSES_STATE=disabled
+		MODULE__CURSES_PANEL_STATE=disabled
+		MODULE_READLINE_STATE=disabled
+		MODULE__TKINTER_STATE=disabled
+		MODULE_PYEXPAT_STATE=disabled
+		MODULE_ZLIB_STATE=disabled
+	EOF
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	PYTHON_DISABLE_MODULES+=" _ctypes _crypt" emake
+	popd &> /dev/null || die
+}
+
 src_configure() {
 	local disable
 	# disable automagic bluetooth headers detection
@@ -232,72 +296,12 @@ src_configure() {
 	local -x OPT=
 
 	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross to satisfy --with-build-python.
-			--without-lto
-			--without-readline
-			--disable-optimizations
-		)
-
+		build_cbuild_python
 		myeconfargs+=(
 			# Point the imminent CHOST build to the Python we just
 			# built for CBUILD.
 			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
 		)
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-		# We disable _ctypes and _crypt for CBUILD because Python's setup.py can't handle locating
-		# libdir correctly for cross.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" \
-			ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Avoid as many dependencies as possible for the cross build.
-		cat >> Makefile <<-EOF || die
-			MODULE_NIS_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__GDBM_STATE=disabled
-			MODULE__DBM_STATE=disabled
-			MODULE__SQLITE3_STATE=disabled
-			MODULE__HASHLIB_STATE=disabled
-			MODULE__SSL_STATE=disabled
-			MODULE__CURSES_STATE=disabled
-			MODULE__CURSES_PANEL_STATE=disabled
-			MODULE_READLINE_STATE=disabled
-			MODULE__TKINTER_STATE=disabled
-			MODULE_PYEXPAT_STATE=disabled
-			MODULE_ZLIB_STATE=disabled
-		EOF
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the --with-build-python value
-		# immediately.
-		PYTHON_DISABLE_MODULES="${PYTHON_DISABLE_MODULES} _ctypes _crypt" emake
-		popd &> /dev/null || die
 	fi
 
 	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1-r1.ebuild
index 07d09f16532..1a53a9eb0e9 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1-r1.ebuild
@@ -137,6 +137,70 @@ src_prepare() {
 	eautoreconf
 }
 
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
 src_configure() {
 	local disable
 	# disable automagic bluetooth headers detection
@@ -243,72 +307,12 @@ src_configure() {
 	local -x OPT=
 
 	if tc-is-cross-compiler ; then
-		# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
-		local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
-
-		# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
-		# propagated to sysconfig for built extensions
-		#
-		# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
-		local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
-		local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
-		local -x CFLAGS= LDFLAGS=
-		local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
-		local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
-
-		# We need to build our own Python on CBUILD first, and feed it in.
-		# bug #847910
-		local myeconfargs_cbuild=(
-			"${myeconfargs[@]}"
-
-			--libdir="${cbuild_libdir:2}"
-
-			# Avoid needing to load the right libpython.so.
-			--disable-shared
-
-			# As minimal as possible for the mini CBUILD Python
-			# we build just for cross to satisfy --with-build-python.
-			--without-lto
-			--without-readline
-			--disable-optimizations
-		)
-
+		build_cbuild_python
 		myeconfargs+=(
 			# Point the imminent CHOST build to the Python we just
 			# built for CBUILD.
 			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
 		)
-
-		mkdir "${WORKDIR}"/${P}-${CBUILD} || die
-		pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
-
-		# Avoid as many dependencies as possible for the cross build.
-		mkdir Modules || die
-		cat > Modules/Setup.local <<-EOF || die
-			*disabled*
-			nis
-			_dbm _gdbm
-			_sqlite3
-			_hashlib _ssl
-			_curses _curses_panel
-			readline
-			_tkinter
-			pyexpat
-			zlib
-			# We disabled these for CBUILD because Python's setup.py can't handle locating
-			# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
-			# and uncommented if needed.
-			#_ctypes _crypt
-		EOF
-
-		ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
-
-		# Unfortunately, we do have to build this immediately, and
-		# not in src_compile, because CHOST configure for Python
-		# will check the existence of the --with-build-python value
-		# immediately.
-		emake
-		popd &> /dev/null || die
 	fi
 
 	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1.ebuild
index 417ddacff0f..d9637d52d1f 100644
--- a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc2_p1.ebuild
@@ -249,6 +249,7 @@ src_configure() {
 		local myeconfargs_cbuild=(
 			"${myeconfargs[@]}"
 
+			--prefix="${BROOT}"/usr
 			--libdir="${cbuild_libdir:2}"
 
 			# Avoid needing to load the right libpython.so.
diff --git a/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc3.ebuild b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc3.ebuild
new file mode 100644
index 00000000000..1a53a9eb0e9
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-lang/python/python-3.12.0_rc3.ebuild
@@ -0,0 +1,532 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+IUSE="
+	bluetooth build debug +ensurepip examples gdbm libedit lto
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils[extra-filters(+)]
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-util/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	sys-devel/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+	)
+
+	default
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	local disable
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# https://bugs.gentoo.org/700012
+	if is-flagq -flto || is-flagq '-flto=*'; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+	fi
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		ac_cv_header_stropts_h=no
+
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_with lto)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	# Fix collisions between different slots of Python.
+	rm "${ED}/usr/$(get_libdir)/libpython3.so" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild
index 51765e37897..4ac16d60902 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r3.ebuild
@@ -75,6 +75,9 @@ src_configure() {
 	# bug #407135
 	use test && append-flags -g
 
+	# bug 660738
+	filter-flags -fno-asynchronous-unwind-tables
+
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r4.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r4.ebuild
index 231f5e4a488..df95012d1bf 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/elfutils/elfutils-0.189-r4.ebuild
@@ -77,6 +77,9 @@ src_configure() {
 	# bug #407135
 	use test && append-flags -g
 
+	# bug 660738
+	filter-flags -fno-asynchronous-unwind-tables
+
 	multilib-minimal_src_configure
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
index ca6d5eb1558..8838499ec5d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/glib/Manifest
@@ -1,3 +1,2 @@
 DIST glib-2.76.4.tar.xz 5274356 BLAKE2B c9ceb514ea81e1e6ab2d0efc82c48c0d8ae6c997fd0e3c56d47a5174b027f785b58266fff73b1d1132e272305126fbff22e3c65d47de46224cd12fa49796d5bc SHA512 f76932dc5090a44880373228e2b162f338415d06f7c90f2950eab1a43bb191c56a1797da4d377594f6a999197fef4defb848039259cfa4105bb68288a928f5b7
-DIST glib-2.77.3.tar.xz 5316816 BLAKE2B 94d28c1526a19cb679a85f32bda159ee07862ce6aa0e2bb2e953c748d8cc790454603d3db8c748638754fef60e74a6e3584952804ff438b49fcfc009803a07b5 SHA512 d9727d67e63d7f8ce710bff497c183799b0192ac10900da87887bd76812aad9603e7f132d7eb4e8626787c427048aeafb4a28654ab808c676bcfc2b897e005d9
 DIST glib-2.78.0.tar.xz 5327096 BLAKE2B 3a494a16d12b17c7986bbe865d5e3b2727d40e7272fbb34897a90173c0fb780b0e7f024042f60ac6d1fcb9a2a4731948b6ac733c2bd6bd27c32b97281e20fc72 SHA512 3d06890002f4b13f831c83fbb70cfce529f9750e30888619e4d6277116be15d106379a03143412cf4b2a289c0cbdbbc299ecf17284fbffc06c791ecf7556c765
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.77.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.77.3.ebuild
deleted file mode 100644
index 642ad1b4015..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-libs/glib/glib-2.77.3.ebuild
+++ /dev/null
@@ -1,312 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_REQ_USE="xml(+)"
-PYTHON_COMPAT=( python3_{10..11} )
-
-inherit gnome.org gnome2-utils linux-info meson-multilib multilib python-any-r1 toolchain-funcs xdg
-
-DESCRIPTION="The GLib library of C routines"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="2"
-IUSE="dbus debug +elf gtk-doc +mime selinux static-libs sysprof systemtap test utils xattr"
-RESTRICT="!test? ( test )"
-REQUIRED_USE="gtk-doc? ( test )" # Bug #777636
-
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-# * elfutils (via libelf) does not build on Windows. gresources are not embedded
-# within ELF binaries on that platform anyway and inspecting ELF binaries from
-# other platforms is not that useful so exclude the dependency in this case.
-# * Technically static-libs is needed on zlib, util-linux and perhaps more, but
-# these are used by GIO, which glib[static-libs] consumers don't really seem
-# to need at all, thus not imposing the deps for now and once some consumers
-# are actually found to static link libgio-2.0.a, we can revisit and either add
-# them or just put the (build) deps in that rare consumer instead of recursive
-# RDEPEND here (due to lack of recursive DEPEND).
-RDEPEND="
-	!<dev-util/gdbus-codegen-${PV}
-	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/libpcre2-10.32:0=[${MULTILIB_USEDEP},unicode(+),static-libs?]
-	>=dev-libs/libffi-3.0.13-r1:=[${MULTILIB_USEDEP}]
-	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
-	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
-	kernel_linux? ( >=sys-apps/util-linux-2.23[${MULTILIB_USEDEP}] )
-	selinux? ( >=sys-libs/libselinux-2.2.2-r5[${MULTILIB_USEDEP}] )
-	xattr? ( !elibc_glibc? ( >=sys-apps/attr-2.4.47-r1[${MULTILIB_USEDEP}] ) )
-	elf? ( virtual/libelf:0= )
-	sysprof? ( >=dev-util/sysprof-capture-3.40.1:4[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}"
-# libxml2 used for optional tests that get automatically skipped
-BDEPEND="
-	app-text/docbook-xsl-stylesheets
-	dev-libs/libxslt
-	>=sys-devel/gettext-0.19.8
-	gtk-doc? ( >=dev-util/gtk-doc-1.33
-		app-text/docbook-xml-dtd:4.2
-		app-text/docbook-xml-dtd:4.5 )
-	systemtap? ( >=dev-util/systemtap-1.3 )
-	${PYTHON_DEPS}
-	test? ( >=sys-apps/dbus-1.2.14 )
-	virtual/pkgconfig
-"
-# TODO: >=dev-util/gdbus-codegen-${PV} test dep once we modify gio/tests/meson.build to use external gdbus-codegen
-
-PDEPEND="
-	dbus? ( gnome-base/dconf )
-	mime? ( x11-misc/shared-mime-info )
-"
-# shared-mime-info needed for gio/xdgmime, bug #409481
-# dconf is needed to be able to save settings, bug #498436
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/gio-querymodules$(get_exeext)
-)
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.64.1-mark-gdbus-server-auth-test-flaky.patch
-)
-
-pkg_setup() {
-	if use kernel_linux ; then
-		CONFIG_CHECK="~INOTIFY_USER"
-		if use test ; then
-			CONFIG_CHECK="~IPV6"
-			WARNING_IPV6="Your kernel needs IPV6 support for running some tests, skipping them."
-		fi
-		linux-info_pkg_setup
-	fi
-	python-any-r1_pkg_setup
-}
-
-src_prepare() {
-	if use test; then
-		# TODO: Review the test exclusions, especially now with meson
-		# Disable tests requiring dev-util/desktop-file-utils when not installed, bug #286629, upstream bug #629163
-		if ! has_version dev-util/desktop-file-utils ; then
-			ewarn "Some tests will be skipped due dev-util/desktop-file-utils not being present on your system,"
-			ewarn "think on installing it to get these tests run."
-			sed -i -e "/appinfo\/associations/d" gio/tests/appinfo.c || die
-			sed -i -e "/g_test_add_func/d" gio/tests/desktop-app-info.c || die
-		fi
-
-		# gdesktopappinfo requires existing terminal (gnome-terminal or any
-		# other), falling back to xterm if one doesn't exist
-		#if ! has_version x11-terms/xterm && ! has_version x11-terms/gnome-terminal ; then
-		#	ewarn "Some tests will be skipped due to missing terminal program"
-		# These tests seem to sometimes fail even with a terminal; skip for now and reevulate with meson
-		# Also try https://gitlab.gnome.org/GNOME/glib/issues/1601 once ready
-		# for backport (or in a bump) and file new issue if still fails
-		sed -i -e "/appinfo\/launch/d" gio/tests/appinfo.c || die
-		# desktop-app-info/launch* might fail similarly
-		sed -i -e "/desktop-app-info\/launch-as-manager/d" gio/tests/desktop-app-info.c || die
-		#fi
-
-		# https://bugzilla.gnome.org/show_bug.cgi?id=722604
-		sed -i -e "/timer\/stop/d" glib/tests/timer.c || die
-		sed -i -e "/timer\/basic/d" glib/tests/timer.c || die
-
-		ewarn "Tests for search-utils have been skipped"
-		sed -i -e "/search-utils/d" glib/tests/meson.build || die
-
-		# Play nice with network-sandbox, but this approach would defeat the purpose of the test
-		#sed -i -e "s/localhost/127.0.0.1/g" gio/tests/gsocketclient-slow.c || die
-	else
-		# Don't build tests, also prevents extra deps, bug #512022
-		sed -i -e '/subdir.*tests/d' {.,gio,glib}/meson.build || die
-	fi
-
-	# Don't build fuzzing binaries - not used
-	sed -i -e '/subdir.*fuzzing/d' meson.build || die
-
-	# gdbus-codegen is a separate package
-	sed -i -e '/install_dir/d' gio/gdbus-2.0/codegen/meson.build || die
-
-	# Same kind of meson-0.50 issue with some installed-tests files; will likely be fixed upstream soon
-	sed -i -e '/install_dir/d' gio/tests/meson.build || die
-
-	cat > "${T}/glib-test-ld-wrapper" <<-EOF
-		#!/usr/bin/env sh
-		exec \${LD:-ld} "\$@"
-	EOF
-	chmod a+x "${T}/glib-test-ld-wrapper" || die
-	sed -i -e "s|'ld'|'${T}/glib-test-ld-wrapper'|g" gio/tests/meson.build || die
-
-	# make default sane for us
-	if use prefix ; then
-		sed -i -e "s:/usr/local:${EPREFIX}/usr:" gio/xdgmime/xdgmime.c || die
-		# bug #308609, without path, bug #314057
-		export PERL=perl
-	fi
-
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		# fix standards conflicts
-		sed -i \
-			-e 's/\<\(_XOPEN_SOURCE_EXTENDED\)\>/_POSIX_PTHREAD_SEMANTICS/' \
-			-e '/\<_XOPEN_SOURCE\>/s/\<2\>/600/' \
-			meson.build || die
-		sed -i -e '/#define\s\+_POSIX_SOURCE/d' \
-			glib/giounix.c || die
-	fi
-
-	# disable native macOS integrations
-	sed -i -e '/glib_conf.set(.HAVE_\(CARBON\|COCOA\).,/s/true/false/' \
-		meson.build || die
-	sed -i \
-		-e '/AvailabilityMacros.h/d' \
-		gio/giomodule.c || die
-
-	default
-	gnome2_environment_reset
-	# TODO: python_name sedding for correct python shebang? Might be relevant mainly for glib-utils only
-}
-
-multilib_src_configure() {
-	# TODO: figure a way to pass appropriate values for all cross properties
-	# that glib uses (search for get_cross_property)
-	#if tc-is-cross-compiler ; then
-		# https://bugzilla.gnome.org/show_bug.cgi?id=756473
-		# TODO-meson: This should be in meson cross file as 'growing_stack'
-		# property; and more, look at get_cross_property
-		#case ${CHOST} in
-		#hppa*|metag*) export glib_cv_stack_grows=yes ;;
-		#*)            export glib_cv_stack_grows=no ;;
-		#esac
-	#fi
-
-	local emesonargs=(
-		--buildtype $(usex debug debug plain)
-		-Ddefault_library=$(usex static-libs both shared)
-		-Druntime_dir="${EPREFIX}"/run
-		$(meson_feature selinux)
-		$(meson_use xattr)
-		-Dlibmount=enabled # only used if host_system == 'linux'
-		-Dman=true
-		$(meson_use systemtap dtrace)
-		$(meson_use systemtap)
-		$(meson_feature sysprof)
-		$(meson_native_use_bool gtk-doc gtk_doc)
-		$(meson_use test tests)
-		-Dinstalled_tests=false
-		-Dnls=enabled
-		-Doss_fuzz=disabled
-		$(meson_native_use_feature elf libelf)
-		-Dmultiarch=false
-	)
-	meson_src_configure
-}
-
-multilib_src_test() {
-	export XDG_CONFIG_DIRS=/etc/xdg
-	export XDG_DATA_DIRS=/usr/local/share:/usr/share
-	export G_DBUS_COOKIE_SHA1_KEYRING_DIR="${T}/temp"
-	export LC_TIME=C # bug #411967
-	export TZ=UTC
-	unset GSETTINGS_BACKEND # bug #596380
-	python_setup
-
-	# https://bugs.gentoo.org/839807
-	local -x SANDBOX_PREDICT=${SANDBOX_PREDICT}
-	addpredict /usr/b
-
-	# Related test is a bit nitpicking
-	mkdir "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-	chmod 0700 "$G_DBUS_COOKIE_SHA1_KEYRING_DIR"
-
-	meson_src_test --timeout-multiplier 2 --no-suite flaky
-}
-
-multilib_src_install() {
-	meson_src_install
-	keepdir /usr/$(get_libdir)/gio/modules
-}
-
-multilib_src_install_all() {
-	# These are installed by dev-util/glib-utils
-	# TODO: With patching we might be able to get rid of the python-any deps
-	# and removals, and test depend on glib-utils instead; revisit now with
-	# meson
-	rm "${ED}/usr/bin/glib-genmarshal" || die
-	rm "${ED}/usr/share/man/man1/glib-genmarshal.1" || die
-	rm "${ED}/usr/bin/glib-mkenums" || die
-	rm "${ED}/usr/share/man/man1/glib-mkenums.1" || die
-	rm "${ED}/usr/bin/gtester-report" || die
-	rm "${ED}/usr/share/man/man1/gtester-report.1" || die
-	# gdbus-codegen manpage installed by dev-util/gdbus-codegen
-	rm "${ED}/usr/share/man/man1/gdbus-codegen.1" || die
-}
-
-pkg_preinst() {
-	xdg_pkg_preinst
-
-	# Make gschemas.compiled belong to glib alone
-	local cache="/usr/share/glib-2.0/schemas/gschemas.compiled"
-
-	if [[ -e ${EROOT}${cache} ]]; then
-		cp "${EROOT}"${cache} "${ED}"/${cache} || die
-	else
-		touch "${ED}"${cache} || die
-	fi
-
-	multilib_pkg_preinst() {
-		# Make giomodule.cache belong to glib alone
-		local cache="/usr/$(get_libdir)/gio/modules/giomodule.cache"
-
-		if [[ -e ${EROOT}${cache} ]]; then
-			cp "${EROOT}"${cache} "${ED}"${cache} || die
-		else
-			touch "${ED}"${cache} || die
-		fi
-	}
-
-	# Don't run the cache ownership when cross-compiling, as it would end up with an empty cache
-	# file due to inability to create it and GIO might not look at any of the modules there
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_preinst
-	fi
-}
-
-pkg_postinst() {
-	xdg_pkg_postinst
-	# glib installs no schemas itself, but we force update for fresh install in case
-	# something has dropped in a schemas file without direct glib dep; and for upgrades
-	# in case the compiled schema format could have changed
-	gnome2_schemas_update
-
-	multilib_pkg_postinst() {
-		gnome2_giomodule_cache_update \
-			|| die "Update GIO modules cache failed (for ${ABI})"
-	}
-	if ! tc-is-cross-compiler ; then
-		multilib_foreach_abi multilib_pkg_postinst
-	else
-		ewarn "Updating of GIO modules cache skipped due to cross-compilation."
-		ewarn "You might want to run gio-querymodules manually on the target for"
-		ewarn "your final image for performance reasons and re-run it when packages"
-		ewarn "installing GIO modules get upgraded or added to the image."
-	fi
-
-	for v in ${REPLACING_VERSIONS}; do
-		if ver_test "$v" "-lt" "2.63.6"; then
-			ewarn "glib no longer installs the gio-launch-desktop binary. You may need"
-			ewarn "to restart your session for \"Open With\" dialogs to work."
-		fi
-	done
-}
-
-pkg_postrm() {
-	xdg_pkg_postrm
-	gnome2_schemas_update
-
-	if [[ -z ${REPLACED_BY_VERSION} ]]; then
-		multilib_pkg_postrm() {
-			rm -f "${EROOT}"/usr/$(get_libdir)/gio/modules/giomodule.cache
-		}
-		multilib_foreach_abi multilib_pkg_postrm
-		rm -f "${EROOT}"/usr/share/glib-2.0/schemas/gschemas.compiled
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
index 288f625d457..dc9a1c12977 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.2.1-r5.ebuild
@@ -8,7 +8,6 @@ inherit gnuconfig libtool flag-o-matic multilib-minimal toolchain-funcs
 MY_PV=${PV/_p*}
 MY_PV=${MY_PV/_/-}
 
-MANUAL_PV=${MY_PV}
 MANUAL_PV=6.2.1
 
 MY_P=${PN}-${MY_PV}
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild
index 0ec36d5b779..2cb6293940a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gmp/gmp-6.3.0.ebuild
@@ -8,7 +8,6 @@ inherit gnuconfig libtool flag-o-matic multilib-minimal toolchain-funcs
 MY_PV=${PV/_p*}
 MY_PV=${MY_PV/_/-}
 
-MANUAL_PV=${MY_PV}
 MANUAL_PV=6.2.1
 
 MY_P=${PN}-${MY_PV}
@@ -26,7 +25,7 @@ S="${WORKDIR}"/${MY_P%a}
 LICENSE="|| ( LGPL-3+ GPL-2+ )"
 # The subslot reflects the C & C++ SONAMEs.
 SLOT="0/10.4"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +cpudetection +cxx pic static-libs"
 REQUIRED_USE="cpudetection? ( asm )"
 RESTRICT="!cpudetection? ( bindist )"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
index aeb50dcc606..dcf0501a11b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/Manifest
@@ -1,2 +1,2 @@
 DIST gobject-introspection-1.76.1.tar.xz 1055416 BLAKE2B 2251c34b543c95f95bdec6853c8234db1b2e6271e729eaa5abf28e39c7718b326e0813a1214c62fb4634fd11218c4c856e6651de09081b01c9fcf8f73b8cf316 SHA512 84331a30f8854d2259609650c21aadd6363ea1417a75828bd395f8f4346da1c6d6550cff5f2c9f5f6fd6fbf2a9d27b5880c2ee1616fa905c5f362384d481a916
-DIST gobject-introspection-1.78.0.tar.xz 1060136 BLAKE2B ae95ad5cec48f0eb001e1ba65cd6e88ab8846d1ab6721ac421f6077f1a69fca1989a0631a7c852361d4b92f7f25503e3f505e734055d3f61530f829924f37972 SHA512 b7749295437255d45f5f842195315105d7b85bddb20bf205c7bd7f0c9e9e77fe1db2c84af6d784b54fb0d8eef488895f5eb9439ccf4ca81d03e802802b13e5dd
+DIST gobject-introspection-1.78.1.tar.xz 1060296 BLAKE2B 115cf9ea27cec2d8d3a84081c909b72144fd1568bc316677c26f49652dc93b34fba10701678ad4977dcf97a89f7608545fbd2d73c2503c87635b2102e66ae024 SHA512 a3081882995a762645b04faa71082dbd523bee845519007e48b13235aad8a4cd4c74f0d042a6c17710125f945bd970e4b76e95a559274e294d595e04725a4e97
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.78.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.78.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.78.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection-common/gobject-introspection-common-1.78.1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
index aeb50dcc606..dcf0501a11b 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/Manifest
@@ -1,2 +1,2 @@
 DIST gobject-introspection-1.76.1.tar.xz 1055416 BLAKE2B 2251c34b543c95f95bdec6853c8234db1b2e6271e729eaa5abf28e39c7718b326e0813a1214c62fb4634fd11218c4c856e6651de09081b01c9fcf8f73b8cf316 SHA512 84331a30f8854d2259609650c21aadd6363ea1417a75828bd395f8f4346da1c6d6550cff5f2c9f5f6fd6fbf2a9d27b5880c2ee1616fa905c5f362384d481a916
-DIST gobject-introspection-1.78.0.tar.xz 1060136 BLAKE2B ae95ad5cec48f0eb001e1ba65cd6e88ab8846d1ab6721ac421f6077f1a69fca1989a0631a7c852361d4b92f7f25503e3f505e734055d3f61530f829924f37972 SHA512 b7749295437255d45f5f842195315105d7b85bddb20bf205c7bd7f0c9e9e77fe1db2c84af6d784b54fb0d8eef488895f5eb9439ccf4ca81d03e802802b13e5dd
+DIST gobject-introspection-1.78.1.tar.xz 1060296 BLAKE2B 115cf9ea27cec2d8d3a84081c909b72144fd1568bc316677c26f49652dc93b34fba10701678ad4977dcf97a89f7608545fbd2d73c2503c87635b2102e66ae024 SHA512 a3081882995a762645b04faa71082dbd523bee845519007e48b13235aad8a4cd4c74f0d042a6c17710125f945bd970e4b76e95a559274e294d595e04725a4e97
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.78.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.78.1.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.78.0.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-libs/gobject-introspection/gobject-introspection-1.78.1.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
index c9e12df8e4b..bff20d62316 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libgcrypt/libgcrypt-1.10.2.ebuild
@@ -13,7 +13,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="LGPL-2.1 MIT"
 SLOT="0/20" # subslot = soname major version
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1 doc +getentropy static-libs"
 
 # Build system only has --disable-arm-crypto-support right now
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4-r1.ebuild
index d3944853b9a..0100109ae88 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libksba/libksba-1.6.4-r1.ebuild
@@ -20,7 +20,7 @@ SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
 
 LICENSE="LGPL-3+ GPL-2+ GPL-3"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="static-libs"
 
 RDEPEND=">=dev-libs/libgpg-error-1.33"
diff --git a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild
index 034bb69550d..2064f9bd662 100644
--- a/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-libs/libpcre/libpcre-8.45-r2.ebuild
@@ -23,7 +23,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="3"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="bzip2 +cxx +jit libedit pcre16 pcre32 +readline static-libs unicode valgrind zlib"
 REQUIRED_USE="
 	readline? ( !libedit )
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
index f3eea181f4a..5f584cde4e1 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.0-r1.ebuild
@@ -26,7 +26,7 @@ S=${WORKDIR}/${MY_P}
 
 LICENSE="Apache-2.0"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.2-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.2-r1.ebuild
new file mode 100644
index 00000000000..444c115bf84
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/cython-3.0.2-r1.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_TESTED=( python3_{10..11} )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" python3_12 pypy3 )
+PYTHON_REQ_USE="threads(+)"
+
+inherit distutils-r1 multiprocessing toolchain-funcs
+
+MY_P=${P/_rc/rc}
+DESCRIPTION="A Python to C compiler"
+HOMEPAGE="
+	https://cython.org/
+	https://github.com/cython/cython/
+	https://pypi.org/project/Cython/
+"
+SRC_URI="
+	https://github.com/cython/cython/archive/${PV/_rc/rc}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/numpy[${PYTHON_USEDEP}]
+		' python3_{10..11})
+	)
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-0.29.22-spawn-multiprocessing.patch"
+	"${FILESDIR}/${PN}-0.29.23-test_exceptions-py310.patch"
+	"${FILESDIR}/${PN}-0.29.23-pythran-parallel-install.patch"
+	# https://github.com/cython/cython/pull/5675
+	"${FILESDIR}/${P}-enummeta.patch"
+)
+
+distutils_enable_sphinx docs \
+	dev-python/jinja \
+	dev-python/sphinx-issues \
+	dev-python/sphinx-tabs
+
+python_compile() {
+	# Python gets confused when it is in sys.path before build.
+	local -x PYTHONPATH=
+
+	distutils-r1_python_compile
+}
+
+python_test() {
+	if ! has "${EPYTHON/./_}" "${PYTHON_TESTED[@]}"; then
+		einfo "Skipping tests on ${EPYTHON} (xfail)"
+		return
+	fi
+
+	# Needed to avoid confusing cache tests
+	unset CYTHON_FORCE_REGEN
+
+	tc-export CC
+	# https://github.com/cython/cython/issues/1911
+	local -x CFLAGS="${CFLAGS} -fno-strict-overflow"
+	"${PYTHON}" runtests.py \
+		-vv \
+		-j "$(makeopts_jobs)" \
+		--work-dir "${BUILD_DIR}"/tests \
+		--no-examples \
+		--no-code-style \
+		|| die "Tests fail with ${EPYTHON}"
+}
+
+python_install_all() {
+	local DOCS=( CHANGES.rst README.rst ToDo.txt USAGE.txt )
+	distutils-r1_python_install_all
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.2-enummeta.patch b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.2-enummeta.patch
new file mode 100644
index 00000000000..284af4ac6c1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/cython/files/cython-3.0.2-enummeta.patch
@@ -0,0 +1,69 @@
+From 81cc077ad035947a3429c245f1e28c8b43c6dcc6 Mon Sep 17 00:00:00 2001
+From: da-woods <dw-git@d-woods.co.uk>
+Date: Sat, 2 Sep 2023 10:32:59 +0100
+Subject: [PATCH] Fix invalid fastcall dict when keywords are passed
+
+Fixes #5665
+
+I'm slightly surprised this hasn't caused more bugs. We're passing
+a dict where we should be passing a tuple of names.
+
+Replacement should hopefully be right, but I don't know how
+optimized or otherwise it is.
+---
+ Cython/Utility/ObjectHandling.c | 36 +++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/Cython/Utility/ObjectHandling.c b/Cython/Utility/ObjectHandling.c
+index 8ea5be42935..507fb94f605 100644
+--- a/Cython/Utility/ObjectHandling.c
++++ b/Cython/Utility/ObjectHandling.c
+@@ -2328,27 +2328,33 @@ static CYTHON_INLINE PyObject* __Pyx_PyObject_FastCallDict(PyObject *func, PyObj
+     #endif
+     #endif
+ 
+-    #if CYTHON_VECTORCALL
+-    #if Py_VERSION_HEX < 0x03090000
+-    vectorcallfunc f = _PyVectorcall_Function(func);
+-    #else
+-    vectorcallfunc f = PyVectorcall_Function(func);
+-    #endif
+-    if (f) {
+-        return f(func, args, (size_t)nargs, kwargs);
+-    }
+-    #elif defined(__Pyx_CyFunction_USED) && CYTHON_BACKPORT_VECTORCALL
+-    // exclude fused functions for now
+-    if (__Pyx_CyFunction_CheckExact(func)) {
+-        __pyx_vectorcallfunc f = __Pyx_CyFunction_func_vectorcall(func);
+-        if (f) return f(func, args, (size_t)nargs, kwargs);
++    if (kwargs == NULL) {
++        #if CYTHON_VECTORCALL
++        #if Py_VERSION_HEX < 0x03090000
++        vectorcallfunc f = _PyVectorcall_Function(func);
++        #else
++        vectorcallfunc f = PyVectorcall_Function(func);
++        #endif
++        if (f) {
++            return f(func, args, (size_t)nargs, NULL);
++        }
++        #elif defined(__Pyx_CyFunction_USED) && CYTHON_BACKPORT_VECTORCALL
++        // exclude fused functions for now
++        if (__Pyx_CyFunction_CheckExact(func)) {
++            __pyx_vectorcallfunc f = __Pyx_CyFunction_func_vectorcall(func);
++            if (f) return f(func, args, (size_t)nargs, NULL);
++        }
++        #endif
+     }
+-    #endif
+ 
+     if (nargs == 0) {
+         return __Pyx_PyObject_Call(func, $empty_tuple, kwargs);
+     }
++    #if PY_VERSION_HEX >= 0x03090000 && !CYTHON_COMPILING_IN_LIMITED_API
++    return PyObject_VectorcallDict(func, args, nargs, kwargs);
++    #else
+     return __Pyx_PyObject_FastCall_fallback(func, args, (size_t)nargs, kwargs);
++    #endif
+ }
+ 
+ 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
index fe2726585f7..f00f6de966c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/Manifest
@@ -1 +1,2 @@
 DIST fasteners-0.18.gh.tar.gz 42343 BLAKE2B 702ca6a68733ed202ae0f8a2d9d430012c5786ef8d779903186815f9250ed7b2ccf781694aa57ef230009a470ef7c6bd0e83cc7bc9fcb809d2335542e799e3d6 SHA512 40928e93fa94ca9e67335d15acede73b70906885f8cc34262b00e2dfba9dfed8647f11490ab0df4c8fcfd94778362cfdc4bd0053063660b962202524dd5bda18
+DIST fasteners-0.19.gh.tar.gz 43188 BLAKE2B c30f4dc3da6605aa2552f58ae1071b51efefe2aea59ca8815fd50eebdbe7e826756cd9923485d6fb99dcc39196def485f4c1346a234bc7af09e2426c84b6a0d3 SHA512 47db216ff5bad5c669ca2d9be0ee09feba4a3d55ed0eac8d3623bd3d112b0b87fb9019f8785d035ec32ad9fa9e4ae7d1c92a576c97eec29acc82711d7e71a465
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.19.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.19.ebuild
new file mode 100644
index 00000000000..d3b2343df0d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/fasteners/fasteners-0.19.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..11} )
+
+inherit distutils-r1
+
+DESCRIPTION="Python package that provides useful locks"
+HOMEPAGE="
+	https://github.com/harlowja/fasteners/
+	https://pypi.org/project/fasteners/
+"
+SRC_URI="
+	https://github.com/harlowja/fasteners/archive/${PV}.tar.gz
+		-> ${P}.gh.tar.gz
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="
+	test? (
+		dev-python/diskcache[${PYTHON_USEDEP}]
+		dev-python/more-itertools[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+EPYTEST_IGNORE=(
+	tests/test_eventlet.py
+)
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild
index 6688823b28d..4fdc0a908a8 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/lxml/lxml-4.9.3-r1.ebuild
@@ -24,7 +24,7 @@ S=${WORKDIR}/lxml-${P}
 
 LICENSE="BSD ElementTree GPL-2 PSF-2"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc examples +threads test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
index 1098d86add2..f28feba89e0 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/Manifest
@@ -1 +1,4 @@
+DIST setuptools-scm-8.0.1.tar.gz 71827 BLAKE2B 4011879490a02f5bb8b4fa0292ee696010cca9cb5c322854f2c342b4c02a86f7a31535c3fe7b4e6eab4fb77c90a469714227c1487ee7e1c1d4de3a4db1137b6b SHA512 05c087cbcb8bf2f03d68cf91e5545c25dea85d61d16c26194ade42a5e78a573f1adc4265897998d4b151834e994b3aa32e02a1eb2fa103a4cd1f3c8e3b78d8d4
+DIST setuptools-scm-8.0.2.tar.gz 72614 BLAKE2B 80dedf269f504a632f6b8c8ceafc28948e359825b926ac851219171db4015856aaebde8c0e8ee81dc807bb1b25010d686a039063922046dc4d72beacf14914c6 SHA512 1a636f452cbe61fc1bc6fca49032e7d12b80fe5d8931f292cfa295d6787fb9273fd7f3887f3f74d60c1da19f4e2f676d038fd860c0410838225cad95e6375f9b
+DIST setuptools-scm-8.0.3.tar.gz 72824 BLAKE2B f45b3bf67cc259e18fbd3a155d10967cf7c6a9df69d6bff7cc452236da3c3e1d0205ff7f5523c5bfdcbdbf5056e00f06c21dc1178edf14b386a0b89e95c947c1 SHA512 7002da1abdabbf617fb92b94aa04f6fe90aa5cbe26ae7ff8a9df0c53b35e8d13e6294ed38373d081ccafe375b376d52e72d5c7a031dbfb356aa0ee3221641096
 DIST setuptools_scm-7.1.0.tar.gz 71904 BLAKE2B be5ae215dadcc290290762b732434258409ecc2d71cdf1332ffe73431effae7cbc33e052a718efd952be79350171ed3e468492fc719bc08750dc23364fb0ee9d SHA512 bd7260672c213db6b8c5842dbb6ac69e69ce040777865c935033971f65d905bd8e6b54e174190a924e452c302e69d4c1de231cbc8f603176ba013a739840dad3
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.1.ebuild
new file mode 100644
index 00000000000..cb671ce3fa1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.1.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYPI_NO_NORMALIZE=1
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools_scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		dev-python/tomli[${PYTHON_USEDEP}]
+	' 3.10)
+	dev-python/typing-extensions[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-vcs/git
+		!sparc? (
+			dev-vcs/mercurial
+		)
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.2.ebuild
new file mode 100644
index 00000000000..cb671ce3fa1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.2.ebuild
@@ -0,0 +1,61 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYPI_NO_NORMALIZE=1
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools_scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		dev-python/tomli[${PYTHON_USEDEP}]
+	' 3.10)
+	dev-python/typing-extensions[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-vcs/git
+		!sparc? (
+			dev-vcs/mercurial
+		)
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.3.ebuild
new file mode 100644
index 00000000000..bd4c320ce6c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools-scm/setuptools-scm-8.0.3.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+DISTUTILS_USE_PEP517=standalone
+PYPI_NO_NORMALIZE=1
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="Manage versions by scm tags via setuptools"
+HOMEPAGE="
+	https://github.com/pypa/setuptools_scm/
+	https://pypi.org/project/setuptools-scm/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+# there's an optional dep on rich for cute logs
+RDEPEND="
+	dev-python/packaging[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	$(python_gen_cond_dep '
+		dev-python/tomli[${PYTHON_USEDEP}]
+	' 3.10)
+	dev-python/typing-extensions[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-vcs/git
+		!sparc? (
+			dev-vcs/mercurial
+		)
+	)
+"
+
+distutils_enable_tests pytest
+
+python_test() {
+	local EPYTEST_DESELECT=(
+		# the usual nondescript gpg-agent failure
+		testing/test_git.py::test_git_getdate_signed_commit
+
+		# fetching from the Internet
+		testing/test_regressions.py::test_pip_download
+
+		# calls flake8, unpredictable
+		testing/test_functions.py::test_dump_version_flake8
+	)
+
+	if has_version dev-python/nose; then
+		EPYTEST_DESELECT+=(
+			# https://bugs.gentoo.org/892639
+			testing/test_integration.py::test_pyproject_support
+		)
+	fi
+
+	epytest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
index 4973727e161..32105a8e64a 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/Manifest
@@ -1,2 +1,3 @@
-DIST setuptools-68.0.0.tar.gz 2194111 BLAKE2B 614a1c69f640ce8d0e510c444e058fecd3810421983a03cd345e43e1148799bed7e5d53ac689a4fe3ce3174d16f2bb719236bd5442b5f06ffc7659d0f4c7d15f SHA512 da6d535a0db6eaf477c8c2148efbc2100fd88a14f3adad44d20e22bf52bee3f00fe86547ea650fe653519bd6ff5f9ef033a55bb3a05fed041e88e78cdfb81d7e
 DIST setuptools-68.1.2.tar.gz 2198001 BLAKE2B bd21de32246eb7bd17289536a65e87636c39d8d7712dffa61b07b052fa7e9020fc06fe2de294a4e4782738c4385ff31e6552a6d3f403c3b1da98ea07405d57e8 SHA512 a5a84102ce72f38162b190b91286013cb8660b45f383df04fba65e38c658a5c5b93cdf05f789436618fa596b3ca6688a7c54d31d6d10b729124d3b135660c328
+DIST setuptools-68.2.1.tar.gz 2203059 BLAKE2B 2db15077041c908e476f115fb1d54abdc6ddef6c1f7b23f2149a0c61c23aa584ada51d73cf5d1ed7e3670cd18077fa1d0001b654e45d9c5882f993e2bf56ffb1 SHA512 f7083c3a38f3f9dc1ea3b87d398db7d483d5692e20f395aead40a310cd329c76243450b7d95b4a797ab1c6d2919cba4ac76fa73d2cb454d3c3b9f3209401611b
+DIST setuptools-68.2.2.tar.gz 2203338 BLAKE2B 3d91bd4b4be1fb7a01b0cca1736187b80f9b07d0e647b49b483d6b8da55f69a678d2c910cde46bd9645dbd10b0b1d14c124d111817cbd7be8d5fab909f787998 SHA512 ed3138a39e8ae47d695e71835024d66d63b8de51aa336bd8524de81a5036aa26cf587caca5d6b46c833f77a6e9c8c1ae6b64e8310f712bd9c4e760196778b2ca
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.1.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.1.2.ebuild
index dff9ddb41ca..b74eeed6633 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.1.2.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.1.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.1.ebuild
index 3f796e7f558..dff9ddb41ca 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.0.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.1.ebuild
@@ -21,7 +21,7 @@ HOMEPAGE="
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~arm64-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
 IUSE="test"
 RESTRICT="!test? ( test )"
 
@@ -63,8 +63,6 @@ PDEPEND="
 	dev-python/setuptools-scm[${PYTHON_USEDEP}]
 "
 
-DOCS=( {CHANGES,README}.rst )
-
 src_prepare() {
 	local PATCHES=(
 		# TODO: remove this when we're 100% PEP517 mode
@@ -112,6 +110,8 @@ python_test() {
 		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
 		# fails with importlib-metadata-6.6.0
 		setuptools/tests/test_egg_info.py::TestWriteEntries::test_invalid_entry_point
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
 	)
 
 	if has_version "<dev-python/packaging-22"; then
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.2.ebuild
new file mode 100644
index 00000000000..dff9ddb41ca
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/setuptools/setuptools-68.2.2.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# please keep this ebuild at EAPI 8 -- sys-apps/portage dep
+EAPI=8
+
+# please bump dev-python/ensurepip-setuptools along with this package!
+
+DISTUTILS_USE_PEP517=standalone
+PYTHON_TESTED=( python3_{10..12} pypy3 )
+PYTHON_COMPAT=( "${PYTHON_TESTED[@]}" )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 multiprocessing pypi
+
+DESCRIPTION="Collection of extensions to Distutils"
+HOMEPAGE="
+	https://github.com/pypa/setuptools/
+	https://pypi.org/project/setuptools/
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-python/jaraco-text-3.7.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/more-itertools-8.12.0-r1[${PYTHON_USEDEP}]
+	>=dev-python/nspektr-0.3.0[${PYTHON_USEDEP}]
+	>=dev-python/ordered-set-4.0.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/packaging-21.3-r2[${PYTHON_USEDEP}]
+	>=dev-python/platformdirs-2.6.2-r1[${PYTHON_USEDEP}]
+	>=dev-python/tomli-2.0.1[${PYTHON_USEDEP}]
+	>=dev-python/wheel-0.37.1-r1[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	${RDEPEND}
+	test? (
+		$(python_gen_cond_dep '
+			dev-python/build[${PYTHON_USEDEP}]
+			>=dev-python/ini2toml-0.9[${PYTHON_USEDEP}]
+			>=dev-python/filelock-3.4.0[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-envs-2.2[${PYTHON_USEDEP}]
+			>=dev-python/jaraco-path-3.2.0[${PYTHON_USEDEP}]
+			dev-python/pip[${PYTHON_USEDEP}]
+			dev-python/pip-run[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-fixture-config[${PYTHON_USEDEP}]
+			dev-python/pytest-timeout[${PYTHON_USEDEP}]
+			dev-python/pytest-virtualenv[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+			>=dev-python/tomli-w-1.0.0[${PYTHON_USEDEP}]
+			>=dev-python/virtualenv-20[${PYTHON_USEDEP}]
+		' "${PYTHON_TESTED[@]}")
+	)
+"
+# setuptools-scm is here because installing plugins apparently breaks stuff at
+# runtime, so let's pull it early. See bug #663324.
+PDEPEND="
+	>=dev-python/certifi-2016.9.26[${PYTHON_USEDEP}]
+	dev-python/setuptools-scm[${PYTHON_USEDEP}]
+"
+
+src_prepare() {
+	local PATCHES=(
+		# TODO: remove this when we're 100% PEP517 mode
+		"${FILESDIR}"/setuptools-62.4.0-py-compile.patch
+	)
+
+	distutils-r1_src_prepare
+
+	# remove bundled dependencies
+	rm -r */_vendor || die
+
+	# remove the ugly */extern hack that breaks on unvendored deps
+	rm -r */extern || die
+	find -name '*.py' -exec sed \
+		-e 's:from \w*[.]\+extern ::' -e 's:\w*[.]\+extern[.]::' \
+		-i {} + || die
+}
+
+python_test() {
+	if ! has "${EPYTHON}" "${PYTHON_TESTED[@]/_/.}"; then
+		return
+	fi
+
+	local EPYTEST_DESELECT=(
+		# network
+		# TODO: see if PRE_BUILT_SETUPTOOLS_* helps
+		setuptools/tests/config/test_apply_pyprojecttoml.py::test_apply_pyproject_equivalent_to_setupcfg
+		setuptools/tests/integration/test_pip_install_sdist.py::test_install_sdist
+		setuptools/tests/test_build_meta.py::test_legacy_editable_install
+		setuptools/tests/test_distutils_adoption.py
+		setuptools/tests/test_editable_install.py
+		setuptools/tests/test_setuptools.py::test_its_own_wheel_does_not_contain_tests
+		setuptools/tests/test_virtualenv.py::test_clean_env_install
+		setuptools/tests/test_virtualenv.py::test_no_missing_dependencies
+		setuptools/tests/test_virtualenv.py::test_test_command_install_requirements
+		# TODO
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_basic
+		setuptools/tests/config/test_setupcfg.py::TestConfigurationReader::test_ignore_errors
+		setuptools/tests/test_extern.py::test_distribution_picklable
+		# expects bundled deps in virtualenv
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_in_sdist
+		setuptools/tests/config/test_apply_pyprojecttoml.py::TestMeta::test_example_file_not_in_wheel
+		setuptools/tests/test_editable_install.py::test_editable_with_pyproject
+		# fails if python-xlib is installed
+		setuptools/tests/test_easy_install.py::TestSetupRequires::test_setup_requires_with_allow_hosts
+		# fails with importlib-metadata-6.6.0
+		setuptools/tests/test_egg_info.py::TestWriteEntries::test_invalid_entry_point
+		# TODO, probably some random package
+		setuptools/tests/config/test_setupcfg.py::TestOptions::test_cmdclass
+	)
+
+	if has_version "<dev-python/packaging-22"; then
+		EPYTEST_DESELECT+=(
+			# old packaging is more lenient
+			setuptools/tests/config/test_setupcfg.py::TestOptions::test_raises_accidental_env_marker_misconfig
+		)
+	fi
+
+	epytest -n "$(makeopts_jobs)" setuptools
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
index f3af271c07f..1e3a04957ab 100644
--- a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/Manifest
@@ -1 +1,2 @@
 DIST typing_extensions-4.7.1.gh.tar.gz 84841 BLAKE2B 9b49b37c90b90775995d9d77b6b480eeab51b71a9af9474c0f43db021106ff02d0e4e882be04c114477ff2b386037c286e9de2d9cd2394bd4e1459ce7c6e1951 SHA512 948f6c5c9597f6cf7d77987d1a5dad9f15b4303f9d156de3d97abda0c55567b2649eb6df7ac36a07f9d6306103d81fd00a38b04b3b5c521ff2f8f153f9219fb1
+DIST typing_extensions-4.8.0.gh.tar.gz 83807 BLAKE2B 4b160b79117dfeb83e911ff8c2b91a97512a70c1c5a2a87d6d2bcab7f5604efdb192c3c4eb5cfd7c102744c786e014dafc6346e5c544ec4f995d5810c83f8e73 SHA512 1e82f49d837c3fbead7d0867db667f97be2836f1f98bcde7315eb8c5455e605659fe7759ccf86fcbb2373789d9dab500a3b2a75bbcaf9216521c6b8c2796090a
diff --git a/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.8.0.ebuild b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.8.0.ebuild
new file mode 100644
index 00000000000..df5b00b2ff7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-python/typing-extensions/typing-extensions-4.8.0.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=flit
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+
+inherit distutils-r1
+
+MY_P=${P/-/_}
+DESCRIPTION="Backported and Experimental Type Hints for Python 3.7+"
+HOMEPAGE="
+	https://pypi.org/project/typing-extensions/
+	https://github.com/python/typing_extensions/
+"
+SRC_URI="
+	https://github.com/python/typing_extensions/archive/${PV}.tar.gz
+		-> ${MY_P}.gh.tar.gz
+"
+S=${WORKDIR}/${MY_P}
+
+LICENSE="PSF-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+
+distutils_enable_tests unittest
+
+python_test() {
+	cd src || die
+	eunittest
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
index a69ce34cf8a..ebc6347dfa2 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/Manifest
@@ -5,19 +5,7 @@ DIST cmake-3.26.4.tar.gz 10669686 BLAKE2B 34508c724e0d4967e010917f6fac6f426b0d83
 DIST cmake-3.26.5-SHA-256.txt 1646 BLAKE2B 242688153008e99bab046fc6e32d20990cd5f654bed67a6d5de0c41b140a6b53adaa797de71ce4dce2cfb120e3472726ab79b871e7926600689e0ae11016ba2d SHA512 f333cdbb2a77ba4c697df3dc270c73e5847b1361d70f5900602226997362a22563b6e1c2eecce35a5cb4ee04a157795c78e4ed426d407aa63b5e04b2be7d1ece
 DIST cmake-3.26.5-SHA-256.txt.asc 833 BLAKE2B 4014785626e30f4ee2bb9bfeb1bb5398040c96b2303e657ee938fcfc6302f54515b4b2a4c2bcb1cb212a1c849b128e0f18e4f34c0ba7b99a5d25c606a631819a SHA512 fef08f30627641ac4ea0aabaec099ad0cae0c0b957419328f37b1ba88f9103069213d2bcf6f733941a254fd4913981e3c5367bf422b9873e59001644b4e760a5
 DIST cmake-3.26.5.tar.gz 10669227 BLAKE2B 23d9df4becaf26da6698f1601ed080a63124c1ab4df7b087423feeab4fd0e7596803eb807b52eb87bd50c894ec3ecef9c046349c1d2d14f7384a38fe9f61830d SHA512 43c17e00d6f326b96ea47c62bbffd19409281641b297b2362e4ed6a696e7e618d2ff265a213634bfa4c1200c3f581531fde6507f282a9460ab65af6c7bab61de
-DIST cmake-3.27.0-SHA-256.txt 1646 BLAKE2B 262ec1c374029603877015351bd3b25f60a9b311f98b4f9a85df573bfd468a06dce2161354c07affe17221633efcc2677d1c93f303c05b93a6e8548bdd8b9f72 SHA512 d91813fe3df1a5a3d06991c6abe3afa8dc5a9236b93e427b05c077a138e53a42e367cfacb76da562e6c6db01411bfea4ecb416363a3f724c10616cbcfb0a2ad4
-DIST cmake-3.27.0-SHA-256.txt.asc 833 BLAKE2B a86db55c45440770ae200e7e9e0b01329df8758588de15a8c3ed96f82f6493e3e3a059b81fe42e7fcae36ae52da7b4c8ee3b90359b6e35103596bfbe098b6af6 SHA512 441aa1a17973913005992079b3de54dea42239830ec52741de089ef978e084d1e233c375fccab1cee08d4d18bbd6197417771de6aec8335752a2ca5efebbf181
 DIST cmake-3.27.0-docs.tar.xz 521348 BLAKE2B 319c84195c37b1944bb5d3fde1aeae75623fc90a734c1ba74d730cd5678bff75806f7aa8aa8171fd7878a09b3316c9c0ee23c0c055e869a4385f54987f86d801 SHA512 e9c300526f9fe4e450e921308b7af42f4b8972f2f546f7bbf2dffb4ca696793fe09f1610636b05c82b1cf74ed8ef95377bec69e15f8c9197d6960e674e0d5400
-DIST cmake-3.27.0.tar.gz 10977223 BLAKE2B a031002dc662552c7af2da35494b536c359011c035216286d22dd78d3b6f607d1a552b5296f14117956f20dd61b94036004912f2e834957e0aacb8bb5037ed75 SHA512 8b5836ac1c1f1e741ebbf6c9a1c9dca322dfd963598838a8789cd926fc071bde2fc53e42b6a2d5d8697f12d96dbf2cebdf03817d7d84b68256ef80b779a27fed
-DIST cmake-3.27.1-SHA-256.txt 1646 BLAKE2B 3437dc50b66a014569e9194c609cdcb6022175f6220685d24f5276af4348ffd93db8a18108e54d00d62e54889181cccc09e722fccdd10475515f91b55859d12d SHA512 b0a48431e333dd0cc2670b630340e39015617f9d49a3c43c6181d8e669f33abc00d4c08fab8d59aecadbbbba031136136897a1f1a4cf5dec849ca868592c7e9f
-DIST cmake-3.27.1-SHA-256.txt.asc 833 BLAKE2B 17dbb29edcf09501455dffe090f3973083e38134559131572a55b065eae5494541b56589f78d55467cfa1ef1d3e8cba180a7dc3c949531193fc9ef3102feaad5 SHA512 bbe31efe4ffbae5d82483a677dab86586477b0af0e79dd6bfe85ae266b09a1881bf31249d91023f41fdcab066e558e52a1e7eb12dfbbea44f297d3d8eeaaea48
-DIST cmake-3.27.1.tar.gz 10977868 BLAKE2B dcb998e45d238ba94ff9422a30014b274d1db48f094c7e027717b7b271bb0c63e4f11cae29552683e747f9872ccddbaaefa4d90a0113dc409d556ad0743835f6 SHA512 d8831105fed3772bcb821a2b184fe0ffbff15795a5b0a89f2ad1cb0372a40c8f22f2bab72c671a6d17464521b7337067df929a5c3ece99f84848cc3a2fe6716f
-DIST cmake-3.27.2-SHA-256.txt 1646 BLAKE2B 89e437e7f6750d81bcc7a207a2c8ea49ac5385e8e5dc3c420d3c7c099d82102d4e7bf9886e86a939c38f07efe413a3ccc7dc63b240204dadc6be7e13896799fe SHA512 50f8d75222d4e767aba90a09eb4bb4cab14dcfe04795f7b4d525f0fd64384c112a64d12a26a2722b086b42a7f3c2176ad1445983f63c6af57771099bbeb3a2b6
-DIST cmake-3.27.2-SHA-256.txt.asc 833 BLAKE2B ec2994faeb1aab675ec02dd6ce10444e972d3599e48efbba2634a62b628c653c1aa067e461e6d8483628d142a5ba86df987ac8907a8916d47a077f93dad7d8e8 SHA512 b1d527e7481d90346c8a1ed61942f48eecf4089a5768691fdcd9592b8cb24af5496aa56aff0e2101c5533f4d19b727105d9cda5c140b60eabc2984ad91f1600a
-DIST cmake-3.27.2.tar.gz 10978264 BLAKE2B 709e6c2769365daf1003ce4bb443291286cd236ab3b1f2b52f13b795e680231a0791b677d59c7389966a1f6d3e716a5e528dd87843e8cbd3a674902d2c92aa04 SHA512 a5fee6e97c69c525a5679c77f1615dbfde982fdbebb68b137a3fd2adf94a0a09773cc21fdc55936f039c13ebfc20ef852814158685e821a8545fcb314a6115f9
-DIST cmake-3.27.3-SHA-256.txt 1646 BLAKE2B 937aea86f553e65b17d3ec5b3c67d790cb614510bfc054cd24c4a39c1f1d6961798ccc067465b6ea2c837ce9a422075d160820c368c3897a37d60c0c8e0c942f SHA512 5d88128a559581924112e04b6049cf293c64e5f095a5685844ad553caf6d66c8589a2665ccd4cc4b546bd670aa932b529dbca82c1a4db4e611c8a341cc241277
-DIST cmake-3.27.3-SHA-256.txt.asc 833 BLAKE2B a73010dead5d44a0d146bbf1c84d303eb07e51ca752f5c3396f534abcd8353afb453f9e00eb77958075ec622e42f48faa70deb1626164607efd521e86477cf55 SHA512 965d62f92133b68911846f65d50dadc2a99c4034fcff9abc1c9e94780049a4e35d621a379079d77bdab18ab22d21bb287ee166cdd6ca2c1f7be0cf6500c11746
-DIST cmake-3.27.3.tar.gz 10978618 BLAKE2B 00376f64031365b5b3ed53d18a51d64ac33b3722933fb48e041fd28942688022e003697450228e46f9bfbfdc81f402552a7f741542dd800b34f7520cf5ba7087 SHA512 cbb845d2a8724faf5c9b57c6350a130c981ef5d209eb34fd52a5940ff7e176b0ae6512f766ee9ee6f03063269179ba15e123690a0d62ac65e32ffe8027806d9f
-DIST cmake-3.27.4-SHA-256.txt 1646 BLAKE2B 42c905f7550e0140ca28f334dc4cd8b244f57830af3011c098b3859cb5c50643141045a61e1e22559d2bb0cf29034229465e73aa4752e2a927fb8ce1426f7f74 SHA512 ecd9e60edee28dd272e8afcc7b0b2240e19f0676b9d634dbe02727bade880103b4a03a1f52a757264e825984a4c4bf7d290df5b32e9b1204555b56afb33d488f
-DIST cmake-3.27.4-SHA-256.txt.asc 833 BLAKE2B 983a89f1637596ebf72e5456a488293bd2dcc21ade8738051279ce43d18244573b912acb7bbe3ff5d52e4b5b52f2bb23784a0750c84997d311d925dd3a608c11 SHA512 f99f606f9907581c3f121b4e0d99ec54a439be35012ca94d4762ae95764c01ef5aeda848dd9c460e340a284e9c3d59fd97315006bfd259863551ae6764af2e4e
-DIST cmake-3.27.4.tar.gz 10980052 BLAKE2B 29991e736c3ed901d30f656742f236e78854fbc13b543f02b08348733e2d4fbc5ef2e4b32f5d2a641c0a1eeacd091db6cc71643f000e9c5505718d999897457c SHA512 fc04b041f5c73b0a969ba09251e00e20f33e7a76460630d60e95ce08086c6b41b82315bd8782c19070b5f12a4290858825687f816b69ad5df8101053b4a2b48a
+DIST cmake-3.27.6-SHA-256.txt 1646 BLAKE2B 402f803dad534d8d053b5b17ba56fb1e61b256e9c1119337a5ef7b23e43c23b592ffcdd5e307ddc0b736b115f8080fde75e4b233d3a7ce42e4e772d8264390a3 SHA512 46c5536d7b8d8b08f97a7352d89df8c12ee9c3b28cd49bd29f91d6136bdb56481f93eb2ceb9c0391dc1284c43f36f384f7b749483b64aebb4f84c6a2cd9077d5
+DIST cmake-3.27.6-SHA-256.txt.asc 833 BLAKE2B e8089ea43f47776b7aec6b57b200c17429bd65a30674cd31868ce04be81ad30bc357f6a3d59748a0366a04e9c4ab844fde3e468025eaab9e9df7d848a96ad290 SHA512 c81b2e51be808cc9cd20a83a2063c721b1dea134f8fdb063ca4b5c6e5b524bd8366c9313b3437374d957cafb629bd4cea7c00ed4e5e23cbef4ad47dfc7f68788
+DIST cmake-3.27.6.tar.gz 10982239 BLAKE2B 1aa876c0c4601261de30fa7829726f9423f3591ba6bfc17377cb846c025f9dc4d564a020b41dc2e24ba12b163c199803167fefd832cea723acdb6e10b6ac9b23 SHA512 268b5bd84800c37ce0e311cadf13c275a538d612844cc8687107549fe6341a6c3115560e3b9162836843016213d225f62db130bc251bf8aff50c69b9bd58e638
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild
deleted file mode 100644
index ce6bc30e2c6..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.0-r1.ebuild
+++ /dev/null
@@ -1,288 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-CMAKE_DOCS_VERSION=${PV}
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake elisp-common flag-o-matic multiprocessing \
-	toolchain-funcs virtualx xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == 9999 ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap emacs ncurses qt5 test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
-
-	# Upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
-
-	cmake_src_configure
-}
-
-src_compile() {
-	cmake_src_compile
-	use emacs && elisp-compile Auxiliary/cmake-mode.el
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actualy bootstrap it every time so why test it.
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	virtx cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	if use emacs; then
-		elisp-install ${PN} Auxiliary/cmake-mode.el Auxiliary/cmake-mode.elc
-		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild
deleted file mode 100644
index 2eb1f89504f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.1-r1.ebuild
+++ /dev/null
@@ -1,288 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-CMAKE_DOCS_VERSION=3.27.0
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake elisp-common flag-o-matic multiprocessing \
-	toolchain-funcs virtualx xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == 9999 ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap emacs ncurses qt5 test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
-
-	# Upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
-
-	cmake_src_configure
-}
-
-src_compile() {
-	cmake_src_compile
-	use emacs && elisp-compile Auxiliary/cmake-mode.el
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actualy bootstrap it every time so why test it.
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	virtx cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	if use emacs; then
-		elisp-install ${PN} Auxiliary/cmake-mode.el Auxiliary/cmake-mode.elc
-		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.2.ebuild
deleted file mode 100644
index 2eb1f89504f..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.2.ebuild
+++ /dev/null
@@ -1,288 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-cmake-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-: ${CMAKE_DOCS_PREBUILT:=1}
-
-CMAKE_DOCS_PREBUILT_DEV=sam
-#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-CMAKE_DOCS_VERSION=3.27.0
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# See bug #784815
-CMAKE_DOCS_USEFLAG="+doc"
-
-# TODO RunCMake.LinkWhatYouUse fails consistently w/ ninja
-# ... but seems fine as of 3.22.3?
-# TODO ... but bootstrap sometimes(?) fails with ninja now. bug #834759.
-CMAKE_MAKEFILE_GENERATOR="emake"
-CMAKE_REMOVE_MODULES_LIST=( none )
-inherit bash-completion-r1 cmake elisp-common flag-o-matic multiprocessing \
-	toolchain-funcs virtualx xdg-utils
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="Cross platform Make"
-HOMEPAGE="https://cmake.org/"
-if [[ ${PV} == 9999 ]] ; then
-	CMAKE_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.kitware.com/cmake/cmake.git"
-	inherit git-r3
-else
-	SRC_URI="https://cmake.org/files/v$(ver_cut 1-2)/${MY_P}.tar.gz"
-
-	if [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${CMAKE_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${CMAKE_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	if [[ ${PV} != *_rc* ]] ; then
-		VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/bradking.asc
-		inherit verify-sig
-
-		SRC_URI+=" verify-sig? (
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt
-			https://github.com/Kitware/CMake/releases/download/v$(ver_cut 1-3)/${MY_P}-SHA-256.txt.asc
-		)"
-
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-		BDEPEND="verify-sig? ( sec-keys/openpgp-keys-bradking )"
-	fi
-fi
-
-[[ ${CMAKE_DOCS_PREBUILT} == 1 ]] && CMAKE_DOCS_USEFLAG="doc"
-
-S="${WORKDIR}/${MY_P}"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap emacs ncurses qt5 test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	>=app-arch/libarchive-3.3.3:=
-	app-crypt/rhash:0=
-	>=dev-libs/expat-2.0.1
-	>=dev-libs/jsoncpp-1.9.2-r2:0=
-	>=dev-libs/libuv-1.10.0:=
-	>=net-misc/curl-7.21.5[ssl]
-	sys-libs/zlib
-	virtual/pkgconfig
-	dap? ( dev-cpp/cppdap )
-	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
-	)
-"
-DEPEND="${RDEPEND}"
-BDEPEND+="
-	doc? (
-		dev-python/requests
-		dev-python/sphinx
-	)
-	test? ( app-arch/libarchive[zstd] )
-"
-
-SITEFILE="50${PN}-gentoo.el"
-
-PATCHES=(
-	# Prefix
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0001-Don-t-use-.so-for-modules-on-darwin-macos.-Use-.bund.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0002-Set-some-proper-paths-to-make-cmake-find-our-tools.patch
-	# Misc
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0003-Prefer-pkgconfig-in-FindBLAS.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0004-Ensure-that-the-correct-version-of-Qt-is-always-used.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0005-Respect-Gentoo-s-Python-eclasses.patch
-	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
-
-	# Upstream fixes (can usually be removed with a version bump)
-)
-
-cmake_src_bootstrap() {
-	# disable running of cmake in bootstrap command
-	sed -i \
-		-e '/"${cmake_bootstrap_dir}\/cmake"/s/^/#DONOTRUN /' \
-		bootstrap || die "sed failed"
-
-	# execinfo.h on Solaris isn't quite what it is on Darwin
-	if [[ ${CHOST} == *-solaris* ]] ; then
-		sed -i -e 's/execinfo\.h/blablabla.h/' \
-			Source/kwsys/CMakeLists.txt || die
-	fi
-
-	# bootstrap script isn't exactly /bin/sh compatible
-	tc-env_build ${CONFIG_SHELL:-sh} ./bootstrap \
-		--prefix="${T}/cmakestrap/" \
-		--parallel=$(makeopts_jobs "${MAKEOPTS}" "$(get_nproc)") \
-		|| die "Bootstrap failed"
-}
-
-src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
-		git-r3_src_unpack
-	elif [[ ${PV} == *_rc* ]] || ! use verify-sig ; then
-		default
-	else
-		cd "${DISTDIR}" || die
-
-		# See https://mgorny.pl/articles/verify-sig-by-example.html#verifying-using-a-checksum-file-with-a-detached-signature
-		verify-sig_verify_detached ${MY_P}-SHA-256.txt{,.asc}
-		verify-sig_verify_unsigned_checksums ${MY_P}-SHA-256.txt sha256 ${MY_P}.tar.gz
-
-		cd "${WORKDIR}" || die
-
-		default
-	fi
-}
-
-src_prepare() {
-	cmake_src_prepare
-
-	if [[ ${CHOST} == *-darwin* ]] ; then
-		# Disable Xcode hooks, bug #652134
-		sed -i -e 's/cm\(\|Global\|Local\)XCode[^.]\+\.\(cxx\|h\)//' \
-			Source/CMakeLists.txt || die
-		sed -i -e '/define CMAKE_USE_XCODE/s/XCODE/NO_XCODE/' \
-			-e '/cmGlobalXCodeGenerator.h/d' \
-			Source/cmake.cxx || die
-
-		# Disable isysroot usage with GCC, we've properly instructed
-		# where things are via GCC configuration and ldwrapper
-		sed -i -e '/cmake_gnu_set_sysroot_flag/d' \
-			Modules/Platform/Apple-GNU-*.cmake || die
-		# Disable isysroot usage with clang as well
-		sed -i -e '/_SYSROOT_FLAG/d' \
-			Modules/Platform/Apple-Clang.cmake || die
-		# Don't set a POSIX standard, system headers don't like that, #757426
-		sed -i -e 's/^#if !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmLoadCommandCommand.cxx \
-			Source/cmStandardLexer.h \
-			Source/cmSystemTools.cxx \
-			Source/cmTimestamp.cxx
-		sed -i -e 's/^#if !defined(_POSIX_C_SOURCE) && !defined(_WIN32) && !defined(__sun)/& \&\& !defined(__APPLE__)/' \
-			Source/cmStandardLexer.h
-	fi
-
-	# Add gcc libs to the default link paths
-	sed -i \
-		-e "s|@GENTOO_PORTAGE_GCCLIBDIR@|${EPREFIX}/usr/${CHOST}/lib/|g" \
-		-e "$(usex prefix-guest "s|@GENTOO_HOST@||" "/@GENTOO_HOST@/d")" \
-		-e "s|@GENTOO_PORTAGE_EPREFIX@|${EPREFIX}/|g" \
-		Modules/Platform/{UnixPaths,Darwin}.cmake || die "sed failed"
-
-	if ! has_version -b \>=${CATEGORY}/${PN}-3.13 || ! cmake --version &>/dev/null ; then
-		CMAKE_BINARY="${S}/Bootstrap.cmk/cmake"
-		cmake_src_bootstrap
-	fi
-}
-
-src_configure() {
-	# Fix linking on Solaris
-	[[ ${CHOST} == *-solaris* ]] && append-ldflags -lsocket -lnsl
-
-	# ODR warnings, bug #858335
-	# https://gitlab.kitware.com/cmake/cmake/-/issues/20740
-	filter-lto
-
-	local mycmakeargs=(
-		-DCMAKE_USE_SYSTEM_LIBRARIES=ON
-		-DCMake_ENABLE_DEBUGGER=$(usex dap)
-		-DCMAKE_DOC_DIR=/share/doc/${PF}
-		-DCMAKE_MAN_DIR=/share/man
-		-DCMAKE_DATA_DIR=/share/${PN}
-		-DSPHINX_MAN=$(usex doc)
-		-DSPHINX_HTML=$(usex doc)
-		-DBUILD_CursesDialog="$(usex ncurses)"
-		-DBUILD_TESTING=$(usex test)
-	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
-
-	cmake_src_configure
-}
-
-src_compile() {
-	cmake_src_compile
-	use emacs && elisp-compile Auxiliary/cmake-mode.el
-}
-
-src_test() {
-	# Fix OutDir and SelectLibraryConfigurations tests
-	# these are altered thanks to our eclass
-	sed -i -e 's:^#_cmake_modify_IGNORE ::g' \
-		"${S}"/Tests/{OutDir,CMakeOnly/SelectLibraryConfigurations}/CMakeLists.txt \
-		|| die
-
-	pushd "${BUILD_DIR}" > /dev/null || die
-
-	# Excluded tests:
-	#    BootstrapTest: we actualy bootstrap it every time so why test it.
-	#    BundleUtilities: bundle creation broken
-	#    CMakeOnly.AllFindModules: pthread issues
-	#    CTest.updatecvs: which fails to commit as root
-	#    Fortran: requires fortran
-	#    RunCMake.CompilerLauncher: also requires fortran
-	#    RunCMake.CPack_RPM: breaks if app-arch/rpm is installed because
-	#        debugedit binary is not in the expected location
-	#    RunCMake.CPack_DEB: breaks if app-arch/dpkg is installed because
-	#        it can't find a deb package that owns libc
-	#    TestUpload, which requires network access
-	#    RunCMake.CMP0125, known failure reported upstream (bug #829414)
-	local myctestargs=(
-		--output-on-failure
-		-E "(BootstrapTest|BundleUtilities|CMakeOnly.AllFindModules|CompileOptions|CTest.UpdateCVS|Fortran|RunCMake.CompilerLauncher|RunCMake.CPack_(DEB|RPM)|TestUpload|RunCMake.CMP0125)" \
-	)
-
-	virtx cmake_src_test
-}
-
-src_install() {
-	cmake_src_install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${CMAKE_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${CMAKE_DOCS_VERSION}-docs/man*/*.[0-8]
-	fi
-
-	if use emacs; then
-		elisp-install ${PN} Auxiliary/cmake-mode.el Auxiliary/cmake-mode.elc
-		elisp-site-file-install "${FILESDIR}/${SITEFILE}"
-	fi
-
-	insinto /usr/share/vim/vimfiles/syntax
-	doins Auxiliary/vim/syntax/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/indent
-	doins Auxiliary/vim/indent/cmake.vim
-
-	insinto /usr/share/vim/vimfiles/ftdetect
-	doins "${FILESDIR}/${PN}.vim"
-
-	dobashcomp Auxiliary/bash-completion/{${PN},ctest,cpack}
-}
-
-pkg_postinst() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
-
-pkg_postrm() {
-	use emacs && elisp-site-regen
-
-	if use qt5; then
-		xdg_icon_cache_update
-		xdg_desktop_database_update
-		xdg_mimeinfo_database_update
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.4.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6-r1.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.4.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6-r1.ebuild
index 98ff361e9f7..b122058f45c 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.4.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6-r1.ebuild
@@ -60,7 +60,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap emacs ncurses qt5 test"
+IUSE="${CMAKE_DOCS_USEFLAG} dap emacs gui ncurses qt6 test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -74,12 +74,15 @@ RDEPEND="
 	virtual/pkgconfig
 	dap? ( dev-cpp/cppdap )
 	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
 	)
+	ncurses? ( sys-libs/ncurses:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND+="
@@ -103,6 +106,9 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	# pkgconf
+	# fixes https://github.com/pkgconf/pkgconf/issues/317
+	"${FILESDIR}"/${PN}-3.27.4-0001-FindPkgConfig-ignore-whitespace-separators-in-versio.patch
 )
 
 cmake_src_bootstrap() {
@@ -201,8 +207,10 @@ src_configure() {
 		-DSPHINX_HTML=$(usex doc)
 		-DBUILD_CursesDialog="$(usex ncurses)"
 		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
 	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
 
 	cmake_src_configure
 }
@@ -270,7 +278,7 @@ src_install() {
 pkg_postinst() {
 	use emacs && elisp-site-regen
 
-	if use qt5; then
+	if use gui; then
 		xdg_icon_cache_update
 		xdg_desktop_database_update
 		xdg_mimeinfo_database_update
@@ -280,7 +288,7 @@ pkg_postinst() {
 pkg_postrm() {
 	use emacs && elisp-site-regen
 
-	if use qt5; then
+	if use gui; then
 		xdg_icon_cache_update
 		xdg_desktop_database_update
 		xdg_mimeinfo_database_update
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.3-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.3-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6.ebuild
index 98ff361e9f7..b999a8475ec 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.3-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-3.27.6.ebuild
@@ -103,6 +103,9 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-3.27.0_rc1-0006-Filter-out-distcc-warnings-to-avoid-confusing-CMake.patch
 
 	# Upstream fixes (can usually be removed with a version bump)
+	# pkgconf
+	# fixes https://github.com/pkgconf/pkgconf/issues/317
+	"${FILESDIR}"/${PN}-3.27.4-0001-FindPkgConfig-ignore-whitespace-separators-in-versio.patch
 )
 
 cmake_src_bootstrap() {
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
index 1646d11a2bb..f6edfcf4187 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/cmake-9999.ebuild
@@ -9,8 +9,7 @@ EAPI=8
 : ${CMAKE_DOCS_PREBUILT:=1}
 
 CMAKE_DOCS_PREBUILT_DEV=sam
-#CMAKE_DOCS_VERSION=$(ver_cut 1-3)
-CMAKE_DOCS_VERSION=${PV}
+CMAKE_DOCS_VERSION=$(ver_cut 1-3)
 # Default to generating docs (inc. man pages) if no prebuilt; overridden later
 # See bug #784815
 CMAKE_DOCS_USEFLAG="+doc"
@@ -60,7 +59,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="BSD"
 SLOT="0"
-IUSE="${CMAKE_DOCS_USEFLAG} dap emacs ncurses qt5 test"
+IUSE="${CMAKE_DOCS_USEFLAG} dap emacs gui ncurses qt6 test"
 RESTRICT="!test? ( test )"
 
 RDEPEND="
@@ -74,12 +73,15 @@ RDEPEND="
 	virtual/pkgconfig
 	dap? ( dev-cpp/cppdap )
 	emacs? ( >=app-editors/emacs-23.1:* )
-	ncurses? ( sys-libs/ncurses:0= )
-	qt5? (
-		dev-qt/qtcore:5
-		dev-qt/qtgui:5
-		dev-qt/qtwidgets:5
+	gui? (
+		!qt6? (
+			dev-qt/qtcore:5
+			dev-qt/qtgui:5
+			dev-qt/qtwidgets:5
+		)
+		qt6? ( dev-qt/qtbase:6[gui,widgets] )
 	)
+	ncurses? ( sys-libs/ncurses:= )
 "
 DEPEND="${RDEPEND}"
 BDEPEND+="
@@ -201,8 +203,10 @@ src_configure() {
 		-DSPHINX_HTML=$(usex doc)
 		-DBUILD_CursesDialog="$(usex ncurses)"
 		-DBUILD_TESTING=$(usex test)
+		-DBUILD_QtDialog=$(usex gui)
 	)
-	use qt5 && mycmakeargs+=( -DBUILD_QtDialog=ON )
+
+	use gui && mycmakeargs+=( -DCMake_QT_MAJOR_VERSION=$(usex qt6 6 5) )
 
 	cmake_src_configure
 }
@@ -270,7 +274,7 @@ src_install() {
 pkg_postinst() {
 	use emacs && elisp-site-regen
 
-	if use qt5; then
+	if use gui; then
 		xdg_icon_cache_update
 		xdg_desktop_database_update
 		xdg_mimeinfo_database_update
@@ -280,7 +284,7 @@ pkg_postinst() {
 pkg_postrm() {
 	use emacs && elisp-site-regen
 
-	if use qt5; then
+	if use gui; then
 		xdg_icon_cache_update
 		xdg_desktop_database_update
 		xdg_mimeinfo_database_update
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/cmake/files/cmake-3.27.4-0001-FindPkgConfig-ignore-whitespace-separators-in-versio.patch b/sdk_container/src/third_party/portage-stable/dev-util/cmake/files/cmake-3.27.4-0001-FindPkgConfig-ignore-whitespace-separators-in-versio.patch
new file mode 100644
index 00000000000..9ee8a1c9fcb
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/cmake/files/cmake-3.27.4-0001-FindPkgConfig-ignore-whitespace-separators-in-versio.patch
@@ -0,0 +1,38 @@
+https://gitlab.kitware.com/cmake/cmake/-/merge_requests/8789
+
+From d47771bbb96a8435401950fb504b06003ec0babb Mon Sep 17 00:00:00 2001
+From: Paul Zander <negril.nx+gentoo@gmail.com>
+Date: Sat, 9 Sep 2023 13:45:19 +0200
+Subject: [PATCH] FindPkgConfig: ignore whitespace separators in version check
+
+The regex used to split up the version if it contains an operator fails
+if the string contains whitespaces. Resulting in an extra whitespace
+after the package name and before the package version leading to
+breakage in pkgconf and thus webkit-gtk.
+
+See:
+https://github.com/pkgconf/pkgconf/issues/317
+https://bugs.webkit.org/show_bug.cgi?id=261125
+https://bugs.gentoo.org/913644
+---
+ Modules/FindPkgConfig.cmake | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Modules/FindPkgConfig.cmake b/Modules/FindPkgConfig.cmake
+index 4d29f4505..6e8b78441 100644
+--- a/Modules/FindPkgConfig.cmake
++++ b/Modules/FindPkgConfig.cmake
+@@ -563,8 +563,8 @@ macro(_pkg_check_modules_internal _is_required _is_silent _no_cmake_path _no_cma
+     foreach (_pkg_check_modules_pkg ${_pkg_check_modules_list})
+       set(_pkg_check_modules_exist_query)
+ 
+-      # check whether version is given
+-      if (_pkg_check_modules_pkg MATCHES "(.*[^><])(=|[><]=?)(.*)")
++      # check whether version is given while ignoring whitespace
++      if (_pkg_check_modules_pkg MATCHES "(.*[^>< \t])[ \t]*(=|[><]=?)[ \t]*(.*)")
+         set(_pkg_check_modules_pkg_name "${CMAKE_MATCH_1}")
+         set(_pkg_check_modules_pkg_op "${CMAKE_MATCH_2}")
+         set(_pkg_check_modules_pkg_ver "${CMAKE_MATCH_3}")
+-- 
+2.42.0
+
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
index ca6d5eb1558..8838499ec5d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/Manifest
@@ -1,3 +1,2 @@
 DIST glib-2.76.4.tar.xz 5274356 BLAKE2B c9ceb514ea81e1e6ab2d0efc82c48c0d8ae6c997fd0e3c56d47a5174b027f785b58266fff73b1d1132e272305126fbff22e3c65d47de46224cd12fa49796d5bc SHA512 f76932dc5090a44880373228e2b162f338415d06f7c90f2950eab1a43bb191c56a1797da4d377594f6a999197fef4defb848039259cfa4105bb68288a928f5b7
-DIST glib-2.77.3.tar.xz 5316816 BLAKE2B 94d28c1526a19cb679a85f32bda159ee07862ce6aa0e2bb2e953c748d8cc790454603d3db8c748638754fef60e74a6e3584952804ff438b49fcfc009803a07b5 SHA512 d9727d67e63d7f8ce710bff497c183799b0192ac10900da87887bd76812aad9603e7f132d7eb4e8626787c427048aeafb4a28654ab808c676bcfc2b897e005d9
 DIST glib-2.78.0.tar.xz 5327096 BLAKE2B 3a494a16d12b17c7986bbe865d5e3b2727d40e7272fbb34897a90173c0fb780b0e7f024042f60ac6d1fcb9a2a4731948b6ac733c2bd6bd27c32b97281e20fc72 SHA512 3d06890002f4b13f831c83fbb70cfce529f9750e30888619e4d6277116be15d106379a03143412cf4b2a289c0cbdbbc299ecf17284fbffc06c791ecf7556c765
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.77.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.77.3.ebuild
deleted file mode 100644
index 3595e34fd89..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/gdbus-codegen/gdbus-codegen-2.77.3.ebuild
+++ /dev/null
@@ -1,74 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-GNOME_ORG_MODULE="glib"
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="xml(+)"
-DISTUTILS_USE_PEP517=setuptools
-DISTUTILS_SINGLE_IMPL=1
-
-inherit gnome.org distutils-r1
-
-DESCRIPTION="GDBus code and documentation generator"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2+"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-macos"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-S="${WORKDIR}/glib-${PV}/gio/gdbus-2.0/codegen"
-
-python_prepare_all() {
-	PATCHES=(
-		"${FILESDIR}/${PN}-2.56.1-sitedir.patch"
-	)
-	distutils-r1_python_prepare_all
-
-	local MAJOR_VERSION=$(ver_cut 1)
-	local MINOR_VERSION=$(ver_cut 2)
-	sed -e 's:@PYTHON@:python:' gdbus-codegen.in > gdbus-codegen || die
-	sed -e "s:@VERSION@:${PV}:" \
-		-e "s:@MAJOR_VERSION@:${MAJOR_VERSION}:" \
-		-e "s:@MINOR_VERSION@:${MINOR_VERSION}:" config.py.in > config.py || die
-	cp "${FILESDIR}/setup.py-2.32.4" setup.py || die "cp failed"
-	sed -e "s/@PV@/${PV}/" -i setup.py || die "sed setup.py failed"
-}
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/glib-utils)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	distutils-r1_src_compile
-	do_xsltproc_command \
-		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.xml" \
-		"${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
-
-src_test() {
-	einfo "Skipping tests. This package is tested by dev-libs/glib"
-	einfo "when merged with FEATURES=test"
-}
-
-python_install_all() {
-	distutils-r1_python_install_all # no-op, but prevents QA warning
-	doman "${WORKDIR}/glib-${PV}/docs/reference/gio/gdbus-codegen.1"
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
index ca6d5eb1558..8838499ec5d 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/Manifest
@@ -1,3 +1,2 @@
 DIST glib-2.76.4.tar.xz 5274356 BLAKE2B c9ceb514ea81e1e6ab2d0efc82c48c0d8ae6c997fd0e3c56d47a5174b027f785b58266fff73b1d1132e272305126fbff22e3c65d47de46224cd12fa49796d5bc SHA512 f76932dc5090a44880373228e2b162f338415d06f7c90f2950eab1a43bb191c56a1797da4d377594f6a999197fef4defb848039259cfa4105bb68288a928f5b7
-DIST glib-2.77.3.tar.xz 5316816 BLAKE2B 94d28c1526a19cb679a85f32bda159ee07862ce6aa0e2bb2e953c748d8cc790454603d3db8c748638754fef60e74a6e3584952804ff438b49fcfc009803a07b5 SHA512 d9727d67e63d7f8ce710bff497c183799b0192ac10900da87887bd76812aad9603e7f132d7eb4e8626787c427048aeafb4a28654ab808c676bcfc2b897e005d9
 DIST glib-2.78.0.tar.xz 5327096 BLAKE2B 3a494a16d12b17c7986bbe865d5e3b2727d40e7272fbb34897a90173c0fb780b0e7f024042f60ac6d1fcb9a2a4731948b6ac733c2bd6bd27c32b97281e20fc72 SHA512 3d06890002f4b13f831c83fbb70cfce529f9750e30888619e4d6277116be15d106379a03143412cf4b2a289c0cbdbbc299ecf17284fbffc06c791ecf7556c765
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.77.3.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.77.3.ebuild
deleted file mode 100644
index 6fb045244ae..00000000000
--- a/sdk_container/src/third_party/portage-stable/dev-util/glib-utils/glib-utils-2.77.3.ebuild
+++ /dev/null
@@ -1,62 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-PYTHON_COMPAT=( python3_{10..12} )
-GNOME_ORG_MODULE="glib"
-
-inherit gnome.org python-single-r1
-
-DESCRIPTION="Build utilities for GLib using projects"
-HOMEPAGE="https://www.gtk.org/"
-
-LICENSE="LGPL-2.1+"
-SLOT="0" # /usr/bin utilities that can't be parallel installed by their nature
-REQUIRED_USE="${PYTHON_REQUIRED_USE}"
-
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-
-RDEPEND="${PYTHON_DEPS}"
-DEPEND="${RDEPEND}"
-BDEPEND="
-	dev-libs/libxslt
-	app-text/docbook-xsl-stylesheets
-"
-
-src_configure() { :; }
-
-do_xsltproc_command() {
-	# Taken from meson.build for manual manpage building - keep in sync (also copied to dev-util/gdbus-codegen)
-	xsltproc \
-		--nonet \
-		--stringparam man.output.quietly 1 \
-		--stringparam funcsynopsis.style ansi \
-		--stringparam man.th.extra1.suppress 1 \
-		--stringparam man.authors.section.enabled 0 \
-		--stringparam man.copyright.section.enabled 0 \
-		-o "${2}" \
-		http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl \
-		"${1}" || die "manpage generation failed"
-}
-
-src_compile() {
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-genmarshal.in > gobject/glib-genmarshal || die
-	sed -e "s:@VERSION@:${PV}:g;s:@PYTHON@:python:g" gobject/glib-mkenums.in > gobject/glib-mkenums || die
-	sed -e "s:@GLIB_VERSION@:${PV}:g;s:@PYTHON@:python:g" glib/gtester-report.in > glib/gtester-report || die
-	do_xsltproc_command docs/reference/gobject/glib-genmarshal.xml docs/reference/gobject/glib-genmarshal.1
-	do_xsltproc_command docs/reference/gobject/glib-mkenums.xml docs/reference/gobject/glib-mkenums.1
-	do_xsltproc_command docs/reference/glib/gtester-report.xml docs/reference/glib/gtester-report.1
-}
-
-src_install() {
-	python_fix_shebang gobject/glib-genmarshal
-	python_fix_shebang gobject/glib-mkenums
-	python_fix_shebang glib/gtester-report
-	exeinto /usr/bin
-	doexe gobject/glib-genmarshal
-	doexe gobject/glib-mkenums
-	doexe glib/gtester-report
-	doman docs/reference/gobject/glib-genmarshal.1
-	doman docs/reference/gobject/glib-mkenums.1
-	doman docs/reference/glib/gtester-report.1
-}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/meson/files/meson-1.2.1-llvm-17.patch b/sdk_container/src/third_party/portage-stable/dev-util/meson/files/meson-1.2.1-llvm-17.patch
new file mode 100644
index 00000000000..ceee1dcd292
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/meson/files/meson-1.2.1-llvm-17.patch
@@ -0,0 +1,41 @@
+https://bugs.gentoo.org/914576
+https://github.com/mesonbuild/meson/commit/d0b09898c703f6c10ec5a6b2aeace0df2e3570aa
+https://github.com/mesonbuild/meson/commit/9c74c73bc7107c794e7f9896cc4220e50ad32bba
+
+From d0b09898c703f6c10ec5a6b2aeace0df2e3570aa Mon Sep 17 00:00:00 2001
+From: Christoph Reiter <reiter.christoph@gmail.com>
+Date: Sat, 23 Sep 2023 17:21:43 +0200
+Subject: [PATCH] get_llvm_tool_names: add llvm 17
+
+this fixes the "frameworks: 15 llvm" tests with llvm 17
+--- a/mesonbuild/environment.py
++++ b/mesonbuild/environment.py
+@@ -157,6 +157,7 @@ def get_llvm_tool_names(tool: str) -> T.List[str]:
+     # unless it becomes a stable release.
+     suffixes = [
+         '', # base (no suffix)
++        '-17',  '17',
+         '-16',  '16',
+         '-15',  '15',
+         '-14',  '14',
+
+From 9c74c73bc7107c794e7f9896cc4220e50ad32bba Mon Sep 17 00:00:00 2001
+From: Christoph Reiter <reiter.christoph@gmail.com>
+Date: Sat, 23 Sep 2023 14:10:29 +0200
+Subject: [PATCH] openmp: add 5.1/5.2, fixes openmp with llvm v17
+
+llvm v17 defaults to 5.1 and without this meson fails to find
+openmp: 'ERROR: Dependency "openmp" not found, tried system'
+
+Add 5.2 as well while at it.
+--- a/mesonbuild/dependencies/misc.py
++++ b/mesonbuild/dependencies/misc.py
+@@ -85,6 +85,8 @@ def __init__(self, name: str, env: 'Environment', kwargs: T.Dict[str, T.Any]):
+ class OpenMPDependency(SystemDependency):
+     # Map date of specification release (which is the macro value) to a version.
+     VERSIONS = {
++        '202111': '5.2',
++        '202011': '5.1',
+         '201811': '5.0',
+         '201611': '5.0-revision1',  # This is supported by ICC 19.x
+         '201511': '4.5',
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r1.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r1.ebuild
index 2f54a012076..bf7bd116044 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r1.ebuild
@@ -16,7 +16,7 @@ else
 	S=${WORKDIR}/${MY_P}
 
 	if [[ ${PV} != *_rc* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r2.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r2.ebuild
new file mode 100644
index 00000000000..48e35139458
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/meson/meson-1.2.1-r2.ebuild
@@ -0,0 +1,122 @@
+# Copyright 2016-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} pypy3 )
+DISTUTILS_USE_PEP517=setuptools
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_REPO_URI="https://github.com/mesonbuild/meson"
+	inherit git-r3
+else
+	inherit pypi
+
+	MY_P=${P/_/}
+	S=${WORKDIR}/${MY_P}
+
+	if [[ ${PV} != *_rc* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+inherit bash-completion-r1 distutils-r1 toolchain-funcs
+
+DESCRIPTION="Open source build system"
+HOMEPAGE="https://mesonbuild.com/"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	test? (
+		dev-libs/glib:2
+		dev-libs/gobject-introspection
+		dev-util/ninja
+		dev-vcs/git
+		sys-libs/zlib[static-libs(+)]
+		virtual/pkgconfig
+	)
+"
+RDEPEND="
+	virtual/pkgconfig
+"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-python-path.patch
+	"${FILESDIR}"/${P}-llvm-17.patch
+)
+
+python_prepare_all() {
+	local disable_unittests=(
+		# ASAN and sandbox both want control over LD_PRELOAD
+		# https://bugs.gentoo.org/673016
+		-e 's/test_generate_gir_with_address_sanitizer/_&/'
+
+		# ASAN is unsupported on some targets
+		# https://bugs.gentoo.org/692822
+		-e 's/test_pch_with_address_sanitizer/_&/'
+
+		# https://github.com/mesonbuild/meson/issues/7203
+		-e 's/test_templates/_&/'
+
+		# Broken due to python2 wrapper
+		-e 's/test_python_module/_&/'
+	)
+
+	sed -i "${disable_unittests[@]}" unittests/*.py || die
+
+	# Broken due to python2 script created by python_wrapper_setup
+	rm -r "test cases/frameworks/1 boost" || die
+
+	distutils-r1_python_prepare_all
+}
+
+src_test() {
+	tc-export PKG_CONFIG
+	if ${PKG_CONFIG} --exists Qt5Core && ! ${PKG_CONFIG} --exists Qt5Gui; then
+		ewarn "Found Qt5Core but not Qt5Gui; skipping tests"
+	else
+		distutils-r1_src_test
+	fi
+}
+
+python_test() {
+	(
+		# test_meson_installed
+		unset PYTHONDONTWRITEBYTECODE
+
+		# https://bugs.gentoo.org/687792
+		unset PKG_CONFIG
+
+		# test_cross_file_system_paths
+		unset XDG_DATA_HOME
+
+		# 'test cases/unit/73 summary' expects 80 columns
+		export COLUMNS=80
+
+		# If JAVA_HOME is not set, meson looks for javac in PATH.
+		# If javac is in /usr/bin, meson assumes /usr/include is a valid
+		# JDK include path. Setting JAVA_HOME works around this broken
+		# autodetection. If no JDK is installed, we should end up with an empty
+		# value in JAVA_HOME, and the tests should get skipped.
+		export JAVA_HOME=$(java-config -O 2>/dev/null)
+
+		# Call python3 instead of EPYTHON to satisfy test_meson_uninstalled.
+		python3 run_tests.py
+	) || die "Testing failed with ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	insinto /usr/share/vim/vimfiles
+	doins -r data/syntax-highlighting/vim/{ftdetect,indent,syntax}
+
+	insinto /usr/share/zsh/site-functions
+	doins data/shell-completions/zsh/_meson
+
+	dobashcomp data/shell-completions/bash/meson
+}
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
index a8c77095f0c..f24a9347ce5 100644
--- a/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/Manifest
@@ -1,2 +1,3 @@
 DIST linux-6.3.tar.xz 136891752 BLAKE2B f1887c8924efa8d0cb14c4e604affd0b0168bcf20f56a37c027405c7bc11aba822a43fcb38ccb55a81a26f747d00e1ab5a6554818affbf1e1c7ef5220150fc69 SHA512 768979440f4907ba64d4481b383d6101faf208f27a0b897156123aa278c5743fe3c4f61945b2541429c532d45382aaee8899ea9d44a1d2895bfbb79bfd937f65
 DIST linux-6.4.tar.xz 137794856 BLAKE2B b59eb04a8715af9f686978812e6d4a466172bb859f80657076de14cd0828b4fac15b688ff8959f5c65485f7f6bef26590412c66821e720de843cb8666f226c90 SHA512 11a48b25e0b513782d3b89101c2ec8dd9cefd6ce08dc63a91137903b66392aa72ca1fe32816710673af84dd47de3ab8738056a6af93dc0d5e60ef4b869b49928
+DIST linux-6.5.tar.xz 138898084 BLAKE2B 2e641b79a080e8f4ce283bcf6b74e2c6f15a374367f1c4c875c663868dbe801317340824fb3adb46b3a51d3b7e1f67cc4e8144d367621ec43ffba5c4eb8abb39 SHA512 1b59dc5e65d4922c3217a8c8f19022dfd6595ae89747861d825bfeb51a4ae6c85449d05db69635a712bef7b355b80318195665582d8933b1fed6ba582f6ff257
diff --git a/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.5.ebuild b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.5.ebuild
new file mode 100644
index 00000000000..a1a140af0ed
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/dev-util/perf/perf-6.5.ebuild
@@ -0,0 +1,313 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+inherit bash-completion-r1 estack flag-o-matic linux-info llvm toolchain-funcs python-r1
+
+DESCRIPTION="Userland tools for Linux Performance Counters"
+HOMEPAGE="https://perf.wiki.kernel.org/"
+
+LINUX_V="${PV:0:1}.x"
+if [[ ${PV} == *_rc* ]] ; then
+	LINUX_VER=$(ver_cut 1-2).$(($(ver_cut 3)-1))
+	PATCH_VERSION=$(ver_cut 1-3)
+	LINUX_PATCH=patch-${PV//_/-}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/${LINUX_PATCH}
+		https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/testing/v${PATCH_VERSION}/${LINUX_PATCH}"
+elif [[ ${PV} == *.*.* ]] ; then
+	# stable-release series
+	LINUX_VER=$(ver_cut 1-2)
+	LINUX_PATCH=patch-${PV}.xz
+	SRC_URI="https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_PATCH}"
+else
+	LINUX_VER=${PV}
+	SRC_URI=""
+fi
+
+LINUX_SOURCES="linux-${LINUX_VER}.tar.xz"
+SRC_URI+=" https://www.kernel.org/pub/linux/kernel/v${LINUX_V}/${LINUX_SOURCES}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~x86 ~amd64-linux ~x86-linux"
+IUSE="audit babeltrace bpf caps clang crypt debug +doc gtk java libpfm libtraceevent libtracefs lzma numa perl python slang systemtap tcmalloc unwind zstd"
+
+REQUIRED_USE="
+	bpf? ( clang )
+	${PYTHON_REQUIRED_USE}
+"
+
+# setuptools (and Python) are always needed even if not building Python bindings
+BDEPEND="
+	${LINUX_PATCH+dev-util/patchutils}
+	${PYTHON_DEPS}
+	>=app-arch/tar-1.34-r2
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+	doc? (
+		app-text/asciidoc
+		app-text/sgml-common
+		app-text/xmlto
+		sys-process/time
+	)
+"
+
+RDEPEND="
+	audit? ( sys-process/audit )
+	babeltrace? ( dev-util/babeltrace )
+	bpf? (
+		dev-libs/libbpf
+		dev-util/bpftool
+		dev-util/pahole
+	)
+	caps? ( sys-libs/libcap )
+	clang? (
+		sys-devel/clang:=
+		sys-devel/llvm:=
+	)
+	crypt? ( dev-libs/openssl:= )
+	gtk? ( x11-libs/gtk+:2 )
+	java? ( virtual/jre:* )
+	libpfm? ( dev-libs/libpfm:= )
+	libtraceevent? ( dev-libs/libtraceevent )
+	libtracefs? ( dev-libs/libtracefs )
+	lzma? ( app-arch/xz-utils )
+	numa? ( sys-process/numactl )
+	perl? ( dev-lang/perl:= )
+	python? ( ${PYTHON_DEPS} )
+	slang? ( sys-libs/slang )
+	systemtap? ( dev-util/systemtap )
+	tcmalloc? ( dev-util/google-perftools )
+	unwind? ( sys-libs/libunwind:= )
+	zstd? ( app-arch/zstd:= )
+	dev-libs/elfutils
+	sys-libs/binutils-libs:=
+	sys-libs/zlib
+"
+
+DEPEND="${RDEPEND}
+	>=sys-kernel/linux-headers-5.10
+	java? ( virtual/jdk )
+"
+
+S_K="${WORKDIR}/linux-${LINUX_VER}"
+S="${S_K}/tools/perf"
+
+CONFIG_CHECK="
+	~DEBUG_INFO
+	~FTRACE
+	~FTRACE_SYSCALLS
+	~FUNCTION_TRACER
+	~KALLSYMS
+	~KALLSYMS_ALL
+	~KPROBES
+	~KPROBE_EVENTS
+	~PERF_EVENTS
+	~UPROBES
+	~UPROBE_EVENTS
+"
+
+QA_FLAGS_IGNORED=(
+	'usr/bin/perf-read-vdso32' # not linked with anything except for libc
+	'usr/libexec/perf-core/dlfilters/.*' # plugins
+)
+
+pkg_pretend() {
+	if ! use doc ; then
+		ewarn "Without the doc USE flag you won't get any documentation nor man pages."
+		ewarn "And without man pages, you won't get any --help output for perf and its"
+		ewarn "sub-tools."
+	fi
+}
+
+pkg_setup() {
+	use clang && llvm_pkg_setup
+	# We enable python unconditionally as libbpf always generates
+	# API headers using python script
+	python_setup
+
+	if use bpf ; then
+		CONFIG_CHECK+="~BPF ~BPF_EVENTS ~BPF_SYSCALL ~DEBUG_INFO_BTF ~HAVE_EBPF_JIT"
+	fi
+
+	linux-info_pkg_setup
+}
+
+# src_unpack and src_prepare are copied to dev-util/bpftool since
+# it's building from the same tarball, please keep it in sync with bpftool
+src_unpack() {
+	local paths=(
+		kernel/bpf tools/{arch,bpf,build,include,lib,perf,scripts}
+		scripts include lib "arch/*/lib"
+	)
+
+	# We expect the tar implementation to support the -j option (both
+	# GNU tar and libarchive's tar support that).
+	echo ">>> Unpacking ${LINUX_SOURCES} (${paths[*]}) to ${PWD}"
+	gtar --wildcards -xpf "${DISTDIR}"/${LINUX_SOURCES} \
+		"${paths[@]/#/linux-${LINUX_VER}/}" || die
+
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		eshopts_push -o noglob
+		ebegin "Filtering partial source patch"
+		filterdiff -p1 ${paths[@]/#/-i } -z "${DISTDIR}"/${LINUX_PATCH} \
+			> ${P}.patch
+		eend $? || die "filterdiff failed"
+		eshopts_pop
+	fi
+
+	local a
+	for a in ${A}; do
+		[[ ${a} == ${LINUX_SOURCES} ]] && continue
+		[[ ${a} == ${LINUX_PATCH} ]] && continue
+		unpack ${a}
+	done
+}
+
+src_prepare() {
+	default
+	if [[ -n ${LINUX_PATCH} ]] ; then
+		pushd "${S_K}" >/dev/null || die
+		eapply "${WORKDIR}"/${P}.patch
+		popd || die
+	fi
+
+	pushd "${S_K}" >/dev/null || die
+	eapply "${FILESDIR}"/perf-6.0-clang.patch
+	eapply "${FILESDIR}"/perf-6.0-c++17.patch
+	eapply "${FILESDIR}"/perf-6.4-libtracefs.patch
+	popd || die
+
+	# Drop some upstream too-developer-oriented flags and fix the
+	# Makefile in general
+	sed -i \
+		-e "s@\$(sysconfdir_SQ)/bash_completion.d@$(get_bashcompdir)@" \
+		"${S}"/Makefile.perf || die
+	# A few places still use -Werror w/out $(WERROR) protection.
+	sed -i -e 's@-Werror@@' \
+		"${S}"/Makefile.perf "${S_K}"/tools/lib/bpf/Makefile \
+		"${S_K}"/tools/lib/perf/Makefile || die
+
+	# Avoid the call to make kernelversion
+	sed -i -e '/PERF-VERSION-GEN/d' Makefile.perf || die
+	echo "#define PERF_VERSION \"${PV}\"" > PERF-VERSION-FILE
+
+	# The code likes to compile local assembly files which lack ELF markings.
+	find -name '*.S' -exec sed -i '$a.section .note.GNU-stack,"",%progbits' {} +
+}
+
+puse() { usex $1 "" 1; }
+perf_make() {
+	# The arch parsing is a bit funky.  The perf tools package is integrated
+	# into the kernel, so it wants an ARCH that looks like the kernel arch,
+	# but it also wants to know about the split value -- i386/x86_64 vs just
+	# x86.  We can get that by telling the func to use an older linux version.
+	# It's kind of a hack, but not that bad ...
+
+	# LIBDIR sets a search path of perf-gtk.so. Bug 515954
+
+	local arch=$(tc-arch-kernel)
+	local java_dir
+	use java && java_dir="${EPREFIX}/etc/java-config-2/current-system-vm"
+	# FIXME: NO_CORESIGHT
+	local emakeargs=(
+		V=1 VF=1
+		HOSTCC="$(tc-getBUILD_CC)" HOSTLD="$(tc-getBUILD_LD)"
+		CC="$(tc-getCC)" CXX="$(tc-getCXX)" AR="$(tc-getAR)" LD="$(tc-getLD)" NM="$(tc-getNM)"
+		PKG_CONFIG="$(tc-getPKG_CONFIG)"
+		prefix="${EPREFIX}/usr" bindir_relative="bin"
+		tipdir="share/doc/${PF}"
+		EXTRA_CFLAGS="${CFLAGS}"
+		EXTRA_LDFLAGS="${LDFLAGS}"
+		ARCH="${arch}"
+		BUILD_BPF_SKEL=$(usex bpf 1 "") \
+		BUILD_NONDISTRO=1
+		JDIR="${java_dir}"
+		CORESIGHT=
+		GTK2=$(usex gtk 1 "")
+		LIBCLANGLLVM=$(usex clang 1 "")
+		feature-gtk2-infobar=$(usex gtk 1 "")
+		NO_AUXTRACE=
+		NO_BACKTRACE=
+		NO_DEMANGLE=
+		NO_JEVENTS=$(puse python)
+		NO_JVMTI=$(puse java)
+		NO_LIBAUDIT=$(puse audit)
+		NO_LIBBABELTRACE=$(puse babeltrace)
+		NO_LIBBIONIC=1
+		NO_LIBBPF=$(puse bpf)
+		NO_LIBCAP=$(puse caps)
+		NO_LIBCRYPTO=$(puse crypt)
+		NO_LIBDW_DWARF_UNWIND=
+		NO_LIBELF=
+		NO_LIBNUMA=$(puse numa)
+		NO_LIBPERL=$(puse perl)
+		NO_LIBPFM4=$(puse libpfm)
+		NO_LIBPYTHON=$(puse python)
+		NO_LIBTRACEEVENT=$(puse libtraceevent)
+		NO_LIBUNWIND=$(puse unwind)
+		NO_LIBZSTD=$(puse zstd)
+		NO_SDT=$(puse systemtap)
+		NO_SLANG=$(puse slang)
+		NO_LZMA=$(puse lzma)
+		NO_ZLIB=
+		TCMALLOC=$(usex tcmalloc 1 "")
+		WERROR=0
+		LIBDIR="/usr/libexec/perf-core"
+		libdir="${EPREFIX}/usr/$(get_libdir)"
+		plugindir="${EPREFIX}/usr/$(get_libdir)/perf/plugins"
+		"$@"
+	)
+	emake "${emakeargs[@]}"
+}
+
+src_compile() {
+	filter-lto
+
+	# test-clang.bin not build with g++
+	if use clang; then
+		make -C "${S_K}/tools/build/feature" V=1 CXX=${CHOST}-clang++ test-clang.bin || die
+	fi
+	perf_make -f Makefile.perf
+	use doc && perf_make -C Documentation man
+}
+
+src_test() {
+	:
+}
+
+src_install() {
+	_install_python_ext() {
+		perf_make -f Makefile.perf install-python_ext DESTDIR="${D}"
+	}
+
+	perf_make -f Makefile.perf install DESTDIR="${D}"
+
+	if use python; then
+		python_foreach_impl _install_python_ext
+	fi
+
+	if use gtk; then
+		local libdir
+		libdir="$(get_libdir)"
+		# on some arches it ends up in lib even on 64bit, ppc64 for instance.
+		[[ -f "${ED}"/usr/lib/libperf-gtk.so ]] && libdir="lib"
+		mv "${ED}"/usr/${libdir}/libperf-gtk.so \
+			"${ED}"/usr/libexec/perf-core || die
+	fi
+
+	dodoc CREDITS
+
+	dodoc *txt Documentation/*.txt
+
+	# perf needs this decompressed to print out tips for users
+	docompress -x /usr/share/doc/${PF}/tips.txt
+
+	if use doc ; then
+		doman Documentation/*.1
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
index d0f6d0b4bd9..bbab6a8af1f 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/cmake.eclass
@@ -126,7 +126,6 @@ fi
 # the ebuild. Helps in improving QA of build systems that write to source tree.
 
 # @ECLASS_VARIABLE: CMAKE_SKIP_TESTS
-# @USER_VARIABLE
 # @DEFAULT_UNSET
 # @DESCRIPTION:
 # Array of tests that should be skipped when running CTest.
diff --git a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
index 91de144e111..56afcdc5bcb 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/distutils-r1.eclass
@@ -1461,12 +1461,6 @@ distutils_pep517_install() {
 	[[ -n ${wheel} ]] || die "No wheel name returned"
 
 	distutils_wheel_install "${root}" "${WHEEL_BUILD_DIR}/${wheel}"
-
-	# clean the build tree; otherwise we may end up with PyPy3
-	# extensions duplicated into CPython dists
-	if [[ ${DISTUTILS_USE_PEP517:-setuptools} == setuptools ]]; then
-		rm -rf build || die
-	fi
 }
 
 # @FUNCTION: distutils-r1_python_compile
@@ -1478,9 +1472,6 @@ distutils_pep517_install() {
 #
 # If DISTUTILS_USE_PEP517 is set to any other value, builds a wheel
 # using the PEP517 backend and installs it into ${BUILD_DIR}/install.
-# May additionally call build_ext prior to that when using setuptools
-# and the eclass detects a potential benefit from parallel extension
-# builds.
 #
 # In legacy mode, runs 'esetup.py build'. Any parameters passed to this
 # function will be appended to setup.py invocation, i.e. passed
@@ -1495,40 +1486,21 @@ distutils-r1_python_compile() {
 			# call setup.py build when using setuptools (either via PEP517
 			# or in legacy mode)
 
-			if [[ ${DISTUTILS_USE_PEP517} ]]; then
-				if [[ -d build ]]; then
-					eqawarn "A 'build' directory exists already.  Artifacts from this directory may"
-					eqawarn "be picked up by setuptools when building for another interpreter."
-					eqawarn "Please remove this directory prior to building."
-				fi
-			else
-				_distutils-r1_copy_egg_info
-			fi
-
 			# distutils is parallel-capable since py3.5
 			local jobs=$(makeopts_jobs "${MAKEOPTS} ${*}")
 
 			if [[ ${DISTUTILS_USE_PEP517} ]]; then
-				# issue build_ext only if it looks like we have at least
-				# two source files to build; setuptools is expensive
-				# to start and parallel builds can only benefit us if we're
-				# compiling at least two files
-				#
-				# see extension.py for list of suffixes
-				# .pyx is added for Cython
-				#
-				# esetup.py does not respect SYSROOT, so skip it there
-				if [[ -z ${SYSROOT} && ${DISTUTILS_EXT} && 1 -ne ${jobs}
-					&& 2 -eq $(
-						find '(' -name '*.c' -o -name '*.cc' -o -name '*.cpp' \
-							-o -name '*.cxx' -o -name '*.c++' -o -name '*.m' \
-							-o -name '*.mm' -o -name '*.pyx' ')' -printf '\n' |
-							head -n 2 | wc -l
-					)
-				]]; then
-					esetup.py build_ext -j "${jobs}" "${@}"
-				fi
+				mkdir -p "${BUILD_DIR}" || die
+				local -x DIST_EXTRA_CONFIG="${BUILD_DIR}/extra-setup.cfg"
+				cat > "${DIST_EXTRA_CONFIG}" <<-EOF || die
+					[build]
+					build_base = ${BUILD_DIR}/build
+
+					[build_ext]
+					parallel = ${jobs}
+				EOF
 			else
+				_distutils-r1_copy_egg_info
 				esetup.py build -j "${jobs}" "${@}"
 			fi
 			;;
diff --git a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
index 463d364caee..92e02e3085b 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/java-utils-2.eclass
@@ -577,7 +577,7 @@ java-pkg_regso() {
 			java-pkg_append_ JAVA_PKG_LIBRARY "/${target_dir#${D}}"
 		# Check the path of the lib relative to ${D}
 		elif [[ -e "${D}${lib}" ]]; then
-			target_dir="$(java-pkg_expand_dir_ ${D}${lib})"
+			target_dir="$(java-pkg_expand_dir_ "${D}${lib}")"
 			java-pkg_append_ JAVA_PKG_LIBRARY "${target_dir}"
 		else
 			die "${lib} does not exist"
@@ -924,7 +924,7 @@ java-pkg_recordjavadoc()
 	debug-print-function ${FUNCNAME} $*
 	# the find statement is important
 	# as some packages include multiple trees of javadoc
-	JAVADOC_PATH="$(find ${D}/usr/share/doc/ -name allclasses-frame.html -printf '%h:')"
+	JAVADOC_PATH="$(find "${D}"/usr/share/doc/ -name allclasses-frame.html -printf '%h:')"
 	# remove $D - TODO: check this is ok with all cases of the above
 	JAVADOC_PATH="${JAVADOC_PATH//${D}}"
 	if [[ -n "${JAVADOC_PATH}" ]] ; then
@@ -2390,7 +2390,7 @@ java-pkg_init-compiler_() {
 
 }
 
-# @FUNCTION: init_paths_
+# @FUNCTION: java-pkg_init_paths_
 # @INTERNAL
 # @DESCRIPTION:
 # Initializes some variables that will be used. These variables are mostly used
diff --git a/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass b/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
index 7b77b64de90..8bab2b482cf 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/kernel-2.eclass
@@ -877,7 +877,7 @@ install_sources() {
 	dodir /usr/src
 	einfo ">>> Copying sources ..."
 
-	file="$(find ${WORKDIR} -iname "docs" -type d)"
+	file="$(find "${WORKDIR}" -iname "docs" -type d)"
 	if [[ -n ${file} ]]; then
 		for file in $(find ${file} -type f); do
 			echo "${file//*docs\/}" >> "${S}"/patches.txt
diff --git a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
index f9c6d161d3f..50aeabae1c1 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/python-utils-r1.eclass
@@ -346,24 +346,22 @@ _python_export() {
 			PYTHON_SITEDIR)
 				[[ -n ${PYTHON} ]] || die "PYTHON needs to be set for ${var} to be exported, or requested before it"
 				PYTHON_SITEDIR=$(
-					"${PYTHON}" - <<-EOF || die
-						import sysconfig
-						print(sysconfig.get_path("purelib"))
+					"${PYTHON}" - "${EPREFIX}/usr" <<-EOF || die
+						import sys, sysconfig
+						print(sysconfig.get_path("purelib", vars={"base": sys.argv[1]}))
 					EOF
 				)
-				PYTHON_SITEDIR=${EPREFIX}${PYTHON_SITEDIR#"${BROOT-${EPREFIX}}"}
 				export PYTHON_SITEDIR
 				debug-print "${FUNCNAME}: PYTHON_SITEDIR = ${PYTHON_SITEDIR}"
 				;;
 			PYTHON_INCLUDEDIR)
 				[[ -n ${PYTHON} ]] || die "PYTHON needs to be set for ${var} to be exported, or requested before it"
 				PYTHON_INCLUDEDIR=$(
-					"${PYTHON}" - <<-EOF || die
-						import sysconfig
-						print(sysconfig.get_path("platinclude"))
+					"${PYTHON}" - "${ESYSROOT}/usr" <<-EOF || die
+						import sys, sysconfig
+						print(sysconfig.get_path("platinclude", vars={"installed_platbase": sys.argv[1]}))
 					EOF
 				)
-				PYTHON_INCLUDEDIR=${ESYSROOT}${PYTHON_INCLUDEDIR#"${BROOT-${EPREFIX}}"}
 				export PYTHON_INCLUDEDIR
 				debug-print "${FUNCNAME}: PYTHON_INCLUDEDIR = ${PYTHON_INCLUDEDIR}"
 
@@ -1244,10 +1242,6 @@ _python_check_EPYTHON() {
 _python_check_occluded_packages() {
 	debug-print-function ${FUNCNAME} "${@}"
 
-	# DO NOT ENABLE THIS unless you're going to check for false
-	# positives before filing bugs.
-	[[ ! ${PYTHON_EXPERIMENTAL_QA} ]] && return
-
 	[[ -z ${BUILD_DIR} || ! -d ${BUILD_DIR}/install ]] && return
 
 	local sitedir="${BUILD_DIR}/install$(python_get_sitedir)"
diff --git a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
index 6a88676b750..d93068619cf 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/toolchain.eclass
@@ -2244,7 +2244,9 @@ should_we_gcc_config() {
 
 	local curr_branch_ver=$(ver_cut 1-2 ${curr_config_ver})
 
-	if [[ ${curr_branch_ver} == ${GCC_BRANCH_VER} ]] ; then
+	if tc_use_major_version_only && [[ ${curr_config_ver} == ${GCCMAJOR} ]] ; then
+		return 0
+	elif ! tc_use_major_version_only && [[ ${curr_branch_ver} == ${GCC_BRANCH_VER} ]] ; then
 		return 0
 	else
 		# If we're installing a genuinely different compiler version,
diff --git a/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass b/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
index d99dc346185..bb847bb80cc 100644
--- a/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
+++ b/sdk_container/src/third_party/portage-stable/eclass/verify-sig.eclass
@@ -55,17 +55,22 @@ IUSE="verify-sig"
 # @DESCRIPTION:
 # Signature verification method to use.  The allowed value are:
 #
-# - openpgp -- verify PGP signatures using app-crypt/gnupg (the default)
-# - signify -- verify signatures with Ed25519 public key using app-crypt/signify
+#  - minisig -- verify signatures with (base64) Ed25519 public key using app-crypt/minisign
+#  - openpgp -- verify PGP signatures using app-crypt/gnupg (the default)
+#  - signify -- verify signatures with Ed25519 public key using app-crypt/signify
 : "${VERIFY_SIG_METHOD:=openpgp}"
 
 case ${VERIFY_SIG_METHOD} in
+	minisig)
+		BDEPEND="verify-sig? ( app-crypt/minisign )"
+		;;
 	openpgp)
 		BDEPEND="
 			verify-sig? (
 				app-crypt/gnupg
 				>=app-portage/gemato-16
-			)"
+			)
+		"
 		;;
 	signify)
 		BDEPEND="verify-sig? ( app-crypt/signify )"
@@ -139,6 +144,10 @@ verify-sig_verify_detached() {
 	[[ ${file} == - ]] && filename='(stdin)'
 	einfo "Verifying ${filename} ..."
 	case ${VERIFY_SIG_METHOD} in
+		minisig)
+			minisign -V -P "$(<"${key}")" -x "${sig}" -m "${file}" ||
+				die "minisig signature verification failed"
+			;;
 		openpgp)
 			# gpg can't handle very long TMPDIR
 			# https://bugs.gentoo.org/854492
@@ -198,6 +207,10 @@ verify-sig_verify_message() {
 	[[ ${file} == - ]] && filename='(stdin)'
 	einfo "Verifying ${filename} ..."
 	case ${VERIFY_SIG_METHOD} in
+		minisig)
+			minisign -V -P "$(<"${key}")" -x "${sig}" -o "${output_file}" -m "${file}" ||
+				die "minisig signature verification failed"
+			;;
 		openpgp)
 			# gpg can't handle very long TMPDIR
 			# https://bugs.gentoo.org/854492
@@ -214,12 +227,15 @@ verify-sig_verify_message() {
 }
 
 # @FUNCTION: verify-sig_verify_unsigned_checksums
-# @USAGE: <checksum-file> <algo> <files>
+# @USAGE: <checksum-file> <format> <files>
 # @DESCRIPTION:
 # Verify the checksums for all files listed in the space-separated list
-# <files> (akin to ${A}) using a <checksum-file>.  <algo> specifies
-# the checksum algorithm (e.g. sha256).  <checksum-file> can be "-"
-# for stdin.
+# <files> (akin to ${A}) using a <checksum-file>.  <format> specifies
+# the checksum file format.  <checksum-file> can be "-" for stdin.
+#
+# The following formats are supported:
+#  - sha256 -- sha256sum (<hash> <filename>)
+#  - openssl-dgst -- openssl dgst (<algo>(<filename>)=<hash>)
 #
 # The function dies if one of the files does not match checksums or
 # is missing from the checksum file.
@@ -231,36 +247,52 @@ verify-sig_verify_message() {
 # verify-sig_verify_signed_checksums instead.
 verify-sig_verify_unsigned_checksums() {
 	local checksum_file=${1}
-	local algo=${2}
+	local format=${2}
 	local files=()
 	read -r -d '' -a files <<<"${3}"
-	local chksum_prog chksum_len
+	local chksum_prog chksum_len algo=${format}
 
-	case ${algo} in
+	case ${format} in
 		sha256)
-			chksum_prog=sha256sum
 			chksum_len=64
 			;;
+		openssl-dgst)
+			;;
 		*)
-			die "${FUNCNAME}: unknown checksum algo ${algo}"
+			die "${FUNCNAME}: unknown checksum format ${format}"
 			;;
 	esac
 
 	[[ ${checksum_file} == - ]] && checksum_file=/dev/stdin
-	local checksum filename junk ret=0 count=0
-	while read -r checksum filename junk; do
-		if [[ ${checksum} == "-----BEGIN" ]]; then
+	local line checksum filename junk ret=0 count=0
+	local -A verified
+	while read -r line; do
+		if [[ ${line} == "-----BEGIN"* ]]; then
 			die "${FUNCNAME}: PGP armor found, use verify-sig_verify_signed_checksums instead"
 		fi
 
-		[[ ${#checksum} -eq ${chksum_len} ]] || continue
-		[[ -z ${checksum//[0-9a-f]} ]] || continue
-		has "${filename}" "${files[@]}" || continue
-		[[ -z ${junk} ]] || continue
+		case ${format} in
+			sha256)
+				read -r checksum filename junk <<<"${line}"
+				[[ ${#checksum} -ne ${chksum_len} ]] && continue
+				[[ -n ${checksum//[0-9a-f]} ]] && continue
+				[[ -n ${junk} ]] && continue
+				;;
+			openssl-dgst)
+				[[ ${line} != *"("*")="* ]] && continue
+				checksum=${line##*)=}
+				algo=${line%%(*}
+				filename=${line#*(}
+				filename=${filename%)=*}
+				;;
+		esac
+
+		if ! has "${filename}" "${files[@]}"; then
+			continue
+		fi
 
-		"${chksum_prog}" -c --strict - <<<"${checksum} ${filename}"
-		if [[ ${?} -eq 0 ]]; then
-			(( count++ ))
+		if "${algo,,}sum" -c --strict - <<<"${checksum} ${filename}"; then
+			verified["${filename}"]=1
 		else
 			ret=1
 		fi
@@ -268,7 +300,7 @@ verify-sig_verify_unsigned_checksums() {
 
 	[[ ${ret} -eq 0 ]] ||
 		die "${FUNCNAME}: at least one file did not verify successfully"
-	[[ ${count} -eq ${#files[@]} ]] ||
+	[[ ${#verified[@]} -eq ${#files[@]} ]] ||
 		die "${FUNCNAME}: checksums for some of the specified files were missing"
 }
 
@@ -337,7 +369,7 @@ verify-sig_src_unpack() {
 		# find all distfiles and signatures, and combine them
 		for f in ${A}; do
 			found=
-			for suffix in .asc .sig; do
+			for suffix in .asc .sig .minisig; do
 				if [[ ${f} == *${suffix} ]]; then
 					signatures+=( "${f}" )
 					found=sig
diff --git a/sdk_container/src/third_party/portage-stable/licenses/Ookla b/sdk_container/src/third_party/portage-stable/licenses/Ookla
new file mode 100644
index 00000000000..60127ca0c1d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/licenses/Ookla
@@ -0,0 +1,117 @@
+EULA
+
+This End User License Agreement ("Agreement") is a binding agreement between you ("End User" or "you")
+and Ookla, LLC ("Ookla"). This Agreement governs your use of the Speedtest Software,
+(including all related documentation, the "Software"). The Software is licensed, not sold, to you.
+
+Your use of this Software is subject to the Terms of Use and Privacy Policy at at these URLs:
+https://www.speedtest.net/about/terms and https://www.speedtest.net/about/privacy.
+
+BY INSTALLING THE SOFTWARE, YOU (A) ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS AGREEMENT;
+AND (B) ACCEPT THIS AGREEMENT AND AGREE THAT YOU ARE LEGALLY BOUND BY ITS TERMS.
+IF YOU DO NOT AGREE TO THESE TERMS, DO NOT INSTALL THE SOFTWARE.
+
+IF YOU ARE ENTERING INTO THIS AGREEMENT ON BEHALF OF A COMPANY OR OTHER LEGAL ENTITY,
+YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH ENTITY AND ITS AFFILIATES TO THESE TERMS AND CONDITIONS,
+IN WHICH CASE THE TERMS "YOU" OR "YOUR" SHALL REFER TO SUCH ENTITY AND ITS AFFILIATES.
+IF YOU DO NOT HAVE SUCH AUTHORITY, OR IF YOU DO NOT AGREE WITH THESE TERMS OR CONDITIONS,
+YOU MAY NOT INSTALL OR USE THE SOFTWARE.
+
+1) Grant of License.
+Subject to the terms of this Agreement, Ookla grants you a limited, non-exclusive and non-transferable license
+to use the Software through a command line interface for your personal, non-commercial use on a single personal
+computer owned or otherwise controlled by you. The Software may contain open source software, subject to separate
+license terms made available with the Software or accompanying documentation.
+
+2) Restrictions On Use.
+You shall not:
+(a) copy the Software, except as expressly permitted herein;
+(b) modify, translate, adapt, or otherwise create derivative works or improvements, whether or not patentable, of the Software;
+(c) reverse engineer, disassemble, decompile, decode, or otherwise indirectly or directly attempt to derive or gain access to the source code of the Software or any part thereof;
+(d) remove, delete, alter, or obscure any trademarks or any copyright, trademark, patent, or other intellectual property or proprietary rights notices from the Software, including any copy thereof;
+(e) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer, or otherwise make available the Software, or any features or functionality of the Software, to any third party for any reason, including by making the Software available on a network where it is capable of being accessed by more than one device at any time; or
+(f) install or use the Software on any router, modem, or other non-personal computer device.
+
+3) Ownership.
+You agree without reservation that Ookla, its affiliates or its licensors own and retain all right, title and interest
+in and to the Software and the accompanying documentation, including without limitation, all intellectual property rights therein,
+including all copies, improvements, enhancements, derivative works and modifications thereof.
+Your rights to use the Software are limited to those expressly granted by this Agreement and Ookla reserves all rights not expressly
+granted to you herein. The grant of license herein shall not be deemed to result in the sale, transfer or any other conveyance of Ookla's
+intellectual property of whatsoever nature held or used by Ookla to you. Ookla will retain all rights in and to Ookla's intellectual property,
+including without limitation Ookla’s trademarks, the Software and documentation. By providing Ookla any feedback or ideas, suggestions,
+recommendations, modifications or improvements of the Software or documentation ("Feedback"), you grant Ookla all right, title,
+interest and ownership, including all intellectual property rights therein, to such Feedback. Ookla is free to use and incorporate
+such Feedback in Ookla’s services or technology, without payment of royalties or other consideration to you or liability of any kind.
+
+4) Updates..
+Ookla may from time to time in its sole discretion develop and provide Software updates,
+which may include upgrades, bug fixes, patches, other error corrections, and/or new features
+(collectively, including related documentation, "Updates"). Updates may also modify or delete
+in their entirety certain features and functionality. You agree that Ookla has no obligation to
+provide any Updates or to continue to provide or enable any particular features or functionality.
+
+5) Term and Termination.
+The term of Agreement commences when you install the Software and will continue in effect until
+terminated by you or Ookla as set forth herein. You may terminate this Agreement by deleting the
+Software and all copies thereof in your possession or control. Ookla may terminate this Agreement
+at any time without notice if it ceases to support the Software, which Ookla may do in its sole discretion.
+In addition, Ookla may terminate this Agreement immediately without any notice if you violate any of the
+terms and conditions of this Agreement. Upon termination all rights granted to you under this Agreement shall
+terminate and you must cease all use of the Software and delete all copies of the Software in your possession
+or control. Termination will not limit any of Ookla’s rights or remedies at law or in equity.
+
+6) Disclaimer.
+OOKLA, ITS AFFILIATES, AND ITS LICENSORS PROVIDE THE SOFTWARE AND DOCUMENTATION "AS IS" AND TO THE
+MAXIMUM EXTENT PERMITTED UNDER APPLICABLE LAW, EXPRESSLY DISCLAIM ALL WARRANTIES, WHETHER EXPRESS OR IMPLIED,
+STATUTORY, COMMON LAW, CUSTOM, USAGE, OR OTHERWISE, WITH RESPECT TO THE SOFTWARE AND DOCUMENTATION,
+INCLUDING WITHOUT LIMITATION, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
+TITLE, AND NON-INFRINGEMENT, AND WARRANTIES THAT MAY ARISE OUT OF COURSE OF DEALING, COURSE OF PERFORMANCE,
+USAGE, OR TRADE PRACTICE. WITHOUT LIMITATION TO THE FOREGOING, OOKLA PROVIDES NO WARRANTY OR UNDERTAKING,
+AND MAKES NO REPRESENTATION OF ANY KIND THAT THE SOFTWARE WILL MEET YOUR REQUIREMENTS, ACHIEVE ANY INTENDED RESULTS,
+BE COMPATIBLE, OR WORK WITH ANY OTHER SOFTWARE, APPLICATIONS, SYSTEMS, OR SERVICES, OPERATE WITHOUT INTERRUPTION,
+MEET ANY PERFORMANCE OR RELIABILITY STANDARDS, OR BE ERROR-FREE, OR THAT ANY ERRORS OR DEFECTS CAN OR WILL BE CORRECTED.
+THIS DISCLAIMER OF WARRANTY MAY NOT BE VALID IN SOME JURISDICTIONS. YOU MAY HAVE ADDITIONAL WARRANTY RIGHTS UNDER APPLICABLE
+LAW WHICH MAY NOT BE WAIVED OR DISCLAIMED. OOKLA DOES NOT SEEK TO LIMIT YOUR WARRANTY RIGHTS TO ANY EXTENT NOT PERMITTED
+BY APPLICABLE LAW.
+
+7) Limitation of Liability.
+To the fullest extent permitted by applicable law, in no event shall Ookla, its affiliates or its licensors be liable to you
+for any loss of profits, loss of use, loss or corruption of data, interruption of business, computer failure or malfunction,
+or any indirect, special, incidental, consequential, exemplary, or punitive damages arising from or related to this Agreement
+or your use or inability to use the Software or documentation. Ookla's entire liability and your exclusive remedy for any damages
+under this Agreement will be limited in any event to your direct and actual damages, not to exceed one hundred percent (100%) of
+the total compensation paid by you under this Agreement. The foregoing limitations will apply whether such damages arise out of
+breach of contract, tort (including negligence), or otherwise and regardless of whether such damages were foreseeable or Ookla
+was advised of the possibility of such damages.
+
+8) Export Regulation.
+The Software may be subject to export laws and regulations of the United States and other jurisdictions.
+You represent and warrant that: (i) you are not named on any U.S. government denied-party list;
+and (ii) the Software and documentation will not be downloaded or used in a U.S.-embargoed country or region
+or in violation of any U.S. export law or regulation.
+
+9) Severability.
+In the event that any court of competent jurisdiction determines that any provision of this Agreement is unreasonable
+or unenforceable for any reason, it is the intention of the parties that said provision be enforced to the fullest
+extent permitted by law, that the Agreement shall thereby be reformed, and that in any event the remaining provisions
+of this Agreement shall remain in full force and effect.
+
+10) Applicable Law; Venue.
+This Agreement shall be construed in accordance with and governed by the laws of the State of New York,
+without regard to its choice of law rules. The parties agree that the federal and state courts located in New York City,
+New York shall have exclusive jurisdiction to settle any dispute or claim that arises out of or in connection with this Agreement.
+Each party hereby expressly consents to the jurisdiction of such courts with respect to any such dispute, waives any objection,
+whether on the grounds of venue, residence or domicile or on the ground that the proceeding has been brought in an inconvenient forum,
+and agrees that service of process in any such proceeding may be made by hand delivery or overnight courier with proof of delivery.
+In the event of any dispute arising out of or related to the Agreement, the substantially prevailing party shall be entitled to receive
+its reasonable attorneys’ fees and costs from the other party, in addition to any other relief to which the party is entitled.
+
+11) Waiver.
+No failure or delay by either party in exercising any right, power, or remedy hereunder shall operate as a waiver thereof.
+The waiver by one party of any breach or series of breaches of any provision of this Agreement by the other party will not
+operate or be construed as a waiver of any subsequent breach by that party of that or any other provision of this Agreement.
+
+12) Complete Agreement.
+This Agreement, the Terms of Use and Privacy Policy constitute the entire agreement between the parties with respect to the Software,
+and supersede any and all prior or contemporaneous communications, representations, proposals, agreements, and understandings between the parties.
diff --git a/sdk_container/src/third_party/portage-stable/licenses/unicode b/sdk_container/src/third_party/portage-stable/licenses/unicode
index e8824d38b3a..6be34672d2e 100644
--- a/sdk_container/src/third_party/portage-stable/licenses/unicode
+++ b/sdk_container/src/third_party/portage-stable/licenses/unicode
@@ -1,184 +1,147 @@
-Unicode® Copyright and Terms of Use
+   Unicode® Copyright and Terms of Use
 
-For the general privacy policy governing access to this site, see the
-Unicode Privacy Policy
+For the general privacy policy governing access to this site, see
+the  Unicode Privacy Policy
 <http://www.unicode.org/policies/privacy_policy.html>.
 
-A. Unicode Copyright
-   1. Copyright © 1991-2023 Unicode, Inc. All rights reserved.
+A. _Unicode Copyright_
+    1. Copyright © 1991-2023 Unicode, Inc. All rights reserved.
 
-B. Definitions
+B. _Definitions_
 
-   Unicode Data Files ("DATA FILES") include all data files under the
-   directories:
+   Unicode Data Files ("DATA FILES") include all data files under the directories:
    https://www.unicode.org/Public/
    https://www.unicode.org/reports/
    https://www.unicode.org/ivd/data/
 
-   Unicode Data Files do not include PDF online code charts under the
-   directory:
+   Unicode Data Files do not include PDF online code charts under the directory:
    https://www.unicode.org/Public/
 
-   Unicode Software ("SOFTWARE") includes any source code published in
-   the Unicode Standard or any source code or compiled code under the
-   directories:
+   Unicode Software ("SOFTWARE") includes any source code published in the Unicode Standard
+   or any source code or compiled code under the directories:
    https://www.unicode.org/Public/PROGRAMS/
    https://www.unicode.org/Public/cldr/
    http://site.icu-project.org/download/
 
-C. Terms of Use
-   1. Certain documents and files on this website contain a legend
-      indicating that "Modification is permitted." Any person is hereby
-      authorized, without fee, to modify such documents and files to
-      create derivative works conforming to the Unicode® Standard,
-      subject to Terms and Conditions herein.
-   2. Any person is hereby authorized, without fee, to view, use,
-      reproduce, and distribute all documents and files, subject to the
-      Terms and Conditions herein.
-   3. Further specifications of rights and restrictions pertaining to
-      the use of the Unicode DATA FILES and SOFTWARE can be found in the
-      Unicode Data Files and Software License
-      <https://www.unicode.org/license.txt>.
-   4. Each version of the Unicode Standard has further specifications of
-      rights and restrictions of use. For the book editions (Unicode 5.0
-      and earlier), these are found on the back of the title page
-      <http://www.unicode.org/versions/Unicode5.0.0/Title.pdf>.
-   5. The Unicode PDF online code charts
-      <https://www.unicode.org/charts/> carry specific restrictions.
-      Those restrictions are incorporated as the first page of each PDF
-      code chart.
-   6. All other files, including online documentation of the core
-      specification for Unicode 6.0 and later, are covered under these
-      general Terms of Use.
-   7. No license is granted to "mirror" the Unicode website where a fee
-      is charged for access to the "mirror" site.
-   8. Modification is not permitted with respect to this document.
-      All copies of this document must be verbatim.
-
-D. Restricted Rights Legend
-   1. Any technical data or software which is licensed to the United
-      States of America, its agencies and/or instrumentalities under
-      this Agreement is commercial technical data or commercial computer
-      software developed exclusively at private expense as defined in
-      FAR 2.101, or DFARS 252.227-7014 (June 1995), as applicable. For
-      technical data, use, duplication, or disclosure by the Government
-      is subject to restrictions as set forth in DFARS 202.227-7015
-      Technical Data, Commercial and Items (Nov 1995) and this
-      Agreement. For Software, in accordance with FAR 12-212 or DFARS
-      227-7202, as applicable, use, duplication or disclosure by the
-      Government is subject to the restrictions set forth in this
-      Agreement.
-
-E. Warranties and Disclaimers
-   1. This publication and/or website may include technical or
-      typographical errors or other inaccuracies. Changes are
-      periodically added to the information herein; these changes will
-      be incorporated in new editions of the publication and/or website.
-      Unicode, Inc. may make improvements and/or changes in the
-      product(s) and/or program(s) described in this publication and/or
-      website at any time.
-   2. If this file has been purchased on magnetic or optical media from
-      Unicode, Inc. the sole and exclusive remedy for any claim will be
-      exchange of the defective media within ninety (90) days of
-      original purchase.
-   3. EXCEPT AS PROVIDED IN SECTION E.2, THIS PUBLICATION AND/OR
-      SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND EITHER
-      EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT LIMITED TO, ANY
-      WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
-      OR NON-INFRINGEMENT. UNICODE, INC. AND ITS LICENSORS ASSUME NO
-      RESPONSIBILITY FOR ERRORS OR OMISSIONS IN THIS PUBLICATION AND/OR
-      SOFTWARE OR OTHER DOCUMENTS WHICH ARE REFERENCED BY OR LINKED TO
-      THIS PUBLICATION OR THE UNICODE WEBSITE.
-
-F. Waiver of Damages
-   1. In no event shall Unicode, Inc. or its licensors be liable for any
-      special, incidental, indirect or consequential damages of any
-      kind, or any damages whatsoever, whether or not Unicode, Inc. was
-      advised of the possibility of the damage, including, without
-      limitation, those resulting from the following: loss of use, data
-      or profits, in connection with the use, modification or
-      distribution of this information or its derivatives.
-
-G. Trademarks & Logos
-   1. The Unicode Word Mark and the Unicode Logo are trademarks of
-      Unicode, Inc. “The Unicode Consortium” and “Unicode, Inc.” are
-      trade names of Unicode, Inc. Use of the information and materials
-      found on this website indicates your acknowledgement of Unicode,
-      Inc.’s exclusive worldwide rights in the Unicode Word Mark, the
-      Unicode Logo, and the Unicode trade names.
-   2. The Unicode Consortium Name and Trademark Usage Policy
-      <http://www.unicode.org/policies/logo_policy.html> (“Trademark
-      Policy”) are incorporated herein by reference and you agree to
-      abide by the provisions of the Trademark Policy, which may be
-      changed from time to time in the sole discretion of Unicode, Inc.
-   3. All third party trademarks referenced herein are the property of
-      their respective owners.
-
-H. Miscellaneous
-   1. Jurisdiction and Venue. This website is operated from a location
-      in the State of California, United States of America. Unicode,
-      Inc. makes no representation that the materials are appropriate
-      for use in other locations. If you access this website from other
-      locations, you are responsible for compliance with local laws.
-      This Agreement, all use of this website and any claims and damages
-      resulting from use of this website are governed solely by the laws
-      of the State of California without regard to any principles which
-      would apply the laws of a different jurisdiction. The user agrees
-      that any disputes regarding this website shall be resolved solely
-      in the courts located in Santa Clara County, California. The user
-      agrees said courts have personal jurisdiction and agree to waive
-      any right to transfer the dispute to any other forum.
-   2. Modification by Unicode, Inc. Unicode, Inc. shall have the right
-      to modify this Agreement at any time by posting it to this
-      website. The user may not assign any part of this Agreement
-      without Unicode, Inc.’s prior written consent.
-   3. Taxes. The user agrees to pay any taxes arising from access to
-      this website or use of the information herein, except for those
-      based on Unicode’s net income.
-   4. Severability. If any provision of this Agreement is declared
-      invalid or unenforceable, the remaining provisions of this
-      Agreement shall remain in effect.
-   5. Entire Agreement. This Agreement constitutes the entire agreement
-      between the parties.
-
-------------------------------------------------------------------------
-
-UNICODE, INC. LICENSE AGREEMENT - DATA FILES AND SOFTWARE
-
-COPYRIGHT AND PERMISSION NOTICE
-
-Copyright © 1991-2023 Unicode, Inc.
-
-NOTICE TO USER: Carefully read the following legal agreement. BY
-DOWNLOADING, INSTALLING, COPYING OR OTHERWISE USING DATA FILES, AND/OR
-SOFTWARE, YOU UNEQUIVOCALLY ACCEPT, AND AGREE TO BE BOUND BY, ALL OF THE
-TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE, DO NOT
-DOWNLOAD, INSTALL, COPY, DISTRIBUTE OR USE THE DATA FILES OR SOFTWARE.
-
-Permission is hereby granted, free of charge, to any person obtaining a
-copy of data files and any associated documentation (the "Data Files") or
-software and any associated documentation (the "Software") to deal in the
-Data Files or Software without restriction, including without limitation
-the rights to use, copy, modify, merge, publish, distribute, and/or sell
-copies of the Data Files or Software, and to permit persons to whom the
-Data Files or Software are furnished to do so, provided that either (a)
-this copyright and permission notice appear with all copies of the Data
-Files or Software, or (b) this copyright and permission notice appear in
-associated Documentation.
-
-THE DATA FILES AND SOFTWARE ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
-KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
-THIRD PARTY RIGHTS.
-
-IN NO EVENT SHALL THE COPYRIGHT HOLDER OR HOLDERS INCLUDED IN THIS NOTICE
-BE LIABLE FOR ANY CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES,
-OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
-WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
-ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE DATA
-FILES OR SOFTWARE.
-
-Except as contained in this notice, the name of a copyright holder shall
-not be used in advertising or otherwise to promote the sale, use or other
-dealings in these Data Files or Software without prior written
-authorization of the copyright holder.
+C. _Terms of Use_
+    1. Certain documents and files on this website contain a legend
+       indicating that "Modification is permitted." Any person is
+       hereby authorized, without fee, to modify such documents and
+       files to create derivative works conforming to the Unicode®
+       Standard, subject to Terms and Conditions herein.
+    2. Any person is hereby authorized, without fee, to view, use,
+       reproduce, and distribute all documents and files, subject
+       to the Terms and Conditions herein.
+    3. Further specifications of rights and restrictions pertaining
+       to the use of the Unicode DATA FILES and SOFTWARE can be
+       found in the Unicode Data Files and Software License
+       <https://www.unicode.org/license.txt>.
+    4. Each version of the Unicode Standard has further
+       specifications of rights and restrictions of use. For the
+       book editions (Unicode 5.0 and earlier), these are found on
+       the back of the title page
+       <http://www.unicode.org/versions/Unicode5.0.0/Title.pdf>.
+    5. The Unicode PDF online code charts
+       <https://www.unicode.org/charts/> carry specific
+       restrictions. Those restrictions are incorporated as the
+       first page of each PDF code chart.
+    6. All other files, including online documentation of the core
+       specification for Unicode 6.0 and later, are covered under
+       these general Terms of Use.
+    7. No license is granted to "mirror" the Unicode website where
+       a fee is charged for access to the "mirror" site.
+    8. Modification is not permitted with respect to this document.
+       All copies of this document must be verbatim.
+
+D. _Restricted Rights Legend_
+    1. Any technical data or software which is licensed to the
+       United States of America, its agencies and/or
+       instrumentalities under this Agreement is commercial
+       technical data or commercial computer software developed
+       exclusively at private expense as defined in FAR 2.101, or
+       DFARS 252.227-7014 (June 1995), as applicable. For technical
+       data, use, duplication, or disclosure by the Government is
+       subject to restrictions as set forth in DFARS 202.227-7015
+       Technical Data, Commercial and Items (Nov 1995) and this
+       Agreement. For Software, in accordance with FAR 12-212 or
+       DFARS 227-7202, as applicable, use, duplication or
+       disclosure by the Government is subject to the restrictions
+       set forth in this Agreement.
+
+E. _Warranties and Disclaimers_
+    1. This publication and/or website may include technical or
+       typographical errors or other inaccuracies. Changes are
+       periodically added to the information herein; these changes
+       will be incorporated in new editions of the publication
+       and/or website. Unicode, Inc. may make improvements and/or
+       changes in the product(s) and/or program(s) described in
+       this publication and/or website at any time.
+    2. If this file has been purchased on magnetic or optical media
+       from Unicode, Inc. the sole and exclusive remedy for any
+       claim will be exchange of the defective media within ninety
+       (90) days of original purchase.
+    3. EXCEPT AS PROVIDED IN SECTION E.2, THIS PUBLICATION AND/OR
+       SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND
+       EITHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING, BUT NOT
+       LIMITED TO, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+       PARTICULAR PURPOSE, OR NON-INFRINGEMENT. UNICODE, INC. AND
+       ITS LICENSORS ASSUME NO RESPONSIBILITY FOR ERRORS OR
+       OMISSIONS IN THIS PUBLICATION AND/OR SOFTWARE OR OTHER
+       DOCUMENTS WHICH ARE REFERENCED BY OR LINKED TO THIS
+       PUBLICATION OR THE UNICODE WEBSITE.
+
+F. _Waiver of Damages_
+    1. In no event shall Unicode, Inc. or its licensors be liable
+       for any special, incidental, indirect or consequential
+       damages of any kind, or any damages whatsoever, whether or
+       not Unicode, Inc. was advised of the possibility of the
+       damage, including, without limitation, those resulting from
+       the following: loss of use, data or profits, in connection
+       with the use, modification or distribution of this
+       information or its derivatives.
+
+G. _Trademarks & Logos_
+    1. The Unicode Word Mark and the Unicode Logo are trademarks of
+       Unicode, Inc. “The Unicode Consortium” and “Unicode, Inc.”
+       are trade names of Unicode, Inc. Use of the information and
+       materials found on this website indicates your
+       acknowledgement of Unicode, Inc.’s exclusive worldwide
+       rights in the Unicode Word Mark, the Unicode Logo, and the
+       Unicode trade names.
+    2. The Unicode Consortium Name and Trademark Usage Policy
+       <http://www.unicode.org/policies/logo_policy.html>
+       (“Trademark Policy”) are incorporated herein by reference
+       and you agree to abide by the provisions of the Trademark
+       Policy, which may be changed from time to time in the sole
+       discretion of Unicode, Inc.
+    3. All third party trademarks referenced herein are the
+       property of their respective owners.
+
+H. _Miscellaneous_
+    1. _Jurisdiction and Venue_. This website is operated from a
+       location in the State of California, United States of
+       America. Unicode, Inc. makes no representation that the
+       materials are appropriate for use in other locations. If you
+       access this website from other locations, you are
+       responsible for compliance with local laws. This Agreement,
+       all use of this website and any claims and damages resulting
+       from use of this website are governed solely by the laws of
+       the State of California without regard to any principles
+       which would apply the laws of a different jurisdiction. The
+       user agrees that any disputes regarding this website shall
+       be resolved solely in the courts located in Santa Clara
+       County, California. The user agrees said courts have
+       personal jurisdiction and agree to waive any right to
+       transfer the dispute to any other forum.
+    2. _Modification by Unicode, Inc._ Unicode, Inc. shall have the
+       right to modify this Agreement at any time by posting it to
+       this website. The user may not assign any part of this
+       Agreement without Unicode, Inc.’s prior written consent.
+    3. _Taxes._ The user agrees to pay any taxes arising from
+       access to this website or use of the information herein,
+       except for those based on Unicode’s net income.
+    4. _Severability_.  If any provision of this Agreement is
+       declared invalid or unenforceable, the remaining provisions
+       of this Agreement shall remain in effect.
+    5. _Entire Agreement_. This Agreement constitutes the entire
+       agreement between the parties. 
diff --git a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.42.ebuild b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.42.ebuild
index 7aaf1b1a1ce..96d40282bcb 100644
--- a/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.42.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-dns/bind-tools/bind-tools-9.16.42.ebuild
@@ -16,7 +16,7 @@ SRC_URI="https://downloads.isc.org/isc/bind9/${PV}/${MY_P}.tar.xz"
 
 LICENSE="Apache-2.0 BSD BSD-2 GPL-2 HPND ISC MPL-2.0"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+caps doc gssapi idn libedit readline test xml"
 # no PKCS11 currently as it requires OpenSSL to be patched, also see bug #409687
 RESTRICT="!test? ( test )"
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
index a6579538536..31344ef84f8 100644
--- a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/Manifest
@@ -1 +1,2 @@
 DIST ipset-7.17.tar.bz2 684983 BLAKE2B 43b74ab7caf5a963787184aa75b6c071388c8d28997681444b72118aba68b843e961b50418c3fa70b451b4cb090ec62940b770abac2156910442115edbf90d41 SHA512 e308a0d7707ccf7d0cb06a32cf9a822f97862e007abdbab8a91a5a0d5bfbd9f2fb9a3f5e8f36b250ec0d565438c8648a31e8e5b45d8205a76558e90f46e6e597
+DIST ipset-7.19.tar.bz2 686712 BLAKE2B 04290b94be471aedd732601e1dc147a066933606152beb76ba1a21283aa2e3f8b891fd9575db73f2af67b446fb77a0ca6b2432ae606440ac9e9bf80e41d1f640 SHA512 0f4252e6d967b0f130a2c7a0307b17c6b7d48336e86b2f838ea176f5faaa0c9bbbf273060906b43d91e9b38a9f33c18918e33d02292839a6bc321181d5d7f84e
diff --git a/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.19.ebuild b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.19.ebuild
new file mode 100644
index 00000000000..b2ba675086e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-firewall/ipset/ipset-7.19.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools bash-completion-r1 linux-info systemd
+
+DESCRIPTION="IPset tool for iptables, successor to ippool"
+HOMEPAGE="https://ipset.netfilter.org/ https://git.netfilter.org/ipset/"
+SRC_URI="https://ipset.netfilter.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+
+RDEPEND="
+	>=net-firewall/iptables-1.8.9
+	net-libs/libmnl:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( ChangeLog INSTALL README UPGRADE )
+
+# configurable from outside, e.g. /etc/portage/make.conf
+IP_NF_SET_MAX=${IP_NF_SET_MAX:-256}
+
+pkg_setup() {
+	get_version
+	CONFIG_CHECK="NETFILTER"
+	ERROR_NETFILTER="ipset requires NETFILTER support in your kernel."
+	CONFIG_CHECK+=" NETFILTER_NETLINK"
+	ERROR_NETFILTER_NETLINK="ipset requires NETFILTER_NETLINK support in your kernel."
+	# It does still build without NET_NS, but it may be needed in future.
+	#CONFIG_CHECK="${CONFIG_CHECK} NET_NS"
+	#ERROR_NET_NS="ipset requires NET_NS (network namespace) support in your kernel."
+	CONFIG_CHECK+=" !PAX_CONSTIFY_PLUGIN"
+	ERROR_PAX_CONSTIFY_PLUGIN="ipset contains constified variables (#614896)"
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	export bashcompdir="$(get_bashcompdir)"
+
+	econf \
+		--enable-bashcompl \
+		--with-kmod=no \
+		--with-maxsets=${IP_NF_SET_MAX}
+}
+
+src_install() {
+	einfo "Installing userspace"
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+
+	newinitd "${FILESDIR}"/ipset.initd-r5 ${PN}
+	newconfd "${FILESDIR}"/ipset.confd-r1 ${PN}
+	systemd_newunit "${FILESDIR}"/ipset.systemd-r1 ${PN}.service
+	keepdir /var/lib/ipset
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
index 53f120ddedb..6c37bee74e3 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/Manifest
@@ -4,3 +4,5 @@ DIST curl-8.1.2.tar.xz 2612652 BLAKE2B 66d0828912bb9971dac99025aa8b5c1c2fac1f8b5
 DIST curl-8.1.2.tar.xz.asc 488 BLAKE2B 304dbdb51aa113c0b70b2662e29b1be3294b04f5f00264ce60703756363999cd567dcd0301e27b294d1d53f16ecc016ba429fcbea240949b372750f7e6e7375a SHA512 d120299a2d59259aeb19ae0fa3a3e181e25b6927677187037c61a0901879956177ce8dda10764073a47848f81dcbbcb94e0b6008742994042b6b8fd194e169c3
 DIST curl-8.2.1.tar.xz 2631932 BLAKE2B 77c0b067935397afb3961378f2fe349fa988c6379c1ab7437c5d5f967710b2e9ba7aec91df8fe58a8b26c00c0164d4db9bd095ca27d1bf52b768c8d83cc0ecaf SHA512 3f78c9330c52d32b166f17829fc2be13418ef925e88f75aacad7f369e7afe00dc4a56566418730dbb845b2b284d721b08f639df322e2e1ef2dfab165c4189094
 DIST curl-8.2.1.tar.xz.asc 488 BLAKE2B 569a7c8d338f7175b5035fa281861b57cce7f5327ec6437d79e215e5a806619c9432d7960687e5463787f681cc408371c1eb1f0db7fb8678b8ef34ec50ef69d0 SHA512 31ee66a09e7bd14de949ae991c23a0b905d38407b73ae39bae6d01854d8708355c14bc4d0eab3ff931b85986d0236dd34e934eef6061f4b70739137fd0525084
+DIST curl-8.3.0.tar.xz 2641764 BLAKE2B 6875b20e27ed86f9b6ab256210d85e9fb3b39645e8be710b2e6fe29fba40220f870e06bc21e8a92244670fed0a08c7716e4806a267ede49c4ed6d66e03f5fcd4 SHA512 6404b4c74fe1185cb482631ca3a143996cb7298d0d8a76bfafd7696e7729c00559999a069bdba782dee3f3eb273fb678a4438cb27d3deca54022878cdff83a51
+DIST curl-8.3.0.tar.xz.asc 488 BLAKE2B ef5a749e579710d45db9f73da0cbcb58d77a9dfe73be622536496997fa792fe5cbd0331a31f01e21cbdb36c6384dca44baa647c9f3d20effabb5bfc275b1b491 SHA512 b7d45722640ac50181b20a6d663168ec6eec6691c5604ddfe9c7177f07da598cb2de688c631043dc428c311774d781ccd16bd1e2fb4f038be651e3bee383aec4
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
index 4f21364a91e..d55ecb0e531 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.0.1.ebuild
@@ -13,7 +13,7 @@ SRC_URI="
 	verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
 "
 
-LICENSE="curl"
+LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
index caa759da561..95c1c204617 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.1.2.ebuild
@@ -20,7 +20,7 @@ else
 	KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
-LICENSE="curl"
+LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
 IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
 # These select the default SSL implementation
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild
index 872fa57afa8..4a96e92e4e1 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.2.1.ebuild
@@ -17,10 +17,10 @@ else
 		https://curl.se/download/${P}.tar.xz
 		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
 	"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
-LICENSE="curl"
+LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
 IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
 # These select the default SSL implementation
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.3.0.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.3.0.ebuild
new file mode 100644
index 00000000000..2761514f73e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-8.3.0.ebuild
@@ -0,0 +1,359 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/danielstenberg.asc
+inherit autotools multilib-minimal multiprocessing prefix toolchain-funcs verify-sig
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.se/"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/curl/curl.git"
+else
+	SRC_URI="
+		https://curl.se/download/${P}.tar.xz
+		verify-sig? ( https://curl.se/download/${P}.tar.xz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="BSD curl ISC test? ( BSD-4 )"
+SLOT="0"
+IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
+# These select the default SSL implementation
+IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
+IUSE+=" nghttp3"
+RESTRICT="!test? ( test )"
+
+# Only one default ssl provider can be enabled
+# The default ssl provider needs its USE satisfied
+# nghttp3 = https://bugs.gentoo.org/912029
+REQUIRED_USE="
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_mbedtls
+			curl_ssl_openssl
+			curl_ssl_rustls
+		)
+	)
+	curl_ssl_gnutls? ( gnutls )
+	curl_ssl_mbedtls? ( mbedtls )
+	curl_ssl_openssl? ( openssl )
+	curl_ssl_rustls? ( rustls )
+	nghttp3? ( !openssl )
+"
+
+# cURL's docs and CI/CD are great resources for confirming supported versions
+# particulary for fast-moving targets like HTTP/2 and TCP/2 e.g.:
+# - https://github.com/curl/curl/blob/master/docs/HTTP3.md
+# - https://github.com/curl/curl/blob/master/.github/workflows/quiche-linux.yml
+# However 'supported' vs 'works' are two entirely different things; be sane but
+# don't be afraid to require a later version.
+
+RDEPEND="
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	adns? ( net-dns/c-ares:=[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	http2? ( >=net-libs/nghttp2-1.12.0:=[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:=[static-libs?,${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	ldap? ( net-nds/openldap:=[static-libs?,${MULTILIB_USEDEP}] )
+	nghttp3? (
+		>=net-libs/nghttp3-0.15.0[${MULTILIB_USEDEP}]
+		>=net-libs/ngtcp2-0.19.1[gnutls,ssl,-openssl,${MULTILIB_USEDEP}]
+	)
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			app-misc/ca-certificates
+			net-libs/gnutls:=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:=[${MULTILIB_USEDEP}]
+		)
+		mbedtls? (
+			app-misc/ca-certificates
+			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
+		)
+		openssl? (
+			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
+		)
+		rustls? (
+			net-libs/rustls-ffi:=[${MULTILIB_USEDEP}]
+		)
+	)
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="${RDEPEND}"
+
+BDEPEND="
+	dev-lang/perl
+	virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		http2? ( >=net-libs/nghttp2-1.15.0:=[utils,${MULTILIB_USEDEP}] )
+		nghttp3? ( net-libs/nghttp2:=[utils,${MULTILIB_USEDEP}] )
+	)
+	verify-sig? ( sec-keys/openpgp-keys-danielstenberg )
+"
+
+DOCS=( CHANGES README docs/{FEATURES.md,INTERNALS.md,FAQ,BUGS.md,CONTRIBUTE.md} )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	__builtin_available
+	closesocket
+	CloseSocket
+	getpass_r
+	ioctlsocket
+	IoctlSocket
+	mach_absolute_time
+	setmode
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-prefix.patch
+	"${FILESDIR}"/${PN}-respect-cflags-3.patch
+)
+
+src_prepare() {
+	default
+
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	if use ssl; then
+		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
+
+		if use gnutls; then
+			multilib_is_native_abi && einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls )
+		fi
+		if use mbedtls; then
+			multilib_is_native_abi && einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use openssl; then
+			multilib_is_native_abi && einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use rustls; then
+			multilib_is_native_abi && einfo "SSL provided by rustls"
+			myconf+=( --with-rustls )
+		fi
+		if use curl_ssl_gnutls; then
+			multilib_is_native_abi && einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_mbedtls; then
+			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_openssl; then
+			multilib_is_native_abi && einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_rustls; then
+			multilib_is_native_abi && einfo "Default SSL provided by rustls"
+			myconf+=( --with-default-ssl-backend=rustls )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+			die "Please file a bug, hit impossible condition w/ USE=ssl handling."
+		fi
+
+	else
+		myconf+=( --without-ssl )
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	myconf+=(
+		$(use_enable alt-svc)
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-digest-auth
+		--enable-kerberos-auth
+		--enable-negotiate-auth
+		--enable-aws
+		--enable-dict
+		--disable-ech
+		--enable-file
+		$(use_enable ftp)
+		$(use_enable gopher)
+		$(use_enable hsts)
+		--enable-http
+		$(use_enable imap)
+		$(use_enable ldap)
+		$(use_enable ldap ldaps)
+		--enable-ntlm
+		--disable-ntlm-wb
+		$(use_enable pop3)
+		--enable-rt
+		--enable-rtsp
+		$(use_enable samba smb)
+		$(use_with ssh libssh2)
+		$(use_enable smtp)
+		$(use_enable telnet)
+		$(use_enable tftp)
+		--enable-tls-srp
+		$(use_enable adns ares)
+		--enable-cookies
+		--enable-dateparse
+		--enable-dnsshuffle
+		--enable-doh
+		--enable-symbol-hiding
+		--enable-http-auth
+		--enable-ipv6
+		--enable-largefile
+		--enable-manual
+		--enable-mime
+		--enable-netrc
+		$(use_enable progress-meter)
+		--enable-proxy
+		--enable-socketpair
+		--disable-sspi
+		$(use_enable static-libs static)
+		--enable-pthreads
+		--enable-threaded-resolver
+		--disable-versioned-symbols
+		--without-amissl
+		--without-bearssl
+		$(use_with brotli)
+		--with-fish-functions-dir="${EPREFIX}"/usr/share/fish/vendor_completions.d
+		$(use_with http2 nghttp2)
+		--without-hyper
+		$(use_with idn libidn2)
+		$(use_with kerberos gssapi "${EPREFIX}"/usr)
+		--without-libgsasl
+		--without-libpsl
+		--without-msh3
+		$(use_with nghttp3)
+		$(use_with nghttp3 ngtcp2)
+		--without-quiche
+		$(use_with rtmp librtmp)
+		--without-schannel
+		--without-secure-transport
+		--without-test-caddy
+		--without-test-httpd
+		--without-test-nghttpx
+		$(use_enable websockets)
+		--without-winidn
+		--without-wolfssl
+		--with-zlib
+		$(use_with zstd)
+		--with-zsh-functions-dir="${EPREFIX}"/usr/share/zsh/site-functions
+	)
+
+	if use test && multilib_is_native_abi && ( use http2 || use nghttp3 ); then
+		myconf+=(
+			--with-test-nghttpx="${BROOT}/usr/bin/nghttpx"
+		)
+	fi
+
+	if [[ ${CHOST} == *mingw* ]] ; then
+		myconf+=(
+			--disable-pthreads
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# Avoid building the client (we just want libcurl for multilib)
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+	# Fix up the pkg-config file to be more robust.
+	# https://github.com/curl/curl/issues/864
+	local priv=() libs=()
+	# We always enable zlib.
+	libs+=( "-lz" )
+	priv+=( "zlib" )
+	if use http2; then
+		libs+=( "-lnghttp2" )
+		priv+=( "libnghttp2" )
+	fi
+	if use nghttp3; then
+		libs+=( "-lnghttp3" "-lngtcp2" )
+		priv+=( "libnghttp3" "libngtcp2" )
+	fi
+	if use ssl && use curl_ssl_openssl; then
+		libs+=( "-lssl" "-lcrypto" )
+		priv+=( "openssl" )
+	fi
+	grep -q Requires.private libcurl.pc && die "need to update ebuild"
+	libs=$(printf '|%s' "${libs[@]}")
+	sed -i -r \
+		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
+		libcurl.pc || die
+	echo "Requires.private: ${priv[*]}" >> libcurl.pc || die
+}
+
+multilib_src_compile() {
+	default
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts
+	fi
+}
+
+# There is also a pytest harness that tests for bugs in some very specific
+# situations; we can rely on upstream for this rather than adding additional test deps.
+multilib_src_test() {
+	# See https://github.com/curl/curl/blob/master/tests/runtests.pl#L5721
+	# -n: no valgrind (unreliable in sandbox and doesn't work correctly on all arches)
+	# -v: verbose
+	# -a: keep going on failure (so we see everything which breaks, not just 1st test)
+	# -k: keep test files after completion
+	# -am: automake style TAP output
+	# -p: print logs if test fails
+	# Note: if needed, we can skip specific tests. See e.g. Fedora's packaging
+	# or just read https://github.com/curl/curl/tree/master/tests#run.
+	# Note: we don't run the testsuite for cross-compilation.
+	# Upstream recommend 7*nproc as a starting point for parallel tests.
+	# The network sandbox causes tests 241 and 1083 to fail; these are typically skipped
+	# as most gentoo users don't have an 'ip6-localhost'
+	multilib_is_native_abi && emake test TFLAGS="-n -v -a -k -am -p -j$((7*$(makeopts_jobs))) !241 !1083"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi; then
+		# Shell completions
+		! tc-is-cross-compiler && emake -C scripts DESTDIR="${D}" install
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+	rm -rf "${ED}"/etc/ || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
index 044db08d02b..2761514f73e 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-misc/curl/curl-9999.ebuild
@@ -20,31 +20,31 @@ else
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
-LICENSE="curl"
+LICENSE="BSD curl ISC test? ( BSD-4 )"
 SLOT="0"
-IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls nss +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
+IUSE="+adns alt-svc brotli +ftp gnutls gopher hsts +http2 idn +imap kerberos ldap mbedtls +openssl +pop3 +progress-meter rtmp rustls samba +smtp ssh ssl sslv3 static-libs test telnet +tftp websockets zstd"
 # These select the default SSL implementation
-IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_rustls"
+IUSE+=" curl_ssl_gnutls curl_ssl_mbedtls +curl_ssl_openssl curl_ssl_rustls"
 IUSE+=" nghttp3"
 RESTRICT="!test? ( test )"
 
 # Only one default ssl provider can be enabled
 # The default ssl provider needs its USE satisfied
+# nghttp3 = https://bugs.gentoo.org/912029
 REQUIRED_USE="
 	ssl? (
 		^^ (
 			curl_ssl_gnutls
 			curl_ssl_mbedtls
-			curl_ssl_nss
 			curl_ssl_openssl
 			curl_ssl_rustls
 		)
 	)
 	curl_ssl_gnutls? ( gnutls )
 	curl_ssl_mbedtls? ( mbedtls )
-	curl_ssl_nss? ( nss )
 	curl_ssl_openssl? ( openssl )
 	curl_ssl_rustls? ( rustls )
+	nghttp3? ( !openssl )
 "
 
 # cURL's docs and CI/CD are great resources for confirming supported versions
@@ -63,8 +63,8 @@ RDEPEND="
 	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
 	ldap? ( net-nds/openldap:=[static-libs?,${MULTILIB_USEDEP}] )
 	nghttp3? (
-		>=net-libs/nghttp3-0.14.0[${MULTILIB_USEDEP}]
-		>=net-libs/ngtcp2-0.18.0[gnutls,ssl,-openssl,${MULTILIB_USEDEP}]
+		>=net-libs/nghttp3-0.15.0[${MULTILIB_USEDEP}]
+		>=net-libs/ngtcp2-0.19.1[gnutls,ssl,-openssl,${MULTILIB_USEDEP}]
 	)
 	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
 	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
@@ -78,11 +78,6 @@ RDEPEND="
 			app-misc/ca-certificates
 			net-libs/mbedtls:=[${MULTILIB_USEDEP}]
 		)
-		nss? (
-			app-misc/ca-certificates
-			dev-libs/nss[${MULTILIB_USEDEP}]
-			dev-libs/nss-pem
-		)
 		openssl? (
 			dev-libs/openssl:=[sslv3(-)=,static-libs?,${MULTILIB_USEDEP}]
 		)
@@ -147,7 +142,7 @@ multilib_src_configure() {
 
 	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
 	if use ssl; then
-		myconf+=( --without-gnutls --without-mbedtls --without-nss --without-rustls )
+		myconf+=( --without-gnutls --without-mbedtls --without-rustls )
 
 		if use gnutls; then
 			multilib_is_native_abi && einfo "SSL provided by gnutls"
@@ -157,10 +152,6 @@ multilib_src_configure() {
 			multilib_is_native_abi && einfo "SSL provided by mbedtls"
 			myconf+=( --with-mbedtls )
 		fi
-		if use nss; then
-			multilib_is_native_abi && einfo "SSL provided by nss"
-			myconf+=( --with-nss --with-nss-deprecated )
-		fi
 		if use openssl; then
 			multilib_is_native_abi && einfo "SSL provided by openssl"
 			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
@@ -175,9 +166,6 @@ multilib_src_configure() {
 		elif use curl_ssl_mbedtls; then
 			multilib_is_native_abi && einfo "Default SSL provided by mbedtls"
 			myconf+=( --with-default-ssl-backend=mbedtls )
-		elif use curl_ssl_nss; then
-			multilib_is_native_abi && einfo "Default SSL provided by nss"
-			myconf+=( --with-default-ssl-backend=nss )
 		elif use curl_ssl_openssl; then
 			multilib_is_native_abi && einfo "Default SSL provided by openssl"
 			myconf+=( --with-default-ssl-backend=openssl )
@@ -206,7 +194,12 @@ multilib_src_configure() {
 
 	myconf+=(
 		$(use_enable alt-svc)
-		--enable-crypto-auth
+		--enable-basic-auth
+		--enable-bearer-auth
+		--enable-digest-auth
+		--enable-kerberos-auth
+		--enable-negotiate-auth
+		--enable-aws
 		--enable-dict
 		--disable-ech
 		--enable-file
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
index 797d4fa655a..b4708ff13b0 100644
--- a/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/Manifest
@@ -1,3 +1,4 @@
 DIST iperf-2.0.13.tar.gz 326148 BLAKE2B 2a40aea9e2d7fdc935b91be5e4e586bf68dd27604375d2570570145e5db1ea5837469a4989f47586986932bef33cba05ed19ed3a9ce40c0a5531581c6d3ba982 SHA512 40fcfb8f4d27887f53a743ac07396511fb2a7ac59f4b300fe36896bd0241e191945fa253705990711772ee776d5e4227ed62760fc92abebdfebcedd11c27c0ea
 DIST iperf-3.13.tar.gz 648754 BLAKE2B 8b08ae0e67ed066c7dabd115b757fefff03196aa2d732b6d88e20cf82ea3a5431b9be753fcc7b331932a5e59dc3e24ff4b929a7a1af5b500704cdd5094bf6859 SHA512 067147edffa1d7482a9fc5d54638091f8bc099b9c45d9a471f4e33730463548fb2350749620f2ca3ff509cd7a9c4f63bf01f84cab36718edd8784ce7a15ca368
 DIST iperf-3.14.tar.gz 650626 BLAKE2B 3809689964721ec2f58d29985c1767bc12473f9b659fd8bd430adb00558ceda2519276dbc0df5cb9634ef96d3d98708b8413a712cdb372bd34a28a330049349f SHA512 a90fbaddd73e5b721a84cee71cefb63391c13f64107f5785e954e7c44e9a8c5072e402b6fe45434966d3cc58ac97227c608ca9719161fc23459c5e5efcf8232b
+DIST iperf-3.15.tar.gz 649330 BLAKE2B f086d506d1de8e8b333a7ad46a94279aa5b42800ded7cc6724c3400e479a6523b336c74b5956d07117a178b5f89934553535824a05daafcdb2eb8d31754680e1 SHA512 988bc558f40a16c3d94df3956705712829c1c529efd577db16213783846c84bc3edbad19a4d7890b7aba08fbc4e1c6807105df29931e9b45981066b609d87aa2
diff --git a/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.15.ebuild b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.15.ebuild
new file mode 100644
index 00000000000..e9a1b344d9d
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/net-misc/iperf/iperf-3.15.ebuild
@@ -0,0 +1,54 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools systemd
+
+DESCRIPTION="A TCP, UDP, and SCTP network bandwidth measurement tool"
+HOMEPAGE="https://github.com/esnet/iperf"
+SRC_URI="https://github.com/esnet/iperf/releases/download/${PV}/${P}.tar.gz"
+S="${WORKDIR}"/${P/_/}
+
+LICENSE="BSD"
+SLOT="3"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="sctp"
+
+DEPEND="
+	>=dev-libs/cJSON-1.7.15
+	dev-libs/openssl:=
+	sctp? ( net-misc/lksctp-tools )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( README.md RELNOTES.md )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.10.1-drop-forced-debugging-symbols.patch
+	"${FILESDIR}"/${PN}-3.12-Unbundle-cJSON.patch
+)
+
+src_prepare() {
+	default
+
+	# Drop bundled cjson
+	rm src/cjson.{c,h} || die
+
+	eautoreconf
+}
+
+src_configure() {
+	econf $(use_with sctp)
+}
+
+src_install() {
+	default
+
+	newconfd "${FILESDIR}"/iperf.confd iperf3
+	newinitd "${FILESDIR}"/iperf3.initd iperf3
+	systemd_dounit contrib/iperf3.service
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.59-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.59-r2.ebuild
index ace8b202580..c40329c153e 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.59-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.4.59-r2.ebuild
@@ -34,13 +34,12 @@ IUSE_OPTIONAL="gnutls iodbc sasl ssl odbc debug ipv6 +syslog selinux static-libs
 IUSE_CONTRIB="smbkrb5passwd kerberos kinit pbkdf2 sha2"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( berkdb )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 # always list newer first
 # Do not add any AGPL-3 BDB here!
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.14.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.14.ebuild
index 042d0617e57..0abdc8dcb98 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.14.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.14.ebuild
@@ -33,15 +33,13 @@ IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( cleartext debug sasl )
 	autoca? ( !gnutls )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.30
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild
index b55c20f3ef2..6d3babe45f1 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.5.16.ebuild
@@ -33,15 +33,13 @@ IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( cleartext debug sasl )
 	autoca? ( !gnutls )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.31
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.3-r7.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.3-r7.ebuild
index 807dbe901d7..b60d581438f 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.3-r7.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.3-r7.ebuild
@@ -33,15 +33,13 @@ IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( cleartext sasl )
 	autoca? ( !gnutls )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 # openssl is needed to generate lanman-passwords required by samba
 COMMON_DEPEND="
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r1.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r1.ebuild
index 59c0f019ab6..eb26dad73bf 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r1.ebuild
@@ -33,15 +33,13 @@ IUSE_OPTIONAL="debug gnutls iodbc ipv6 odbc sasl ssl selinux static-libs +syslog
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( cleartext sasl )
 	autoca? ( !gnutls )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.30
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r2.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r2.ebuild
index b144468124f..4ff4b2c3d6d 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.4-r2.ebuild
@@ -34,15 +34,13 @@ IUSE_OPTIONAL="debug gnutls iodbc odbc sasl ssl selinux static-libs +syslog test
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
-
-RESTRICT="!test? ( test )"
 REQUIRED_USE="cxx? ( sasl )
 	pbkdf2? ( ssl )
 	test? ( cleartext sasl )
 	autoca? ( !gnutls )
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )"
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.30
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.5.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.5.ebuild
index b8aa589bf01..e38e6c6522c 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.5.ebuild
@@ -34,7 +34,6 @@ IUSE_OPTIONAL="debug gnutls iodbc odbc sasl ssl selinux static-libs +syslog test
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
 REQUIRED_USE="
 	cxx? ( sasl )
 	pbkdf2? ( ssl )
@@ -43,6 +42,7 @@ REQUIRED_USE="
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )
 "
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.31
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild
index b8aa589bf01..e38e6c6522c 100644
--- a/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild
+++ b/sdk_container/src/third_party/portage-stable/net-nds/openldap/openldap-2.6.6.ebuild
@@ -34,7 +34,6 @@ IUSE_OPTIONAL="debug gnutls iodbc odbc sasl ssl selinux static-libs +syslog test
 IUSE_CONTRIB="kerberos kinit pbkdf2 sha2 smbkrb5passwd"
 IUSE_CONTRIB="${IUSE_CONTRIB} cxx"
 IUSE="systemd ${IUSE_DAEMON} ${IUSE_BACKEND} ${IUSE_OVERLAY} ${IUSE_OPTIONAL} ${IUSE_CONTRIB}"
-RESTRICT="!test? ( test )"
 REQUIRED_USE="
 	cxx? ( sasl )
 	pbkdf2? ( ssl )
@@ -43,6 +42,7 @@ REQUIRED_USE="
 	?? ( test minimal )
 	kerberos? ( ?? ( kinit smbkrb5passwd ) )
 "
+RESTRICT="!test? ( test )"
 
 SYSTEM_LMDB_VER=0.9.31
 # openssl is needed to generate lanman-passwords required by samba
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
index 71869f18824..6f151a40eaf 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/alpha/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-29)
 # Test failures in dev-libs/weston, although not as bad as big-endian
 # (2 at the time of this writing)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
index cd381dfdd24..2393f549e7d 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.mask
@@ -17,6 +17,14 @@
 
 #--- END OF EXAMPLES ---
 
+# Michał Górny <mgorny@gentoo.org> (2023-09-19)
+# dev-cpp/cpp-httplib is keyworded here.
+sys-devel/llvm -debuginfod
+
+# Ionen Wolkens <ionen@gentoo.org> (2023-09-13)
+# media-gfx/renderdoc is keyworded here
+dev-qt/qtbase -renderdoc
+
 # Sam James <sam@gentoo.org> (2023-09-07)
 # media-libs/roc-toolkit is not keyworded in most places
 media-video/pipewire -roc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
index cce7a202535..3db074d0c4a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been stabalized on this arch yet
+dev-db/spatialite rttopo
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-08-21)
 # Mask testing on stable until we have stable qt6
 dev-python/pytest-qt test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
index 40cc5b1b003..3e17c184e94 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.mask
@@ -69,7 +69,7 @@
 # keyworded on amd64
 -clisp
 -clozurecl64
--ecls
+-ecl
 -gcl
 -sbcl
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.stable.mask
index 2f33e3ec976..dc93eb4e00b 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/use.stable.mask
@@ -6,8 +6,6 @@
 
 # Jimi Huotari <chiitoo@gentoo.org> (2023-03-03)
 # Mask until stable.
-qt6
-pyqt6
 pyside6
 
 # Andreas Sturmlechner <asturm@gentoo.org> (2020-06-06)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
index ead16de572a..f132871a3e2 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/amd64/x32/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Maciej Barć <xgqt@gentoo.org> (2023-09-17)
+# Tests require net-libs/nodejs which is unavailable on amd64/x32.
+dev-lang/dafny test
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-07-20)
 # depends on dev-python/notebook which depends on nodejs
 dev-python/ipython notebook
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
index bde53b9837b..a3cb52acc17 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Matt Turner <mattst88@gentoo.org> (2023-05-30)
 # sys-apps/dbus-broker is not keyworded
 app-accessibility/at-spi2-core dbus-broker
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
index 6a2bdef92ca..80c7ecb833c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/arm64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Michał Górny <mgorny@gentoo.org> (2023-06-24)
 # dev-db/mongodb miraculously got keyworded here.
 dev-python/pymongo -test-full
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
index 0a83decefa7..7cbfa56e0f9 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2023-09-19)
+# dev-cpp/cpp-httplib is barely keyworded anywhere.
+sys-devel/llvm debuginfod
+
+# Ionen Wolkens <ionen@gentoo.org> (2023-09-13)
+# media-gfx/renderdoc currently has few keywords
+dev-qt/qtbase renderdoc
+
 # Sam James <sam@gentoo.org> (2023-09-07)
 # media-libs/roc-toolkit is not keyworded in most places
 media-video/pipewire roc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
index 3a6a556ad04..fea25523e4a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/base/use.mask
@@ -208,7 +208,7 @@ clisp
 clozurecl
 clozurecl64
 cmucl
-ecls
+ecl
 gcl
 sbcl
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
index 350f51f3821..fd8fa3df710 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/package.use.mask
@@ -4,6 +4,26 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Sam James <sam@gentoo.org> (2023-09-24)
+# Qt not keyworded here.
+app-doc/doxygen gui
+
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
+# Sam James <sam@gentoo.org> (2023-09-18)
+# x11-libs/gtksourceview:4 not keyworded here
+media-gfx/inkscape sourceview
+
+# Rich Freeman <rich0@gentoo.org> (2023-09-13)
+# Tests require shellcheck which is not currently available on hppa
+sys-process/systemd-cron test
+
 # Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
 # MPV currently[1] has no plans to support >=lua5-3 making luajit
 # the only choice for maintained lua. Apply mask/force to override
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
index 0e94502e8c9..589d5aca11a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.mask
@@ -7,6 +7,10 @@
 # NOTE: When masking a USE flag due to missing keywords, please file a keyword
 # request bug for the hppa arch.
 
+# Sam James <sam@gentoo.org> (2023-09-11)
+# wayland hasn't been tested on hppa
+wayland
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-17)
 # media-libs/libheif is not keyworded here
 heif
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
index 1d147f0b5dc..30b5b2df441 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/hppa/use.stable.mask
@@ -79,10 +79,6 @@ php
 # media-libs/gstreamer is not stable for hppa
 gstreamer
 
-# Rolf Eike Beer <eike@sf-mail.de> (2020-04-13)
-# No stable wayland components on hppa
-wayland
-
 # Rolf Eike Beer <eike@sf-mail.de> (2020-04-11)
 # No stable media-libs/libsdl or media-libs/libsdl2 on hppa
 sdl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
index fe7a5135e9e..9cba5f68e14 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ia64/package.use.mask
@@ -1,6 +1,26 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-24)
+# Qt not keyworded here.
+app-doc/doxygen gui
+
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
+# Rich Freeman <rich0@gentoo.org> (2023-09-13)
+# Tests require shellcheck which is not currently available
+sys-process/systemd-cron test
+
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Sam James <sam@gentoo.org> (2023-06-18)
 # Qt 5 not keyworded here
 app-text/ansifilter gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
index d628254293a..89a2e212f72 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/loong/package.use.mask
@@ -1,6 +1,25 @@
 # Copyright 2022-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# WANG Xuerui <xen0n@gentoo.org> (2023-09-24)
+# fails tests
+gnome-extra/gnome-software flatpak
+
+# WANG Xuerui <xen0n@gentoo.org> (2023-09-21)
+# dev-ruby/asciidoctor is not keyworded yet.
+dev-util/librnp man
+
+# Michał Górny <mgorny@gentoo.org> (2023-09-19)
+# dev-cpp/cpp-httplib is keyworded here.
+sys-devel/llvm -debuginfod
+
+# WANG Xuerui <xen0n@gentoo.org> (2023-09-12)
+# Vulkan is available on loong.
+dev-qt/qt3d -vulkan
+dev-qt/qtdeclarative -vulkan
+dev-qt/qtgui -vulkan
+dev-qt/qtwayland -vulkan
+
 # WANG Xuerui <xen0n@gentoo.org> (2023-09-10)
 # Revdeps of dev-python/ujson which is masked.
 dev-python/cattrs test
@@ -11,12 +30,11 @@ dev-python/ruamel-std-pathlib test
 # Avoid having to keyword more Qt deps
 dev-python/pyside2 3d datavis script location scxml
 
-# WANG Xuerui <xen0n@gentoo.org> (2023-08-05)
-# no keyworded lld
-dev-lang/rust wasm
-
 # WANG Xuerui <xen0n@gentoo.org> (2023-07-26)
-# missing llvm:16 and keyworded lld
+# no llvm:15 or lld:16 on loong
+app-office/libreoffice clang
+<dev-db/postgresql-16 llvm
+<dev-lang/rust-1.73.0 wasm
 dev-lang/spidermonkey clang lto
 
 # Ionen Wolkens <ionen@gentoo.org> (2023-07-26)
@@ -187,21 +205,6 @@ dev-lang/ocaml test
 # Dep media-plugins/libvisual-plugins fails to build, seems too hairy to fix.
 media-plugins/gst-plugins-meta libvisual
 
-# WANG Xuerui <xen0n@gentoo.org> (2022-11-27)
-# Mask configurations not accepting llvm:16 and/or clang:16, either due to
-# lack of testing or simply being unsupported upstream (the opaque pointers
-# in particular need downstream changes).
-app-office/libreoffice clang
-<dev-db/postgresql-16 llvm
-
-# WANG Xuerui <xen0n@gentoo.org> (2022-11-27)
-# LLVM toolchain now partially usable on loong, mask the remaining pieces
-# pending test/bugfixes/porting.
-#
-# - sys-devel/lld: port is still under review
-dev-util/lldb test
-sys-devel/clang-common default-lld
-
 # WANG Xuerui <xen0n@gentoo.org> (2022-10-04)
 # Sanitizers partially supported on this architecture.
 #
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/make.defaults b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/make.defaults
index 9d3d5a8a1bf..c564c464bbc 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/make.defaults
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/make.defaults
@@ -1,4 +1,4 @@
-# Copyright 2008-2021 Gentoo Authors
+# Copyright 2008-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Donnie Berkholz <dberkholz@gentoo.org> (2006-08-18)
@@ -10,8 +10,6 @@ ACCEPT_KEYWORDS="${ARCH} ~mips"
 
 PROFILE_ARCH="mips"
 
-USE="-fortran -openmp"
-
 LIBDIR_o32="lib"
 LIBDIR_n32="lib32"
 LIBDIR_n64="lib64"
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
index a8cd29a0461..e742432047e 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
 # matoro <matoro_gentoo@matoro.tk> (2023-06-18)
 # app-i18n/fcitx:4 not keyworded here
 media-libs/libsdl2 fcitx4
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
index b5a2ae4da5d..a3c7d64fe7a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/mips/use.mask
@@ -93,11 +93,6 @@ gnome
 # some programs with this useflag are useful, e.g #227631
 mpi
 
-# Ryan Hill <dirtyepic@gentoo.org>
-# virtual/blas virtual/cblas and virtual/lapack not keyworded
-lapack
-blas
-
 # Alexander Færøy <eroyf@gentoo.org>
 # Clamav -- untested, masking for now.
 clamav
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
index ebbec045f68..41111f6e8a8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/package.use.mask
@@ -1,6 +1,20 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Georgy Yakovlev <gyakovlev@gentoo.org (2023-09-21)
+# dtrace/systemtap not availabie on ppc platform for jdk
+# configure: ERROR: Unavailable JVM features explicitly enabled for 'server': 'dtrace'
+# https://github.com/openjdk/jdk17u-dev/commit/5b29c6ec93372b20016565b84d449860b7233d6c
+dev-java/openjdk:17 systemtap
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-08-30)
 # Avoid keywordming more Qt stuff
 dev-python/pyside2 3d datavis scxml
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
index 8ab7c49f60d..7a0a92b844c 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Sam James <sam@gentoo.org> (2023-09-22)
+# sys-apps/flatpak is not keyworded here
+sys-apps/xdg-desktop-portal flatpak
+
 # Matt Turner <mattst88@gentoo.org> (2023-05-30)
 # sys-apps/dbus-broker is not keyworded
 app-accessibility/at-spi2-core dbus-broker
@@ -78,10 +86,6 @@ net-misc/plowshare javascript
 # https://www.boost.org/doc/libs/1_78_0/libs/context/doc/html/context/architectures.html
 dev-libs/boost -context
 
-# Sam James <sam@gentoo.org> (2021-12-31)
-# sci-mathematics/polymake not keyworded here
-sci-mathematics/singular polymake
-
 # Sam James <sam@gentoo.org> (2021-12-08)
 # Masks involving webkit-gtk; webkit-gtk was dekeyworded on ppc for a while.
 # We haven't (yet?) restored keywords for all the bits we had to drop, so
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
index 4c5e74f34a9..53d3dbf8f24 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.mask
@@ -37,5 +37,5 @@ java
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # keyworded on ppc
 -clisp
--ecls
+-ecl
 -sbcl
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.stable.mask
index f37bb699d2a..2cedd7b5ce8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc32/use.stable.mask
@@ -37,7 +37,7 @@ aria2
 
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # no stable versions on ppc
-ecls
+ecl
 sbcl
 
 # Chí-Thanh Christopher Nguyễn (2014-03-25)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
index d3b45737525..d76d0eb3b3a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.mask
@@ -1,6 +1,10 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
 # Joonas Niilola <juippis@gentoo.org> (2023-08-24)
 # media-video/libva-utils is masked on ppc64, so hwaccel on Firefox
 # wouldn't work.
@@ -30,6 +34,10 @@ dev-python/nbval test
 # libomptarget is only supported on 64-bit architectures.
 >=sys-libs/libomp-16.0.0_pre20230124 -offload
 
+# Niccolò Belli <niccolo.belli@linuxsystems.it> (2022-11-29)
+# media-libs/webrtc-audio-processing only has amd64, x86 and ppc64 keywords
+media-video/pipewire -echo-cancel
+
 # Sam James <sam@gentoo.org> (2022-10-13)
 # Causes segfaults, bug #871921
 sci-libs/symengine tcmalloc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
index c5b63855461..e250e449283 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/powerpc/ppc64/package.use.stable.mask
@@ -17,6 +17,10 @@
 
 #--- END OF EXAMPLES ---
 
+# Niccolò Belli <niccolo.belli@linuxsystems.it> (2023-03-12)
+# media-libs/webrtc-audio-processing not stable on ppc64
+media-video/pipewire echo-cancel
+
 # Hans de Graaff <graaff@gentoo.org> (2023-03-28)
 # dev-ruby/stringex is not marked stable here yet
 dev-ruby/kramdown unicode
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
new file mode 100644
index 00000000000..ba27d13b1c6
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/ppc/package.use.mask
@@ -0,0 +1,6 @@
+# Copyright 2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Rich Freeman <rich0@gentoo.org> (2023-09-13)
+# Tests require shellcheck which is not currently available
+sys-process/systemd-cron test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
index 32f8f638313..21dba51a2a3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/riscv/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 2019-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Andrew Ammerlaan <andrewammerlaan@gentoo.org (2023-08-30)
 # Avoid keywording more Qt stuff
 dev-python/pyside2 datavis webengine
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
index 8993b33120b..f584ab79bd6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/s390/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-24)
+# Qt not keyworded here.
+app-doc/doxygen gui
+
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
 # Sam James <sam@gentoo.org> (2023-06-18)
 # Qt 5 not keyworded here
 app-text/ansifilter gui
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
index c3a164fad62..388ee4e8ca8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/package.use.mask
@@ -1,6 +1,18 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Qt 6 not keyworded here.
+dev-util/cmake gui
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-20)
+# Libei not keyworded here yet
+x11-base/xwayland libei
+
+# Rich Freeman <rich0@gentoo.org> (2023-09-13)
+# Tests require shellcheck which is not currently available
+sys-process/systemd-cron test
+
 # Sam James <sam@gentoo.org> (2023-07-21)
 # Requires app-emulation/qemu.
 sys-kernel/gentoo-kernel test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
index fefe5467531..1414ed37ec1 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.mask
@@ -66,7 +66,7 @@ physfs
 
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # keyworded on sparc
--ecls
+-ecl
 -sbcl
 
 # Alexandre Rostovtsev <tetromino@gentoo.org> (2012-12-31)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
index 868e5ba4559..ea9608db610 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/sparc/use.stable.mask
@@ -25,7 +25,7 @@ clamav
 
 # Andrey Grozin <grozin@gentoo.org> (2014-06-25)
 # no stable version on sparc
-ecls
+ecl
 sbcl
 
 # Pacho Ramos <pacho@gentoo.org> (2014-04-17)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
index 000f7361b71..5311fd5cbef 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Michał Górny <mgorny@gentoo.org> (2023-09-19)
+# dev-cpp/cpp-httplib is keyworded here.
+sys-devel/llvm -debuginfod
+
+# Jon Janzen <jon@jonjanzen.com> (2023-09-11)
+# librttopo has not been tested on this arch
+dev-db/spatialite rttopo
+
 # Matt Jolly <Matt.Jolly@footclan.ninja> (2023-08-16)
 # Fails tests, potential false negatives #911402
 app-antivirus/clamav system-mspack
@@ -57,14 +65,6 @@ net-misc/seafile-client shibboleth
 sci-mathematics/yacas gui
 sci-physics/root qt5
 
-# Michael Orlitzky <mjo@gentoo.org> (2022-12-23)
-# sci-libs/lrslib is keyworded ~x86, but probably shouldn't have been:
-#
-#   https://bugs.gentoo.org/771675
-#
-# Here we prevent its only direct consumer from pulling it in.
-sci-mathematics/polymake lrs
-
 # Michał Górny <mgorny@gentoo.org> (2022-11-16)
 # spirv-llvm-translator is not keyworded x86.
 dev-libs/libclc spirv
@@ -330,10 +330,6 @@ dev-ruby/asciidoctor test
 # dep tree that is unkeyworded at this time.
 >=net-irc/weechat-1.7 doc
 
-# Johannes Huber <johu@gentoo.org> (2017-08-07)
-# Requires media-libs/qtav, which is not keyworded on x86.
-media-gfx/digikam mediaplayer
-
 # Michał Górny <mgorny@gentoo.org> (2017-08-07)
 # Requires USE=cuda that is masked in this profile.
 media-gfx/blender opensubdiv
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
index a35e1badefb..9e2282f168a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/package.use.stable.mask
@@ -100,10 +100,6 @@ app-admin/sudo -sssd
 # Thomas Deutschmann <whissi@gentoo.org> (2018-06-01)
 net-analyzer/wireshark -doc
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2017-11-21)
-# Requires not yet stabilised media-libs/qtav
-media-gfx/digikam mediaplayer
-
 # Thomas Deutschmann <whissi@gentoo.org> (2017-10-01)
 # Stable mask dev-ruby/haml test till rails is stabilized.
 dev-ruby/haml test
diff --git a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
index bb3406faf4c..b33814159e8 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/arch/x86/use.mask
@@ -61,7 +61,7 @@ webengine
 -clisp
 -clozurecl
 -cmucl
--ecls
+-ecl
 -gcl
 -sbcl
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
index f09a97d08bf..cbe031846f3 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.mask
@@ -25,11 +25,3 @@ sys-libs/libucontext
 # made.)
 # bug #699422.
 virtual/libcrypt:0/1
-
-# Andreas K. Hüttel <dilfridge@gentoo.org> (2021-07-06)
-# No longer maintained upstream; please see the 2021-07-15-opentmpfiles-deprecation
-# news item.
-sys-apps/opentmpfiles
-
-# (above is added here instead of in ../package.mask so x86 musl can
-# override it for the moment)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
index e1cab4651ef..5fe6a08970f 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.force
@@ -1,6 +1,13 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Matt Turner <mattst88@gentoo.org> (2023-09-18)
+# Disabling gstreamer seems to be untested upstream and is often broken.
+# The gstreamer dependencies are trivial in compile time and disk usage
+# compared to webkit-gtk.
+# Bugs #911663, #914362
+>=net-libs/webkit-gtk-2.42 gstreamer
+
 # Alexey Sokolov <alexey+gentoo@asokolov.org> (2023-08-14)
 # OpenMW is only playtested with LuaJIT, and in fact unit tests fail with Lua-5.
 # Therefore apply mask/force to override the profile's defaults, and invert on
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
index 53e8e39dc64..b20c2139e40 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.mask
@@ -6,6 +6,16 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Jaco Kroon <jaco@uls.co.za> (2023-09-19)
+# Joonas Niilola <juippis@gentoo.org> (2023-09-21)
+# DAHDI is being last-rited. See bug #914477.
+net-misc/asterisk dahdi
+net-voip/yate dahdi
+
+# Matt Turner <mattst88@gentoo.org> (2023-09-14)
+# Not ported to libsoup:3.0
+app-office/abiword collab
+
 # Sam James <sam@gentoo.org> (2023-09-09)
 # Needs <dev-libs/openssl-3 which is EOL on 2023-09-11. Please upgrade immediately.
 # See bug #913685.
@@ -163,11 +173,6 @@ sci-libs/vtk debug
 # See also: https://bugs.gentoo.org/891499
 sys-libs/libomp llvm_targets_AMDGPU
 
-# Michał Górny <mgorny@gentoo.org> (2023-01-21)
-# media-libs/qtav is masked for removal.
-media-gfx/digikam mediaplayer
-media-gfx/kphotoalbum qtav
-
 # Sam James <sam@gentoo.org> (2023-01-21)
 # Fails to compile: https://github.com/libffi/libffi/issues/760
 dev-libs/libffi exec-static-trampoline
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
index ee575e800bb..c96747a9b53 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/package.use.stable.mask
@@ -164,10 +164,6 @@ media-plugins/grilo-plugins chromaprint
 # sssd is only stable for amd64 and x86
 app-admin/sudo sssd
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2018-10-16)
-# app-misc/ddcutil is not yet stable.
-kde-plasma/powerdevil brightness-control
-
 # Thomas Deutschmann <whissi@gentoo.org> (2018-06-01)
 # Needs dev-ruby/asciidoctor which has a lot of unstable deps
 net-analyzer/wireshark doc
diff --git a/sdk_container/src/third_party/portage-stable/profiles/base/use.mask b/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
index 3f27878013e..fa6cbeccc5a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/base/use.mask
@@ -4,6 +4,10 @@
 # This file is only for generic masks. For arch-specific masks (i.e.
 # mask everywhere, unmask on arch/*) use arch/base.
 
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2023-09-11)
+# eudev is masked for removal
+eudev
+
 # David Seifert <soap@gentoo.org> (2023-09-09)
 # EOL upstream in 2 months, causes major headaches for OpenSSL 1.1
 # masking. Removal on 2023-10-09.
@@ -14,10 +18,6 @@ php_targets_php8-0
 # Ruby version.
 ruby_targets_ruby30
 
-# Michael Orlitzky <mjo@gentoo.org> (2023-08-11)
-# PHP 7.x is end-of-life. Please upgrade to a newer slot.
-php_targets_php7-4
-
 # Hans de Graaff <graaff@gentoo.org> (2023-04-10)
 # Ruby 2.7 is masked for removal.
 ruby_targets_ruby27
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
index 2c00d2be45e..efa45c708ec 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/musl/package.mask
@@ -1,6 +1,14 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Maciej Barć <xgqt@gentoo.org> (2023-09-16)
+# Binary package, which is compiled against glibc
+dev-lang/dafny-bin
+
+# Maciej Barć <xgqt@gentoo.org> (2023-09-16)
+# Binary package, which is compiled against glibc
+app-shells/pwsh-bin
+
 # Maciej Barć <xgqt@gentoo.org> (2023-07-01)
 # Binary package, which is compiled against glibc
 games-util/heroic-bin
@@ -356,7 +364,6 @@ sys-apps/dbus-broker
 sys-apps/gentoo-systemd-integration
 sys-apps/systemd
 sys-apps/systemd-readahead
-sys-boot/systemd-boot
 sys-process/systemd-cron
 >=www-misc/profile-sync-daemon-6
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/standalone/profile.bashrc b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/standalone/profile.bashrc
index 8c500da8551..87a6dacd791 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/features/prefix/standalone/profile.bashrc
+++ b/sdk_container/src/third_party/portage-stable/profiles/features/prefix/standalone/profile.bashrc
@@ -20,7 +20,7 @@ elif [[ ${CATEGORY}/${PN} == sys-libs/glibc && ${EBUILD_PHASE} == configure ]];
 
     for f in libio/iopopen.c \
 		 shadow/lckpwdf.c resolv/{netdb,resolv}.h elf/rtld.c \
-		 nis/nss_compat/compat-{grp,initgroups,{,s}pwd}.c \
+		 n[is]s/nss_compat/compat-{grp,initgroups,{,s}pwd}.c \
 		 nss/{bug-erange,nss_files/files-{XXX,init{,groups}}}.c \
 		 sysdeps/{{generic,unix/sysv/linux}/paths.h,posix/system.c}
     do
diff --git a/sdk_container/src/third_party/portage-stable/profiles/license_groups b/sdk_container/src/third_party/portage-stable/profiles/license_groups
index 8b525666327..c0666978a37 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/license_groups
+++ b/sdk_container/src/third_party/portage-stable/profiles/license_groups
@@ -81,7 +81,7 @@ OSI-APPROVED @OSI-APPROVED-FREE @OSI-APPROVED-NONFREE
 
 # License agreements that try to take away your rights. These are more
 # restrictive than "all-rights-reserved" or require explicit approval.
-EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-edge Microsoft-vscode Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
+EULA 2dboy-EULA AMD-GPU-PRO-EULA android AnyDesk-TOS Aseprite-EULA baudline bestcrypt CAPYBARA-EULA Coherent-Graphics ETQW f.lux FAH-EULA-2014 Flightradar24 Gameplay-Group-EULA geekbench genymotion GIMPS GOG-EULA google-chrome Intel-SDP Introversion JoyPixels LOKI-EULA MakeMKV-EULA Microsemi microsoft-edge Microsoft-vscode Mojang MTA-0.5 NVIDIA-CUDA NVIDIA-SDK Ookla OPERA-2018 PAPERS-PLEASE PassMark-EULA PICO-8 Primate-Plunge PUEL-11 Q3AEULA-20000111 QUAKE4 RAR sfpg SPS Steam supermicro Synology teamspeak3 teamspeak5 TeamViewer THINKTANKS TIK ubiquiti ut2003 ut2003-demo Vivaldi worklog-assistant WPS-EULA zi-labone
 
 # Deprecated license labels, used by repoman and pkgcheck
 #DEPRECATED (currently none)
diff --git a/sdk_container/src/third_party/portage-stable/profiles/package.mask b/sdk_container/src/third_party/portage-stable/profiles/package.mask
index f53424b2001..8ea9d1af1b6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/package.mask
@@ -33,6 +33,115 @@
 
 #--- END OF EXAMPLES ---
 
+# Hans de Graaff <graaff@gentoo.org> (2023-09-23)
+# ruby31-only package. No reverse dependencies. Archived by
+# upstream. Last release in 2012. Removal on 2023-10-23.
+dev-ruby/kirbybase
+
+# Hans de Graaff <graaff@gentoo.org> (2023-09-23)
+# ruby31-only package. No reverse dependencies. Discontinued by
+# upstream who recommends using dev-ruby/bunny instead. Removal on
+# 2023-10-23.
+dev-ruby/amqp
+
+# Hans de Graaff <graaff@gentoo.org> (2023-09-23)
+# ruby30-only package. Upstream HOMEPAGE and SRC_URI are gone. Last
+# release at least 8 years ago. Bug #909023. Removal on 2024-10-23.
+app-dicts/prime-dict
+
+# Michał Górny <mgorny@gentoo.org> (2023-09-22)
+# =dev-python/setuptools-scm-8.0.1 broke compatibility hard but reverted
+# the changes in 8.0.2.
+~dev-python/setuptools-scm-8.0.1
+
+# Joonas Niilola <juippis@gentoo.org> (2023-09-21)
+# Enigmail's functionality has been built into Thunderbird-68, carrying over
+# all the way to 115. Enigmail hasn't been supported in TB since 91. It's
+# currently only supported on SeaMonkey, but upstream provides a pre-packed
+# extension to download for SM directly. Therefore there's not much reason to
+# package it in Gentoo, given also the current version is years behind upstream
+# releases. Bug #914486
+# Removal in ~30 days.
+x11-plugins/enigmail
+
+# Jaco Kroon <jaco@uls.co.za> (2023-09-19)
+# Joonas Niilola <juippis@gentoo.org> (2023-09-21)
+# DAHDI is not suited for a rolling-release distribution. Upstream releases new
+# versions sporadically and it may take multiple years between them. Old
+# versions are constantly broken with newer kernels, requiring heavy patching
+# downstream. Has no active maintainer in Gentoo. If you use DAHDI and have
+# some ideas how to help, please see bug #914477.
+# Removal on 2024-03-01.
+net-libs/libpri
+net-misc/dahdi
+net-misc/dahdi-tools
+net-misc/openr2
+
+# Ulrich Müller <ulm@gentoo.org> (2023-09-20)
+# Unmaintained upstream: Last release (2.92) in 2003, last commit
+# to XEmacs CVS repository in 2008. Broken with Emacs 29.
+# Masked for removal on 2023-10-20, bug #914449.
+app-emacs/crypt++
+
+# Bernard Cafarelli <voyageur@gentoo.org> (2023-09-19)
+# Only works with PHP 7, which was dropped from Gentoo
+# Upstream has no short-term plan to add PHP 8 support
+# Bug #842882, removal on 2023-10-19.
+www-apps/owncloud
+
+# Michał Górny <mgorny@gentoo.org> (2023-09-17)
+# Core API has not been maintained since 2017, and all the repositories
+# have been archived in 2019.  It remained in ::gentoo only
+# as an optional test dependency, and all reverse dependencies have been
+# updated not to depend on it.
+# Removal on 2023-10-17.  Bug #914363.
+dev-python/coreapi
+dev-python/coreschema
+dev-python/itypes
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2021-07-06, 2023-09-15)
+# No longer maintained upstream; masked everywhere for two years now.
+# Please see also the 2021-07-15-opentmpfiles-deprecation news item.
+# https://www.gentoo.org/support/news-items/2021-07-15-opentmpfiles-deprecation.html
+#
+# The replacement is sys-apps/systemd-utils[tmpfiles]; new name
+# but otherwise identical to the solution described in the news item.
+# Removal on 2023-10-15.
+sys-apps/opentmpfiles
+
+# Hans de Graaff <graaff@gentoo.org> (2023-09-15)
+# Not compatible with ruby31, no reverse dependencies. Last release in
+# 2013. Masked for removal on 2023-10-15.
+dev-ruby/ruby-elf
+
+# Andrew Ammerlaan <andrewammerlaan@gentoo.org> (2023-09-14)
+# No longer a test dependency of dev-python/textdistance, now fails tests
+# with the latest numpy. Upstream inactive and we already need patching for
+# python 3.10 compatibility. No other reverse dependencies.
+# Bug: https://bugs.gentoo.org/887845
+# Removal on 2023-10-14
+dev-python/abydos
+
+# Andreas K. Hüttel <dilfridge@gentoo.org> (2023-09-11)
+# Dead project accumulating open bugs and incompatibilities.
+#
+# For more detail, please see the '2021-08-24-eudev-retirement' news item
+# as well as the '2022-04-19-systemd-utils' news item.
+#
+# No Gentoo maintainer commits since February 2021.
+#
+# Many Gentoo packaging issues (some may need to go upstream):
+#  bug #713106, #753134, bug #667686, bug #771705, bug #668880, #770358, bug #851255
+#  bug #711462, #904741
+#
+# But more pressingly, lacks support for the udev 'tags' API which libgudev now
+# requires. No fix has been committed upstream and other software like Plymouth
+# has been broken with eudev for some time because of this missing support.
+# See bug #913702.
+#
+# Removal on 2023-10-11.
+sys-fs/eudev
+
 # Leonardo Hernández Hernández <leohdz172@proton.me> (2023-09-10)
 # Upstream has marked this packaged as unmaintained[0] and recommends usage of
 # the active fork eza[1] available as sys-apps/eza
@@ -77,11 +186,6 @@ virtual/httpd-php:8.0
 # Depends on PHP 8.0. Removal on 2023-10-09.
 ~www-apps/tt-rss-20220218
 
-# David Seifert <soap@gentoo.org> (2023-09-09)
-# Unmaintained, depends on PHP 8.0. Removal on 2023-10-09.
-www-apps/icingaweb2-module-director
-www-apps/icingaweb2-module-incubator
-
 # David Seifert <soap@gentoo.org> (2023-09-09)
 # Depends on PHP 8.0, which in turn depends on OpenSSL 1.1, which in
 # turn is to be masked and removed soon. Removal on 2023-10-09.
@@ -155,12 +259,6 @@ sci-biology/express
 # Removal on 2023-09-27.  Bug #906516.
 dev-python/pytz_deprecation_shim
 
-# Sam James <sam@gentoo.org> (2023-08-26)
-# 'AttributeError: NoneType object has no attribute cname' regression
-# See bug #913062, https://github.com/cython/cython/issues/5643, and
-# https://github.com/cython/cython/issues/5644.
-=dev-python/cython-3.0.1
-
 # Hans de Graaff <graaff@gentoo.org> (2023-08-26)
 # Obsolete slot. Use the newer shoulda slot instead.
 # Masked for removal on 2023-09-26
@@ -177,47 +275,6 @@ dev-ruby/state_machine
 # 2015. No reverse dependencies. Masked for removal on 2023-09-26.
 dev-ruby/totoridipjp
 
-# Michael Orlitzky <mjo@gentoo.org> (2023-08-23)
-# Incompatible with perl-5.38 and no fix forthcoming (bug 909570).
-# Removal sometime after 2023-09-23.
-sci-mathematics/polymake
-
-# Sam James <sam@gentoo.org> (2023-08-22)
-# Broken with new net-analyzer/net-snmp, no reverse dependencies in Gentoo,
-# no other distros package this, and upstream have discontinued development.
-# Removal on 2023-09-21.  Bug #912582.
-app-emulation/libvirt-snmp
-
-# Sam James <sam@gentoo.org> (2023-08-21)
-# Broken install.
-=net-libs/grpc-1.52.1-r1
-
-# Marek Szuba <marecki@gentoo.org> (2023-08-21)
-# Does not work with recent versions of Sphinx. In the process of being
-# phased out of the Ansible ecosystem in favour of an mkdocs-based
-# approach. No revdeps.
-# Removal on 2023-09-21. Bug #912743.
-dev-python/sphinx_ansible_theme
-
-# Michał Górny <mgorny@gentoo.org> (2023-08-20)
-# Broken for a long time.  Barely any activity upstream, does not
-# manage to follow dev-python/numpy releases.  It was only an optional
-# test dep for one package.
-# Removal on 2023-09-19.  Bug #880415.
-dev-python/nptyping
-
-# Hans de Graaff <graaff@gentoo.org> (2023-08-19)
-# ruby30-only package without any reverse dependencies. Use
-# dev-ruby/psych if you want to safely load YAML files.
-# Masked for removal on 2023-09-19
-dev-ruby/safe_yaml
-
-# Hans de Graaff <graaff@gentoo.org> (2023-08-19)
-# Ruby 3.0 is not compatible with OpenSSL 3 and consequently will be
-# masked earlier than its upstream EOL date. Please use a newer Ruby
-# version instead. Masked for removal on 2023-09-19.
-dev-lang/ruby:3.0
-
 # Sam James <sam@gentoo.org> (2023-08-18)
 # Masked for testing.
 =sys-libs/zlib-1.3-r1
@@ -227,126 +284,10 @@ dev-lang/ruby:3.0
 # Removal after 2023-10-01.  Bug #912363.
 app-dicts/edictionary
 
-# Hans de Graaff <graaff@gentoo.org> (2023-08-17)
-# The ruby project no longer maintains the elisp ruby-mode with the last
-# changed upstream 5 years ago. ruby-mode is also included in Emacs
-# itself, and this version is still maintained.
-# Masked for removal on 2023-09-17.
-app-emacs/ruby-mode
-
-# Matt Turner <mattst88@gentoo.org> (2023-08-14)
-# Dead slot depending on libsoup:2.4
-# Removal on 2023-09-14.
-net-libs/rest:0.7
-
-# Matt Turner <mattst88@gentoo.org> (2023-08-14)
-# Unmaintained in Gentoo and upstream. Last release was 2018, last commit
-# upstream was 2021. Only reverse dependency of dead net-libs/rest:0.7.
-# Removal on 2023-09-14.
-gnome-extra/synapse
-
-# Michael Orlitzky <mjo@gentoo.org> (2023-08-12)
-# More php:7.4 casualties that I missed the first time around.
-# They'll be removed whenever php:7.4 is removed.
-#
-#   * pecl-apcu_bc dead since 2019
-#   * pecl-http:7 is the old slot
-#   * pecl-ncurses dead since 2012
-#   * pecl-propro dead since 2020
-#   * pecl-taint dead in 2021
-#
-dev-php/pecl-apcu_bc
-dev-php/pecl-http:7
-dev-php/pecl-ncurses
-dev-php/pecl-propro
-dev-php/pecl-taint
-
-
-# Michael Orlitzky <mjo@gentoo.org> (2023-08-11)
-# php-7.x is End Of Life (EOL) upstream and no longer receives security
-# fixes. We lose phpunit because it depends on CodeCoverage which
-# depends on TokenStream, and TokenStream is limited to 7.x. Bug 887739
-# to upgrade moodle is seven months old, which I think is long enough to
-# have waited. Selfoss has a newer version. Removal after 2023-09-11.
-dev-lang/php:7.4
-dev-php/PHP_TokenStream
-dev-php/PHP_CodeCoverage
-dev-php/phpspec-prophecy
-dev-php/phpunit
-dev-php/phpunit-mock-objects
-dev-php/sebastian-comparator
-dev-php/sebastian-exporter
-dev-php/sebastian-global-state
-dev-php/sebastian-object-enumerator
-dev-php/sebastian-object-reflector
-dev-php/sebastian-recursion-context
-=mail-client/roundcube-1.4.11
-=virtual/httpd-php-7.4
-=www-apps/moodle-3.11.15
-=www-apps/moodle-4.0.9
-=www-apps/moodle-4.1.4
-=www-apps/moodle-4.2.1
-=www-apps/selfoss-2.19
-
-# Volkmar W. Pogatzki <gentoo@pogatzki.net> (2023-07-05)
-# Library without consumers. Bug #906882
-# Removal on 2023-08-05.
-net-libs/nativebiginteger
-
 # Sam James <sam@gentoo.org> (2023-08-04)
 # Stricter behavior which causes some packages to fail, see bug #911721.
 =dev-util/pkgconf-2.0.0
 
-# David Seifert <soap@gentoo.org> (2023-07-29)
-# EAPI 6, fetch restrictions require annoying registration, no other
-# distro packages this, over 10 years old. Removal on 2023-08-28.
-sci-libs/rosetta-db
-
-# Michael Orlitzky <mjo@gentoo.org> (2023-07-27)
-# Obsolete as of dev-php/swoole-4.3.0, according to
-# its github README. Stuck on php-7.4. Removal on or
-# after 30 days.
-dev-php/swoole-async
-
-# Mike Gilbert <floppym@gentoo.org> (2023-07-24)
-# Migrated to sys-apps/systemd-utils.
-# Removal on 2023-08-24.
-sys-apps/systemd-tmpfiles
-sys-boot/systemd-boot
-sys-fs/udev
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-24)
-# Incompatible with modern dev-python/matplotlib versions.  No upstream
-# activity since 2022-02.  No revdeps.
-# Removal on 2023-08-23.  Bug #904734.
-dev-python/tikzplotlib
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-23)
-# Package with no maintainer and tests restricted (also test deps look
-# suspicious).  It was only needed for tests
-# in dev-python/pyvirtualdisplay, and that package didn't support
-# the newest version anyway.  No revdeps left.
-# Removal on 2023-08-22.  Bug #910708.
-dev-python/vncdotool
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-21)
-# Fragile package requiring custom patching.  The maintainer resigned.
-# No reverse dependencies.
-# Removal on 2023-08-20.  Bug #910619.
-dev-python/cx_Freeze
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-21)
-# The ebuild has not been bumped for a year now.  It doesn't have
-# working tests.  No reverse dependencies.
-# Removal on 2023-08-20.  Bug #907460.
-dev-python/ansible-runner
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-19)
-# Backport package specific to Python 3.9.  No longer necessary now
-# that pypy3 is 3.10.
-# Removal on 2023-08-18.  Bug #910549.
-dev-python/importlib-resources
-
 # Mike Pagano <mpagano@gentoo.org> (2023-07-18)
 # Mask impacted kernels vulnerable to StackRot and
 # ones with a memory corruption bug
@@ -438,69 +379,13 @@ acct-group/spi
 # may or may not lead to useful results.
 <dev-util/catalyst-4
 
-# Joonas Niilola <juippis@gentoo.org> (2023-07-12)
-# Testing. An upgrade from 102 isn't recommended due to downgrading
-# most likely not being possible. Back up your profile before
-# attempting. Fresh install should be fine. Bug #910229
->=mail-client/thunderbird-115.0
-
-# Michał Górny <mgorny@gentoo.org> (2023-07-12)
-# Having scikit-build-core installed still breaks building setuptools
-# extensions in some scenarios.
-# https://github.com/scikit-build/scikit-build-core/issues/426
-=dev-python/scikit-build-core-0.4.7-r1
-
 # Matt Turner <mattst88@gentoo.org> (2023-07-06)
 # GNOME 45 mask
->=app-accessibility/orca-45_alpha
->=app-crypt/libsecret-0.21
 >=app-editors/ghex-45_alpha
->=app-editors/gnome-text-editor-45_alpha
 >=app-misc/gnote-45_alpha
->=app-misc/tracker-3.6_alpha
->=app-misc/tracker-miners-3.6_alpha
->=dev-cpp/gtkmm-4.11
->=dev-libs/gjs-1.77
->=dev-libs/glib-2.77
->=dev-libs/gobject-introspection-1.77
->=dev-libs/gobject-introspection-common-1.77
->=dev-libs/libdex-0.3.0
->=dev-libs/libportal-0.7
->=dev-util/gdbus-codegen-2.77
->=dev-util/glib-utils-2.77
->=games-puzzle/gnome-sudoku-45_alpha
->=gnome-base/gdm-45_beta
->=gnome-base/gnome-control-center-45_alpha
->=gnome-base/gnome-settings-daemon-45_alpha
->=gnome-base/gnome-shell-45_alpha
->=gnome-base/gsettings-desktop-schemas-45_alpha
->=gnome-base/nautilus-45_alpha
->=gnome-extra/gnome-boxes-45_alpha
->=gnome-extra/gnome-calculator-45_alpha
->=gnome-extra/gnome-calendar-45_alpha
->=gnome-extra/gnome-characters-45_alpha
 >=gnome-extra/gnome-logs-45_alpha
->=gnome-extra/gnome-shell-extensions-45_alpha
->=gnome-extra/gnome-software-45_alpha
->=gnome-extra/gnome-system-monitor-45_alpha
->=gnome-extra/gnome-weather-45_alpha
->=gnome-extra/sushi-45_alpha
-gnome-extra/tecla
->=gui-apps/gnome-console-45_alpha
->=gui-libs/gtk-4.11
->=gui-libs/libadwaita-1.4_alpha
->=media-gfx/eog-45_alpha
->=media-gfx/gnome-font-viewer-45_alpha
->=media-libs/libshumate-1.1_alpha
->=net-misc/gnome-connections-45_alpha
 >=net-misc/gnome-remote-desktop-45_alpha
->=sci-geosciences/gnome-maps-45_alpha
->=sys-apps/baobab-45_alpha
->=sys-apps/xdg-desktop-portal-gnome-45_alpha
 >=x11-libs/pango-1.51.0
->=x11-themes/adwaita-icon-theme-45_alpha
->=x11-themes/gnome-backgrounds-45_alpha
->=x11-wm/mutter-45_alpha
 
 # Sam James <sam@gentoo.org> (2023-07-05)
 # Doesn't install all needed files by e.g. kernelshark.
@@ -513,10 +398,6 @@ gnome-extra/tecla
 # Please upgrade to >=dev-perl/dev-perl/OLE-StorageLite-0.220.0.
 =dev-perl/OLE-StorageLite-0.210.0
 
-# Sam James <sam@gentoo.org> (2023-06-23)
-# Segfaults with non-bison yacc.
-=app-shells/bash-5.2_p15-r4
-
 # Michał Górny <mgorny@gentoo.org> (2023-06-21)
 # suitesparseconfig-7.0.0 fails to build with multilib enabled
 # because of dependencies that cannot be satisfied.  All the other
@@ -547,10 +428,6 @@ gnome-extra/tecla
 =dev-db/mariadb-10.11.2
 =dev-db/mariadb-10.11.3
 
-# Sam James <sam@gentoo.org> (2023-06-05)
-# Fails to bootstrap, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110120.
-=sys-devel/gcc-14.0.0_pre20230604
-
 # Bernd Waibel <waebbl-gentoo@posteo.net> (2023-05-31)
 # Mask this version for uptime soversion issue. There will be an updated release
 # shortly which fixes this.
@@ -558,63 +435,26 @@ gnome-extra/tecla
 # Bug: #907211
 =dev-libs/imath-3.1.7
 
-# Sam James <sam@gentoo.org> (2023-05-24)
-# Breaks building C++ consumers at least: bug #906755, bug #906879, bug #906957.
-# Please upgrade to >=0.5.1.
-=net-libs/libproxy-0.5.0
-
-# Sam James <sam@gentoo.org> (2023-05-20)
-# Various regressions, please upgrade to the latest libxml2 (>=2.11.4).
-=dev-libs/libxml2-2.11.1
-=dev-libs/libxml2-2.11.2
-=dev-libs/libxml2-2.11.2-r1
-=dev-libs/libxml2-2.11.3
-
 # Sam James <sam@gentoo.org> (2023-05-19)
 # Breaks Portage's pid-sandbox at least with 5.10 kernels. Pending investigation.
 # If you're hitting this, try: FEATURES="-pid-sandbox" emerge -v1 sys-apps/util-linux
 # as a workaround. bug #906797.
 ~sys-apps/util-linux-2.39
 
-# David Seifert <soap@gentoo.org> (2023-05-19)
-# Abandoned, NIH library only used by other obsolete packages like gkeys
-# and layman, use app-crypt/gpgme[python] as a proper upstream
-# supported gpg library. Removal on 2023-08-17.
-dev-python/pyGPG
-
 # Sam James <sam@gentoo.org> (2023-05-10)
 # Lots of package breakage as usual for new versions. Masked until most/all
 # reverse dependencies are fixed. Tracker bug is bug #906077.
 =dev-libs/libfmt-10*
 
-# Sam James <sam@gentoo.org> (2023-05-03)
-# Broken pkgconfig file, please upgrade to -r1.
-# bug #704348, bug #905632, bug #905822
-=sci-libs/metis-5.2.1
-=sci-libs/metis-5.2.1-r1
-=sci-libs/parmetis-4.0.3_p20230326
-
 # Sam James <sam@gentoo.org> (2023-05-01)
 # Breaks dev-python/scipy build. See bug #905396 and https://github.com/serge-sans-paille/gast/issues/74.
 =dev-python/pythran-0.13.0
 =dev-python/gast-0.5.4
 
-# Sam James <sam@gentoo.org> (2023-05-01)
-# Quite broken, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109672.
-=sys-devel/gcc-14.0.0_pre20230430
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2023-04-30)
 # Breaking even latest ~arch version of KDE PIM, bug #905352.
 =dev-libs/ktextaddons-1.3*
 
-# Sam James <sam@gentoo.org> (2023-04-19)
-# Last-minute libstdc++ symbol versioning magic causes e.g. mold, cmake
-# to segfault:
-# - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108969
-# - https://bugzilla.redhat.com/show_bug.cgi?id=2187768#c4
-# 13.0.1_pre20230419 was GCC 13.1 RC1. RC2 will be made when this is fixed.
-=sys-devel/gcc-13.0.1_pre20230419
-
 # Michał Górny <mgorny@gentoo.org> (2023-04-18)
 # Breaks ABI without SOVERSION bump, effectively preventing
 # xfce4-terminal from starting.
@@ -671,20 +511,11 @@ x11-drivers/nvidia-drivers:0/390
 # https://github.com/igraph/igraph/issues/2311
 =sci-libs/arpack-3.9.0
 
-# Sam James <sam@gentoo.org> (2023-03-24)
-# Please upgrade to make-4.4.1 as make-4.4 has a bunch of issues.
-=sys-devel/make-4.4
-
 # Hans de Graaff <graaff@gentoo.org> (2023-03-19)
 # This version of cucumber-core is not compatible with the other
 # cucumber dependencies. Please downgrade cucumber-core.
 =dev-util/cucumber-core-11.1.0
 
-# Sam James <sam@gentoo.org> (2023-03-16)
-# Breaks building C++ consumers. See bug #901211 and bug #901035.
-# Please upgrade to glib-2.76.0-r1.
-=dev-libs/glib-2.76.0
-
 # Mike Pagano <mpagano@gentoo.org> (2023-03-10)
 # Mask =sys-kernel/gentoo-sources-5.15.99 since it does
 # not include 5.15.99 and is misleading
@@ -699,10 +530,6 @@ x11-drivers/nvidia-drivers:0/390
 # Breaks too many revdeps for now
 =app-text/discount-3*
 
-# Georgy Yakovlev <gyakovlev@gentoo.org> (2022-12-19)
-# This version currently is not compatible with kernel build (yet)
-~dev-util/bindgen-0.63.0
-
 # Jaco Kroon <jaco@uls.co.za> (2022-11-05)
 # Some potentially breaking changes here, please check the UPGRADE.txt file.
 # Most important:  chan_sip no longer builds by default, if you've migrated to
diff --git a/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask b/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
index 359e8435b23..c67f019abf6 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/prefix/package.use.mask
@@ -30,7 +30,7 @@ net-libs/libsoup gssapi samba vala
 net-libs/glib-networking gnome libproxy
 net-misc/wget metalink uuid
 sys-apps/dbus selinux elogind systemd
-app-doc/doxygen clang doxysearch qt5
+app-doc/doxygen clang doxysearch qt5 gui
 app-text/ghostscript-gpl cups
 app-text/texlive-core cjk
 
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
index 891e53c08c9..4c5c2c567b0 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/desktop/package.use
@@ -1,6 +1,13 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
+# Sam James <sam@gentoo.org> (2023-09-22)
+# Most people aren't going to use CMake's GUI. USE=gui is enabled by default
+# on desktop profiles and CMake is unavoidable, it feels a shame to drag in
+# Qt 6 just for something people are unlikely to want. Plus, it avoids a
+# circular dependency out of the box.
+dev-util/cmake -gui -qt5
+
 # Andreas Sturmlechner <asturm@gentoo.org> (2023-07-29)
 # Required by dev-python/PyQt5[multimedia]
 dev-qt/qtmultimedia:5 widgets
@@ -47,10 +54,6 @@ app-arch/unzip natspec
 # Required by kde-frameworks/kwayland
 dev-qt/qtgui:5 egl libinput
 
-# Andreas Sturmlechner <asturm@gentoo.org> (2017-11-30)
-# Avoid circular dependency when installing from scratch
-dev-util/cmake -qt5
-
 # Andreas Sturmlechner <asturm@gentoo.org> (2017-08-04)
 # Required by flac and mp3
 kde-apps/k3b taglib
diff --git a/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask b/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
index 29d19bc587b..eb629cd341a 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
+++ b/sdk_container/src/third_party/portage-stable/profiles/targets/systemd/package.mask
@@ -1,4 +1,4 @@
-# Copyright 1999-2017 Gentoo Foundation
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 # Pacho Ramos <pacho@gentoo.org> (2015-04-21)
@@ -6,4 +6,3 @@
 # portage to not try to pull in other providers leading to
 # strange blockers.
 sys-fs/eudev
-sys-fs/udev
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2020 b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2020
index 7d48f8803ca..a70006f2dad 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2020
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/1Q-2020
@@ -1,7 +1,6 @@
 move dev-libs/range-v3 dev-cpp/range-v3
 move dev-python/neovim-python-client dev-python/pynvim
 move games-action/openastromenace games-action/astromenace
-move dev-python/matplotlib2tikz dev-python/tikzplotlib
 move dev-python/pep257 dev-python/pydocstyle
 move dev-python/pyzor mail-filter/pyzor
 move dev-python/python-sqlparse dev-python/sqlparse
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023 b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
index ce332d5bfb4..b05a6366614 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/2Q-2023
@@ -1,7 +1,6 @@
 move dev-python/jupyter_core dev-python/jupyter-core
 move dev-python/mkdocs_pymdownx_material_extras dev-python/mkdocs-pymdownx-material-extras
 move dev-python/jupyter_client dev-python/jupyter-client
-move dev-python/importlib_resources dev-python/importlib-resources
 move dev-python/importlib_metadata dev-python/importlib-metadata
 move dev-python/python-keyutils dev-python/keyutils
 move dev-python/notebook_shim dev-python/notebook-shim
@@ -30,3 +29,4 @@ move dev-python/service_identity dev-python/service-identity
 move dev-python/readme_renderer dev-python/readme-renderer
 move dev-libs/sexp dev-libs/sexpp
 move net-proxy/obfs4proxy net-proxy/lyrebird
+move dev-java/rat dev-java/apache-rat
diff --git a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023 b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
index a21ee95c627..79b5f7ba979 100644
--- a/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
+++ b/sdk_container/src/third_party/portage-stable/profiles/updates/3Q-2023
@@ -15,3 +15,5 @@ move dev-python/rapidfuzz_capi dev-python/rapidfuzz-capi
 move dev-python/line_profiler dev-python/line-profiler
 move dev-python/memory_profiler dev-python/memory-profiler
 move dev-libs/paho-mqtt-c net-libs/paho-mqtt-c
+move dev-lisp/ecls dev-lisp/ecl
+move sys-devel/ct-ng sys-devel/crosstool-ng
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.0.ebuild
index a56040b060a..2cc4e96840a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-1.7.0.ebuild
@@ -63,12 +63,14 @@ src_prepare() {
 
 src_configure() {
 	local emesonargs=(
-		-Ddefault_library=$(usex static-libs both shared)
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
 		$(meson_feature python)
 		$(meson_feature yaml)
 	)
 
+	# bug #909366
+	use static-libs && emesonargs+=( -Dstatic-build=true )
+
 	meson_src_configure
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
index ef30384edbe..c962e615762 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/dtc/dtc-9999.ebuild
@@ -58,12 +58,14 @@ src_prepare() {
 
 src_configure() {
 	local emesonargs=(
-		-Ddefault_library=$(usex static-libs both shared)
 		-Dtools=true
 		-Dvalgrind=disabled # only used for some tests
 		$(meson_feature python)
 		$(meson_feature yaml)
 	)
 
+	# bug #909366
+	use static-libs && emesonargs+=( -Dstatic-build=true )
+
 	meson_src_configure
 }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/Manifest
index a56842293ed..dc73cb4bb28 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/Manifest
@@ -4,3 +4,4 @@ DIST ethtool-6.1.tar.xz 327644 BLAKE2B 002a4edffda42520d77e8f0c27adf909090823f1a
 DIST ethtool-6.2.tar.xz 332708 BLAKE2B b3fa2571b1efef3b686eb4f20b33e6cc32bdb8cff5f2e642454ca3d41c427b1953df7b07e5ac8ef149f8b4be614210e05e593233655e5fe317c48630b20b68e8 SHA512 ff1f14c7876163bef93ca48e22a3429f09b4bcb3e1d101ef297d9f226e3fc2d3c3f19faf5b85f54cb558479e4a408ef5356a2d12e7ba132cc4cadaf92effccaf
 DIST ethtool-6.3.tar.xz 338764 BLAKE2B c06509525db47f8ee7c220d0b880fe80323a4a00036e9698432b1b9c85ad75045e98b23498f6283497728cafd187ca173b15f3ad60f8e6f8b4d0c5688d84a1f9 SHA512 85e5ecd20abf737e94ddc093f15ab0b876f763a886e3327027c448c0efcc091628c3df42070f30583551fa12f866f5b49d41fb3333acdf854a59bba671646320
 DIST ethtool-6.4.tar.xz 340844 BLAKE2B 15fbd3f2db21b7a880d040bbd5fffc51f5335d182e1d3d23dc23d2cfd3b572fabb5914426f0e8470f4374ceddb07741ed1b57d058a57867b89c1ea2a78d13c10 SHA512 5e389564b41e9494df102f9fb703ae2d80ba38346d84ec6c89b024ec21c85eca9f58e88012290feaa88d3ce035d6f779913798b0ca177e8d0a08eff197eb6afd
+DIST ethtool-6.5.tar.xz 344220 BLAKE2B 1cd79cbac563d63d81212e25df57cd5887e5284f9e4a5e73d483a3fcc1cb18dc0679d7bf53ed424f244642fc7aeda2b6cc5b11341ab28e74f5397a6bbf4130e6 SHA512 07994a20f34b1c1e72f9f855972d31d027968b53b278a5b46c5a2977be8d7152e6439c9719001101be85359876d9d932d2afb9561af9967e84d8a447a7d0c558
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.5.ebuild
new file mode 100644
index 00000000000..a7eff7664c7
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/ethtool/ethtool-6.5.ebuild
@@ -0,0 +1,21 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="Utility for examining and tuning ethernet-based network interfaces"
+HOMEPAGE="https://www.kernel.org/pub/software/network/ethtool/"
+SRC_URI="https://www.kernel.org/pub/software/network/ethtool/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="+netlink"
+
+RDEPEND="netlink? ( net-libs/libmnl )"
+DEPEND="${RDEPEND}"
+BDEPEND="app-arch/xz-utils"
+
+src_configure() {
+	econf $(use_enable netlink)
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
index d268aa0ff19..59ca225c73a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/Manifest
@@ -1,3 +1,4 @@
 DIST hwdata-0.371.tar.gz 2340297 BLAKE2B bb92b6d4f66879eacc1efae13ff1a5fe58014614c4af1906eca0489053f61d0ae2f4be777532cb6209cb2d133f8787774bc803a4d2cdf11a1014d7218bf25650 SHA512 62739cce61493f5d46a9cec5732bd4f9e0c86adec5b56cca31fa50c0d85e3a48d32f5abeaa5ca26f4ba42fc13affe4350b66a1838e958b037ddec7b30e726e86
 DIST hwdata-0.372.tar.gz 2349386 BLAKE2B 0b3c8a7d23cd999090839d046ce6228098bb4976d0be56a07b6b32bdd968e11933b0d648cf4d596ed9ca09f5b754083c62bf0aba116835de6aed72f228cacf1b SHA512 3a7fda4c1f06dff62892dd0d21095d7603a2ec16e67667215b2f59640a38845a79b2dc2a19bcc40656fd472e4216393ac08e190939ec05ef6d4af3e7e6c9141f
 DIST hwdata-0.373.tar.gz 2356072 BLAKE2B 22be63c94f1ba0fe5e31f1a19d8bf60a302bd6a2a7a15fbeaba0c3399490f86e067c5c84e1bbf5c4cc55a1ec588282d41c5ca9f3cf9e774ae559cac1b95d5812 SHA512 cb940a1cad1b7b6cef0e4bca980b0e6f0af06bf157069645645bb4403d98fbb26bbeef580c984b73091375db09e96c8b672b52d5cf27d75581ff8f0e935d8294
+DIST hwdata-0.374.tar.gz 2363130 BLAKE2B 696a0281307bb04f2aa9d946b97fdfffd918a3ee3ccc3479842779a4158e06733d128ca5feedf757fa15abb21bdc502cf3d81a775056aed17a95ddefade38df9 SHA512 c4dad796a170fb3b047ac4fe4a9fb32bc58858cdab7ca424d64e5ea00968af45d95af672a147faa2936436a904eae314b6143de2f75c0649ae9985dc4cad4301
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.374.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.374.ebuild
new file mode 100644
index 00000000000..afddd20d2fd
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/hwdata/hwdata-0.374.ebuild
@@ -0,0 +1,28 @@
+# Copyright 2022-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo
+
+DESCRIPTION="Hardware identification and configuration data"
+HOMEPAGE="https://github.com/vcrhonek/hwdata"
+SRC_URI="https://github.com/vcrhonek/hwdata/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+RESTRICT="test"
+
+src_configure() {
+	# configure is not compatible with econf
+	local conf=(
+		./configure
+		--prefix="${EPREFIX}/usr"
+		--libdir="${EPREFIX}/lib"
+		--datadir="${EPREFIX}/usr/share"
+	)
+
+	edo "${conf[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
index d4f10b35a52..8e7ab514254 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/Manifest
@@ -1,6 +1,2 @@
-DIST iproute2-5.15.0.tar.xz 858068 BLAKE2B bca20ac53e1b2b3ae06186f655ad5073a0e691ed7b3aab25c4fbc118847b72a8a522175732cd22d8ec27480d1ab142319e80a5c3628434bec21260e585e1591d SHA512 e94918fa10e523224b965c7cb5303a101745e89c90d149d2d9876a002b2a894b1c689c519dc22168f3d334c3ee0810c59ec43223baab3d5f4c56f017d6281f22
-DIST iproute2-6.0.0.tar.xz 900312 BLAKE2B 1cfb9b5a7892dec2b35e0eadbd957083e95fdc5077a1aa193329801ff25f9ed90a1fc4152756547be1fab8fe18d9a399001a4c3a61e951f64946156af6a90bae SHA512 be30362b0df6906aa786f935d5f555b8b86c747fe05314066f4180ab2f7c952ae227b7cf04c15e75d8f99ca17bafb7c8dc0fb1c18f3a9e3222d98716bb449f7a
-DIST iproute2-6.1.0.tar.xz 905512 BLAKE2B 38249703e0a9ba74405aebdb97560b286deefa959a9c3f0e0893962b6966f5da2da46199dda6a0f9584bb473f8ba529440643d97f66e9b7619df029e3091d163 SHA512 4e4d3b5e1e1a5444f42671c1e6caee072e80063e34e37386695f76f85a1ab662f4513050814006e5154426cbaadfba1d86b0be14e65978d5e670a16446047b28
-DIST iproute2-6.2.0.tar.xz 911588 BLAKE2B d3bfaecf33ffc7861e983e8db0d6a63f4767b6c01b5346e88f51c65ed6279c4be29412ed18b8f98ed54d60a84455b73fe7745142fd0fc0f3e327a29e8bcce986 SHA512 b24e0fdd0f51b8b78bc3bb681e3829af47d3011e93f3892289eb070b336709a6883728ecc7627ca37f6449720f8ed1349af321c0d04454894a7175b82f7de151
-DIST iproute2-6.3.0.tar.xz 914700 BLAKE2B a7b48c59c8a30f56ca810136f4d9f681fe38359999c260227a6229b972ce70b233d2865a6543cf3f70ed586825f9191c22d459a9fc5cc8c7dbf3ab417064c8a7 SHA512 aec1d8ceb54c8849a075ec1ce079678638e05ccaec093e8b3cbc7243b5fafea2a8c11f10930fced3df82f52d6750aa325178e44f9058e37a556ab108d4a968bf
 DIST iproute2-6.4.0.tar.xz 922164 BLAKE2B 76369d2a794afd13dba1a34ee9a7425775bb7b43c22164274749c01b18d061669aa5abd51d32a15d68f48e75f4837a887dfc28ea41e34d8e4c36b2ab865628dd SHA512 42330be6e061302694ea301765ff8d3cbfaeca4b1d06e39778861e4390ed211c03cb2d41498190202b659f7f5647b1ca4857410ef8c16fd601a35e7162788d21
+DIST iproute2-6.5.0.tar.xz 925940 BLAKE2B 537a956c2fb59df25e90d7899a981e5408c5ee029df2bb87461b899ecf8fe4424a1db5d1b1b67a67bdb2555f6cc4aaf099b0544a2c92ffc3843adc3d17defb96 SHA512 615ba6924becdf08af3f491d347d84897ff0198426d65b194c87146c4527b0856fc51688b59834abe1cb6f9a70b93c66ff7ade6b7c305c1ece0fd6a29df6bc54
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.20.0-no-ipv6.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.20.0-no-ipv6.patch
deleted file mode 100644
index 31733e99f72..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-4.20.0-no-ipv6.patch
+++ /dev/null
@@ -1,38 +0,0 @@
---- iproute2-4.20.0/ip/ipmonitor.c
-+++ iproute2-4.20.0/ip/ipmonitor.c
-@@ -118,7 +118,6 @@
- 
- 	case RTM_NEWPREFIX:
- 		print_headers(fp, "[PREFIX]", ctrl);
--		print_prefix(n, arg);
- 		return 0;
- 
- 	case RTM_NEWRULE:
---- iproute2-4.20.0/ip/iptunnel.c
-+++ iproute2-4.20.0/ip/iptunnel.c
-@@ -549,13 +549,6 @@
- 		break;
- 	case AF_INET:
- 		break;
--	/*
--	 * This is silly enough but we have no easy way to make it
--	 * protocol-independent because of unarranged structure between
--	 * IPv4 and IPv6.
--	 */
--	case AF_INET6:
--		return do_ip6tunnel(argc, argv);
- 	default:
- 		fprintf(stderr, "Unsupported protocol family: %d\n", preferred_family);
- 		exit(-1);
---- iproute2-4.20.0/ip/Makefile
-+++ iproute2-4.20.0/ip/Makefile
-@@ -1,7 +1,7 @@
- # SPDX-License-Identifier: GPL-2.0
- IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
--    rtm_map.o iptunnel.o ip6tunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
--    ipmaddr.o ipmonitor.o ipmroute.o ipprefix.o iptuntap.o iptoken.o \
-+    rtm_map.o iptunnel.o tunnel.o ipneigh.o ipntable.o iplink.o \
-+    ipmaddr.o ipmonitor.o ipmroute.o iptuntap.o iptoken.o \
-     ipxfrm.o xfrm_state.o xfrm_policy.o xfrm_monitor.o iplink_dummy.o \
-     iplink_ifb.o iplink_nlmon.o iplink_team.o iplink_vcan.o iplink_vxcan.o \
-     iplink_vlan.o link_veth.o link_gre.o iplink_can.o iplink_xdp.o \
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-5.12.0-configure-nomagic-nolibbsd.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-5.12.0-configure-nomagic-nolibbsd.patch
new file mode 100644
index 00000000000..4f88da3c20c
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-5.12.0-configure-nomagic-nolibbsd.patch
@@ -0,0 +1,242 @@
+The hand-rolled configure script, for multiple options (selinux,mnl,elf), sets
+a variable as well as modifying CFLAGS & LDLIBS.
+
+If config.mk is later amended to disable a feature, the CFLAGS/LDLIBS tweaks
+are still in place.
+
+Push the CFLAGS/LDLIBS changes into new conditional Makefile code, so that they
+are only passed when correctly needed.
+
+Prior Gentoo testcase for reproduction:
+USE=minimal ebuild ... compile.
+- Linking with libbsd, libelf, libmnl & libcap based only on presence.
+- Links based on libselinux based only on presence.
+
+Closes: https://bugs.gentoo.org/643722
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+Forward-ported from v4.14.1 to v4.16.0 by Lars Wendler <polynomial-c@gentoo.org>
+Added libcap to v4.17.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.17.0 to v4.20.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.20.0 to v5.11.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v5.11.0 to v5.12.0 by Lars Wendler <polynomial-c@gentoo.org>
+
+Update 2023-09-05: Removed libbsd enforcement from config.include for bug #911727
+by Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- iproute2-5.12.0/bridge/Makefile
++++ iproute2-5.12.0/bridge/Makefile
+@@ -2,6 +2,7 @@
+ BROBJ = bridge.o fdb.o monitor.o link.o mdb.o vlan.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ all: bridge
+ 
+--- iproute2-5.12.0/config.include
++++ iproute2-5.12.0/config.include
+@@ -0,0 +1,26 @@
++# We can only modify CFLAGS/LDLIBS after all the config options are known.
++ifeq ($(IP_CONFIG_SETNS),y)
++	CFLAGS += $(IP_CONFIG_SETNS_CFLAGS)
++endif
++ifeq ($(HAVE_ELF),y)
++	CFLAGS += $(HAVE_ELF_CFLAGS)
++	LDLIBS += $(HAVE_ELF_LDLIBS)
++endif
++ifeq ($(HAVE_SELINUX),y)
++	CFLAGS += $(HAVE_SELINUX_CFLAGS)
++	LDLIBS += $(HAVE_SELINUX_LDLIBS)
++endif
++ifeq ($(HAVE_MNL),y)
++	CFLAGS += $(HAVE_MNL_CFLAGS)
++	LDLIBS += $(HAVE_MNL_LDLIBS)
++endif
++ifeq ($(HAVE_CAP),y)
++	CFLAGS += $(HAVE_CAP_CFLAGS)
++	LDLIBS += $(HAVE_CAP_LDLIBS)
++endif
++
++# Rules can only be declared after all variables in them are known.
++%.o: %.c
++	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<
++
++# vim: ft=make:
+--- iproute2-5.12.0/configure
++++ iproute2-5.12.0/configure
+@@ -195,7 +195,7 @@
+     if $CC -I$INCLUDE -o $TMPDIR/setnstest $TMPDIR/setnstest.c >/dev/null 2>&1; then
+ 	echo "IP_CONFIG_SETNS:=y" >>$CONFIG
+ 	echo "yes"
+-	echo "CFLAGS += -DHAVE_SETNS" >>$CONFIG
++	echo "IP_CONFIG_SETNS_CFLAGS += -DHAVE_SETNS" >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -238,8 +238,8 @@
+ 	echo "HAVE_ELF:=y" >>$CONFIG
+ 	echo "yes"
+ 
+-	echo 'CFLAGS += -DHAVE_ELF' `${PKG_CONFIG} libelf --cflags` >> $CONFIG
+-	echo 'LDLIBS += ' `${PKG_CONFIG} libelf --libs` >>$CONFIG
++	echo 'HAVE_ELF_CFLAGS += -DHAVE_ELF' `${PKG_CONFIG} libelf --cflags` >> $CONFIG
++	echo 'HAVE_ELF_LDLIBS += ' `${PKG_CONFIG} libelf --libs` >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -357,8 +357,8 @@
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'LDLIBS +=' `${PKG_CONFIG} --libs libselinux` >>$CONFIG
+-		echo 'CFLAGS += -DHAVE_SELINUX' `${PKG_CONFIG} --cflags libselinux` >>$CONFIG
++		echo 'HAVE_SELINUX_CFLAGS += -DHAVE_SELINUX' `${PKG_CONFIG} --cflags libselinux` >>$CONFIG
++		echo 'HAVE_SELINUX_LDLIBS +=' `${PKG_CONFIG} --libs libselinux` >>$CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -370,8 +370,8 @@
+ 		echo "HAVE_MNL:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBMNL' `${PKG_CONFIG} libmnl --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libmnl --libs` >> $CONFIG
++		echo 'HAVE_MNL_CFLAGS += -DHAVE_LIBMNL' `${PKG_CONFIG} libmnl --cflags` >>$CONFIG
++		echo 'HAVE_MNL_LDLIBS +=' `${PKG_CONFIG} libmnl --libs` >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -411,8 +411,8 @@
+ 	echo "no"
+     else
+ 	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
++		echo 'HAVE_LIBBSD_CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
++		echo 'HAVE_LIBBSD_LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
+ 		echo "no"
+ 	else
+ 		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+@@ -428,8 +428,8 @@
+ 		echo "HAVE_CAP:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBCAP' `${PKG_CONFIG} libcap --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libcap --libs` >> $CONFIG
++		echo 'HAVE_CAP_CFLAGS += -DHAVE_LIBCAP' `${PKG_CONFIG} libcap --cflags` >>$CONFIG
++		echo 'HAVE_CAP_LDLIBS +=' `${PKG_CONFIG} libcap --libs` >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -512,7 +512,3 @@
+ 
+ echo -n "libcap support: "
+ check_cap
+-
+-echo >> $CONFIG
+-echo "%.o: %.c" >> $CONFIG
+-echo '	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<' >> $CONFIG
+--- iproute2-5.12.0/dcb/Makefile
++++ iproute2-5.12.0/dcb/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TARGETS :=
+ 
+--- iproute2-5.12.0/devlink/Makefile
++++ iproute2-5.12.0/devlink/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TARGETS :=
+ 
+--- iproute2-5.12.0/genl/Makefile
++++ iproute2-5.12.0/genl/Makefile
+@@ -2,6 +2,7 @@
+ GENLOBJ=genl.o
+ 
+ include ../config.mk
++include ../config.include
+ SHARED_LIBS ?= y
+ 
+ CFLAGS += -fno-strict-aliasing
+--- iproute2-5.12.0/ip/Makefile
++++ iproute2-5.12.0/ip/Makefile
+@@ -16,6 +16,7 @@
+ RTMONOBJ=rtmon.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ALLOBJ=$(IPOBJ) $(RTMONOBJ)
+ SCRIPTS=ifcfg rtpr routel routef
+--- iproute2-5.12.0/lib/Makefile
++++ iproute2-5.12.0/lib/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -fPIC
+ 
+--- iproute2-5.12.0/misc/Makefile
++++ iproute2-5.12.0/misc/Makefile
+@@ -5,6 +5,7 @@
+ TARGETS=ss nstat ifstat rtacct lnstat
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ifeq ($(HAVE_BERKELEY_DB),y)
+ 	TARGETS += arpd
+--- iproute2-5.12.0/netem/Makefile
++++ iproute2-5.12.0/netem/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DISTGEN = maketable normal pareto paretonormal
+ DISTDATA = normal.dist pareto.dist paretonormal.dist experimental.dist
+--- iproute2-5.12.0/rdma/Makefile
++++ iproute2-5.12.0/rdma/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
+ include ../config.mk
++include ../config.include
+ 
+ TARGETS :=
+ 
+--- iproute2-5.12.0/tc/Makefile
++++ iproute2-5.12.0/tc/Makefile
+@@ -4,6 +4,7 @@
+        emp_ematch.tab.o emp_ematch.lex.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ SHARED_LIBS ?= y
+ 
+--- iproute2-5.12.0/tipc/Makefile
++++ iproute2-5.12.0/tipc/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TARGETS :=
+ 
+--- iproute2-5.12.0/vdpa/Makefile
++++ iproute2-5.12.0/vdpa/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TARGETS :=
+ 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.1.0-strncpy-overlap.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.1.0-strncpy-overlap.patch
deleted file mode 100644
index 8b4b0abbbc7..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.1.0-strncpy-overlap.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-fix UB in strncpy (e.g. truncated ip route output)
-
-Fix overlapping buffers passed to strncpy which is UB. format_host_rta_r writes
-to the buffer passed to it, so hostname (derived from b1) & b1 partly overlap.
-
-This gets worse with sys-libs/glibc-2.37 where the ip route output can be truncated,
-but it was UB anyway and you can see it occurring w/ glibc-2.36.
-
-Bug: https://lore.kernel.org/netdev/0011AC38-4823-4D0A-8580-B108D08959C2@gentoo.org/T/#u
-Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=30112
-Thanks-to: Doug Freed <dwfreed@mtu.edu>
---- a/ip/iproute.c
-+++ b/ip/iproute.c
-@@ -753,6 +753,7 @@ int print_route(struct nlmsghdr *n, void *arg)
- 	int ret;
- 
- 	SPRINT_BUF(b1);
-+	SPRINT_BUF(b2);
- 
- 	if (n->nlmsg_type != RTM_NEWROUTE && n->nlmsg_type != RTM_DELROUTE) {
- 		fprintf(stderr, "Not a route: %08x %08x %08x\n",
-@@ -814,7 +815,7 @@ int print_route(struct nlmsghdr *n, void *arg)
- 				 r->rtm_dst_len);
- 		} else {
- 			const char *hostname = format_host_rta_r(family, tb[RTA_DST],
--					  b1, sizeof(b1));
-+					  b2, sizeof(b2));
- 			if (hostname)
- 				strncpy(b1, hostname, sizeof(b1) - 1);
- 		}
-@@ -837,7 +838,7 @@ int print_route(struct nlmsghdr *n, void *arg)
- 				 r->rtm_src_len);
- 		} else {
- 			const char *hostname = format_host_rta_r(family, tb[RTA_SRC],
--					  b1, sizeof(b1));
-+					  b2, sizeof(b2));
- 			if (hostname)
- 				strncpy(b1, hostname, sizeof(b1) - 1);
- 		}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.4.0-disable-libbsd-fallback.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.4.0-disable-libbsd-fallback.patch
new file mode 100644
index 00000000000..888091387fe
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.4.0-disable-libbsd-fallback.patch
@@ -0,0 +1,25 @@
+
+Disable the optional libbsd fallback in favor of iproute2's own
+strlcat/strlcpy routines. This prevents automagic linking and
+all sorts of other related problems.
+
+Bug: https://bugs.gentoo.org/911727
+Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- a/configure	2023-09-05 16:20:48.000000000 +0200
++++ b/configure	2023-09-05 16:29:15.850347415 +0200
+@@ -454,14 +454,8 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
+ 	echo "no"
+     else
+-	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'HAVE_LIBBSD_CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
+-		echo 'HAVE_LIBBSD_LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
+-		echo "no"
+-	else
+ 		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+ 		echo "yes"
+-	fi
+     fi
+     rm -f $TMPDIR/strtest.c $TMPDIR/strtest
+ }
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-configure-nomagic-nolibbsd.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-configure-nomagic-nolibbsd.patch
new file mode 100644
index 00000000000..4618fb9c94e
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-configure-nomagic-nolibbsd.patch
@@ -0,0 +1,246 @@
+The hand-rolled configure script, for multiple options (selinux,mnl,elf), sets
+a variable as well as modifying CFLAGS & LDLIBS.
+
+If config.mk is later amended to disable a feature, the CFLAGS/LDLIBS tweaks
+are still in place.
+
+Push the CFLAGS/LDLIBS changes into new conditional Makefile code, so that they
+are only passed when correctly needed.
+
+Prior Gentoo testcase for reproduction:
+USE=minimal ebuild ... compile.
+- Linking with libbsd, libelf, libmnl & libcap based only on presence.
+- Links based on libselinux based only on presence.
+
+Closes: https://bugs.gentoo.org/643722
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+Forward-ported from v4.14.1 to v4.16.0 by Lars Wendler <polynomial-c@gentoo.org>
+Added libcap to v4.17.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.17.0 to v4.20.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v4.20.0 to v5.11.0 by Lars Wendler <polynomial-c@gentoo.org>
+Forward-ported from v5.11.0 to v5.12.0 by Lars Wendler <polynomial-c@gentoo.org>
+
+Update 2023-09-05: Removed libbsd enforcement from config.include for bug #911727
+by Holger Hoffstätte <holger@applied-asynchrony.com>
+
+--- a/config.include
++++ b/config.include
+@@ -0,0 +1,26 @@
++# We can only modify CFLAGS/LDLIBS after all the config options are known.
++ifeq ($(IP_CONFIG_SETNS),y)
++	CFLAGS += $(IP_CONFIG_SETNS_CFLAGS)
++endif
++ifeq ($(HAVE_ELF),y)
++	CFLAGS += $(HAVE_ELF_CFLAGS)
++	LDLIBS += $(HAVE_ELF_LDLIBS)
++endif
++ifeq ($(HAVE_SELINUX),y)
++	CFLAGS += $(HAVE_SELINUX_CFLAGS)
++	LDLIBS += $(HAVE_SELINUX_LDLIBS)
++endif
++ifeq ($(HAVE_MNL),y)
++	CFLAGS += $(HAVE_MNL_CFLAGS)
++	LDLIBS += $(HAVE_MNL_LDLIBS)
++endif
++ifeq ($(HAVE_CAP),y)
++	CFLAGS += $(HAVE_CAP_CFLAGS)
++	LDLIBS += $(HAVE_CAP_LDLIBS)
++endif
++
++# Rules can only be declared after all variables in them are known.
++%.o: %.c
++	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<
++
++# vim: ft=make:
+
+--- a/bridge/Makefile
++++ b/bridge/Makefile
+@@ -2,6 +2,7 @@
+ BROBJ = bridge.o fdb.o monitor.o link.o mdb.o vlan.o vni.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ all: bridge
+ 
+--- a/configure
++++ b/configure
+@@ -202,7 +202,7 @@ EOF
+     if $CC -I$INCLUDE -o $TMPDIR/setnstest $TMPDIR/setnstest.c >/dev/null 2>&1; then
+ 	echo "IP_CONFIG_SETNS:=y" >>$CONFIG
+ 	echo "yes"
+-	echo "CFLAGS += -DHAVE_SETNS" >>$CONFIG
++	echo "IP_CONFIG_SETNS_CFLAGS += -DHAVE_SETNS" >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -269,8 +269,8 @@ check_elf()
+ 	echo "HAVE_ELF:=y" >>$CONFIG
+ 	echo "yes"
+ 
+-	echo 'CFLAGS += -DHAVE_ELF' `${PKG_CONFIG} libelf --cflags` >> $CONFIG
+-	echo 'LDLIBS += ' `${PKG_CONFIG} libelf --libs` >>$CONFIG
++	echo 'HAVE_ELF_CFLAGS += -DHAVE_ELF' `${PKG_CONFIG} libelf --cflags` >> $CONFIG
++	echo 'HAVE_ELF_LDLIBS += ' `${PKG_CONFIG} libelf --libs` >>$CONFIG
+     else
+ 	echo "no"
+     fi
+@@ -388,8 +388,8 @@ check_selinux()
+ 		echo "HAVE_SELINUX:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'LDLIBS +=' `${PKG_CONFIG} --libs libselinux` >>$CONFIG
+-		echo 'CFLAGS += -DHAVE_SELINUX' `${PKG_CONFIG} --cflags libselinux` >>$CONFIG
++		echo 'HAVE_SELINUX_CFLAGS += -DHAVE_SELINUX' `${PKG_CONFIG} --cflags libselinux` >>$CONFIG
++		echo 'HAVE_SELINUX_LDLIBS +=' `${PKG_CONFIG} --libs libselinux` >>$CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -414,8 +414,8 @@ check_mnl()
+ 		echo "HAVE_MNL:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBMNL' `${PKG_CONFIG} libmnl --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libmnl --libs` >> $CONFIG
++		echo 'HAVE_MNL_CFLAGS += -DHAVE_LIBMNL' `${PKG_CONFIG} libmnl --cflags` >>$CONFIG
++		echo 'HAVE_MNL_LDLIBS +=' `${PKG_CONFIG} libmnl --libs` >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -455,8 +455,8 @@ EOF
+ 	echo "no"
+     else
+ 	if ${PKG_CONFIG} libbsd --exists; then
+-		echo 'CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
++		echo 'HAVE_LIBBSD_CFLAGS += -DHAVE_LIBBSD' `${PKG_CONFIG} libbsd --cflags` >>$CONFIG
++		echo 'HAVE_LIBBSD_LDLIBS +=' `${PKG_CONFIG} libbsd --libs` >> $CONFIG
+ 		echo "no"
+ 	else
+ 		echo 'CFLAGS += -DNEED_STRLCPY' >>$CONFIG
+@@ -472,8 +472,8 @@ check_cap()
+ 		echo "HAVE_CAP:=y" >>$CONFIG
+ 		echo "yes"
+ 
+-		echo 'CFLAGS += -DHAVE_LIBCAP' `${PKG_CONFIG} libcap --cflags` >>$CONFIG
+-		echo 'LDLIBS +=' `${PKG_CONFIG} libcap --libs` >> $CONFIG
++		echo 'HAVE_CAP_CFLAGS += -DHAVE_LIBCAP' `${PKG_CONFIG} libcap --cflags` >>$CONFIG
++		echo 'HAVE_CAP_LDLIBS +=' `${PKG_CONFIG} libcap --libs` >> $CONFIG
+ 	else
+ 		echo "no"
+ 	fi
+@@ -633,7 +633,3 @@ check_strlcpy
+ 
+ echo -n "libcap support: "
+ check_cap
+-
+-echo >> $CONFIG
+-echo "%.o: %.c" >> $CONFIG
+-echo '	$(QUIET_CC)$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(CPPFLAGS) -c -o $@ $<' >> $CONFIG
+--- a/dcb/Makefile
++++ b/dcb/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DCBOBJ = dcb.o \
+          dcb_app.o \
+--- a/devlink/Makefile
++++ b/devlink/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DEVLINKOBJ = devlink.o mnlg.o
+ TARGETS += devlink
+--- a/genl/Makefile
++++ b/genl/Makefile
+@@ -2,6 +2,7 @@
+ GENLOBJ=genl.o
+ 
+ include ../config.mk
++include ../config.include
+ SHARED_LIBS ?= y
+ 
+ CFLAGS += -fno-strict-aliasing
+--- a/ip/Makefile
++++ b/ip/Makefile
+@@ -18,6 +18,7 @@ IPOBJ=ip.o ipaddress.o ipaddrlabel.o iproute.o iprule.o ipnetns.o \
+ RTMONOBJ=rtmon.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ALLOBJ=$(IPOBJ) $(RTMONOBJ)
+ SCRIPTS=routel
+--- a/lib/Makefile
++++ b/lib/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -fPIC
+ 
+--- a/misc/Makefile
++++ b/misc/Makefile
+@@ -5,6 +5,7 @@ LNSTATOBJ=lnstat.o lnstat_util.o
+ TARGETS=ss nstat ifstat rtacct lnstat
+ 
+ include ../config.mk
++include ../config.include
+ 
+ ifeq ($(HAVE_BERKELEY_DB),y)
+ 	TARGETS += arpd
+--- a/netem/Makefile
++++ b/netem/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ DISTGEN = maketable normal pareto paretonormal
+ DISTDATA = normal.dist pareto.dist paretonormal.dist experimental.dist
+--- a/rdma/Makefile
++++ b/rdma/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -I./include/uapi/
+ 
+--- a/tc/Makefile
++++ b/tc/Makefile
+@@ -4,6 +4,7 @@ TCOBJ= tc.o tc_qdisc.o tc_class.o tc_filter.o tc_util.o tc_monitor.o \
+        emp_ematch.tab.o emp_ematch.lex.o
+ 
+ include ../config.mk
++include ../config.include
+ 
+ SHARED_LIBS ?= y
+ 
+--- a/tipc/Makefile
++++ b/tipc/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ TIPCOBJ=bearer.o \
+     cmdl.o link.o \
+--- a/vdpa/Makefile
++++ b/vdpa/Makefile
+@@ -1,5 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ include ../config.mk
++include ../config.include
+ 
+ CFLAGS += -I./include/uapi/
+ VDPAOBJ = vdpa.o
+-- 
+2.42.0
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-mtu.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-mtu.patch
new file mode 100644
index 00000000000..f2895021eb1
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-6.5.0-mtu.patch
@@ -0,0 +1,50 @@
+http://bugs.gentoo.org/291907
+
+This patch was merged from two patches extracted from this thread:
+http://markmail.org/thread/qkd76gpdgefpjlfn
+
+tc_stab.c: small fixes to commandline help
+
+
+tc_core.c:
+As kernel part of things relies on cell align which is always set to -1,
+I also added it to userspace computation stage. This way if someone
+specified e.g. 2048 and 512 for mtu and tsize respectively, one wouldn't
+end with tsize supporting mtu 4096 suddenly, New default mtu is also set
+to 2048 (disregarding weirdness of setting mtu to such values).
+
+
+Unless I missed something, this is harmless and feels cleaner, but if it's
+not allowed, documentation will have to be changed back to 2047 + extra
+explanation as well.
+--- a/tc/tc_core.c
++++ b/tc/tc_core.c
+@@ -197,12 +197,12 @@ int tc_calc_size_table(struct tc_sizespec *s, __u16 **stab)
+ 	}
+ 
+ 	if (s->mtu == 0)
+-		s->mtu = 2047;
++		s->mtu = 2048;
+ 	if (s->tsize == 0)
+ 		s->tsize = 512;
+ 
+ 	s->cell_log = 0;
+-	while ((s->mtu >> s->cell_log) > s->tsize - 1)
++	while ((s->mtu - 1 >> s->cell_log) > s->tsize - 1)
+ 		s->cell_log++;
+ 
+ 	*stab = malloc(s->tsize * sizeof(__u16));
+--- a/tc/tc_stab.c
++++ b/tc/tc_stab.c
+@@ -27,7 +27,7 @@ static void stab_help(void)
+ 	fprintf(stderr,
+ 		"Usage: ... stab [ mtu BYTES ] [ tsize SLOTS ] [ mpu BYTES ]\n"
+ 		"                [ overhead BYTES ] [ linklayer TYPE ] ...\n"
+-		"   mtu       : max packet size we create rate map for {2047}\n"
++		"   mtu       : max packet size we create size table for {2048}\n"
+ 		"   tsize     : how many slots should size table have {512}\n"
+ 		"   mpu       : minimum packet size used in rate computations\n"
+ 		"   overhead  : per-packet size overhead used in rate computations\n"
+-- 
+2.42.0
+
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-default-color-auto.patch b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-default-color-auto.patch
deleted file mode 100644
index eb017ecd61c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/files/iproute2-default-color-auto.patch
+++ /dev/null
@@ -1,7 +0,0 @@
-diff --git a/ip/ip.c b/ip/ip.c
-index 40d2998a..454da1a3 100644
---- a/ip/ip.c
-+++ b/ip/ip.c
-@@ -169 +169 @@ int main(int argc, char **argv)
--	int color = 0;
-+	int color = COLOR_OPT_AUTO;
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-5.15.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-5.15.0.ebuild
deleted file mode 100644
index 0ba17bb9fd4..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-5.15.0.ebuild
+++ /dev/null
@@ -1,175 +0,0 @@
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit toolchain-funcs flag-o-matic multilib
-
-if [[ ${PV} == "9999" ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables ipv6 libbsd minimal selinux"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!net-misc/arpd
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( dev-libs/libbpf:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support #549948 and some defines #553876
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	sys-devel/flex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.1.0-mtu.patch #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug 643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
-	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
-)
-
-doecho() {
-	echo "${@}"
-	"${@}" || die
-}
-
-src_prepare() {
-	if ! use ipv6 ; then
-		PATCHES+=(
-			"${FILESDIR}"/${PN}-4.20.0-no-ipv6.patch #326849
-		)
-	fi
-
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ "${PV}" != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			-i ${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed 's@echo -n@printf@' -i configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly.  Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c
-	${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null && setns=y || setns=n
-	echo 'int main(){return 0;}' > test.c
-	${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null || sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile
-	popd >/dev/null
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	doecho ./configure --libbpf_force $(usex bpf on off)
-
-	# ...now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, #144265 #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die #330115
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-	# This local header pulls in a lot of linux headers it
-	# doesn't directly need.  Delete this header that requires
-	# linux-headers-3.8 until that goes stable.  #467716
-	sed -i '/linux\/netconf.h/d' "${ED}"/usr/include/libnetlink.h || die
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug 47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.0.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.0.0.ebuild
deleted file mode 100644
index b1a064050fb..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.0.0.ebuild
+++ /dev/null
@@ -1,215 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo toolchain-funcs
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables libbsd minimal nfs selinux split-usr"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!net-misc/arpd
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( dev-libs/libbpf:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
-	nfs? ( net-libs/libtirpc:= )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	sys-devel/flex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.1.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug #643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
-	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
-	"${FILESDIR}"/${PN}-default-color-auto.patch
-)
-
-src_prepare() {
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			-i ${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed 's@echo -n@printf@' -i configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# Build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly. Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null || die
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
-	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
-		setns=y
-	else
-		setns=n
-	fi
-
-	echo 'int main(){return 0;}' > test.c || die
-	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
-		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
-	fi
-	popd >/dev/null || die
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	edo ./configure --libbpf_force $(usex bpf on off)
-
-	# Remove the definitions made by configure and allow them to be overridden
-	# by USE flags below.
-	# We have to do the cheesy only-sed-if-disabled because otherwise
-	# the *_FLAGS etc stuff found by configure will be used but result
-	# in a broken build.
-	if ! use berkdb ; then
-		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
-	fi
-
-	if ! use caps ; then
-		sed -i -e '/HAVE_CAP/d' config.mk || die
-	fi
-
-	if use minimal ; then
-		sed -i -e '/HAVE_MNL/d' config.mk || die
-	fi
-
-	if ! use elf ; then
-		sed -i -e '/HAVE_ELF/d' config.mk || die
-	fi
-
-	if ! use nfs ; then
-		sed -i -e '/HAVE_RPC/d' config.mk || die
-	fi
-
-	if ! use selinux ; then
-		sed -i -e '/HAVE_SELINUX/d' config.mk || die
-	fi
-
-	if ! use libbsd ; then
-		sed -i -e '/HAVE_LIBBSD/d' config.mk || die
-	fi
-
-	# ...Now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	# Keep in sync with ifs above, or refactor to be unified.
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers, bug #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_RPC      := $(usex nfs y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, bug #144265, bug #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die # bug #330115
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-
-	# Collides with net-analyzer/ifstat
-	# https://bugs.gentoo.org/868321
-	mv "${ED}"/sbin/ifstat{,-iproute2} || die
-
-	if use split-usr ; then
-		# Can remove compatibility symlink in a year: 2023-05-28.
-		# bug #547264
-		mv "${ED}"/sbin/ss "${ED}"/bin/ss || die
-		dosym -r /bin/ss /sbin/ss
-	fi
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug #47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.2.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.2.0-r1.ebuild
deleted file mode 100644
index dc076ef7f9c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.2.0-r1.ebuild
+++ /dev/null
@@ -1,220 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit edo toolchain-funcs
-
-if [[ ${PV} == 9999 ]] ; then
-	EGIT_REPO_URI="https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git"
-	inherit git-r3
-else
-	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="kernel routing and traffic control utilities"
-HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables libbsd minimal nfs selinux split-usr"
-# Needs root
-RESTRICT="test"
-
-# We could make libmnl optional, but it's tiny, so eh
-RDEPEND="
-	!net-misc/arpd
-	!minimal? ( net-libs/libmnl:= )
-	atm? ( net-dialup/linux-atm )
-	berkdb? ( sys-libs/db:= )
-	bpf? ( dev-libs/libbpf:= )
-	caps? ( sys-libs/libcap )
-	elf? ( virtual/libelf:= )
-	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
-	nfs? ( net-libs/libtirpc:= )
-	selinux? ( sys-libs/libselinux )
-"
-# We require newer linux-headers for ipset support (bug #549948) and some defines (bug #553876)
-DEPEND="
-	${RDEPEND}
-	>=sys-kernel/linux-headers-3.16
-"
-BDEPEND="
-	app-arch/xz-utils
-	>=sys-devel/bison-2.4
-	sys-devel/flex
-	virtual/pkgconfig
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.1.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug #643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
-	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
-)
-
-src_prepare() {
-	default
-
-	# Fix version if necessary
-	local versionfile="include/version.h"
-	if [[ ${PV} != 9999 ]] && ! grep -Fq "${PV}" ${versionfile} ; then
-		einfo "Fixing version string"
-		sed "s@\"[[:digit:]\.]\+\"@\"${PV}\"@" \
-			-i ${versionfile} || die
-	fi
-
-	# echo -n is not POSIX compliant
-	sed 's@echo -n@printf@' -i configure || die
-
-	sed -i \
-		-e '/^CC :\?=/d' \
-		-e "/^LIBDIR/s:=.*:=/$(get_libdir):" \
-		-e "s|-O2|${CFLAGS} ${CPPFLAGS}|" \
-		-e "/^HOSTCC/s:=.*:= $(tc-getBUILD_CC):" \
-		-e "/^DBM_INCLUDE/s:=.*:=${T}:" \
-		Makefile || die
-
-	# Build against system headers
-	rm -r include/netinet || die #include/linux include/ip{,6}tables{,_common}.h include/libiptc
-	sed -i 's:TCPI_OPT_ECN_SEEN:16:' misc/ss.c || die
-
-	if use minimal ; then
-		sed -i -e '/^SUBDIRS=/s:=.*:=lib tc ip:' Makefile || die
-	fi
-}
-
-src_configure() {
-	tc-export AR CC PKG_CONFIG
-
-	# This sure is ugly. Should probably move into toolchain-funcs at some point.
-	local setns
-	pushd "${T}" >/dev/null || die
-	printf '#include <sched.h>\nint main(){return setns(0, 0);}\n' > test.c || die
-	if ${CC} ${CFLAGS} ${CPPFLAGS} -D_GNU_SOURCE ${LDFLAGS} test.c >&/dev/null ; then
-		setns=y
-	else
-		setns=n
-	fi
-
-	echo 'int main(){return 0;}' > test.c || die
-	if ! ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c -lresolv >&/dev/null ; then
-		sed -i '/^LDLIBS/s:-lresolv::' "${S}"/Makefile || die
-	fi
-	popd >/dev/null || die
-
-	# run "configure" script first which will create "config.mk"...
-	# Using econf breaks since 5.14.0 (a9c3d70d902a0473ee5c13336317006a52ce8242)
-	edo ./configure --libbpf_force $(usex bpf on off)
-
-	# Remove the definitions made by configure and allow them to be overridden
-	# by USE flags below.
-	# We have to do the cheesy only-sed-if-disabled because otherwise
-	# the *_FLAGS etc stuff found by configure will be used but result
-	# in a broken build.
-	if ! use berkdb ; then
-		sed -i -e '/HAVE_BERKELEY_DB/d' config.mk || die
-	fi
-
-	if ! use caps ; then
-		sed -i -e '/HAVE_CAP/d' config.mk || die
-	fi
-
-	if use minimal ; then
-		sed -i -e '/HAVE_MNL/d' config.mk || die
-	fi
-
-	if ! use elf ; then
-		sed -i -e '/HAVE_ELF/d' config.mk || die
-	fi
-
-	if ! use nfs ; then
-		sed -i -e '/HAVE_RPC/d' config.mk || die
-	fi
-
-	if ! use selinux ; then
-		sed -i -e '/HAVE_SELINUX/d' config.mk || die
-	fi
-
-	if ! use libbsd ; then
-		sed -i -e '/HAVE_LIBBSD/d' config.mk || die
-	fi
-
-	# ...Now switch on/off requested features via USE flags
-	# this is only useful if the test did not set other things, per bug #643722
-	# Keep in sync with ifs above, or refactor to be unified.
-	cat <<-EOF >> config.mk
-	TC_CONFIG_ATM := $(usex atm y n)
-	TC_CONFIG_XT  := $(usex iptables y n)
-	TC_CONFIG_NO_XT := $(usex iptables n y)
-	# We've locked in recent enough kernel headers, bug #549948
-	TC_CONFIG_IPSET := y
-	HAVE_BERKELEY_DB := $(usex berkdb y n)
-	HAVE_CAP      := $(usex caps y n)
-	HAVE_MNL      := $(usex minimal n y)
-	HAVE_ELF      := $(usex elf y n)
-	HAVE_RPC      := $(usex nfs y n)
-	HAVE_SELINUX  := $(usex selinux y n)
-	IP_CONFIG_SETNS := ${setns}
-	# Use correct iptables dir, bug #144265, bug #293709
-	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
-	EOF
-}
-
-src_compile() {
-	emake V=1 NETNS_RUN_DIR=/run/netns
-}
-
-src_test() {
-	emake check
-}
-
-src_install() {
-	if use minimal ; then
-		into /
-		dosbin tc/tc
-		dobin ip/ip
-		return 0
-	fi
-
-	emake \
-		DESTDIR="${D}" \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}"/$(get_libdir) \
-		SBINDIR="${EPREFIX}"/sbin \
-		CONFDIR="${EPREFIX}"/etc/iproute2 \
-		DOCDIR="${EPREFIX}"/usr/share/doc/${PF} \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		ARPDDIR="${EPREFIX}"/var/lib/arpd \
-		install
-
-	dodir /bin
-	mv "${ED}"/{s,}bin/ip || die # bug #330115
-
-	dolib.a lib/libnetlink.a
-	insinto /usr/include
-	doins include/libnetlink.h
-
-	# Collides with net-analyzer/ifstat
-	# https://bugs.gentoo.org/868321
-	mv "${ED}"/sbin/ifstat{,-iproute2} || die
-
-	if use split-usr ; then
-		# Can remove compatibility symlink in a year: 2023-05-28.
-		# bug #547264
-		mv "${ED}"/sbin/ss "${ED}"/bin/ss || die
-		dosym -r /bin/ss /sbin/ss
-	fi
-
-	if use berkdb ; then
-		keepdir /var/lib/arpd
-		# bug #47482, arpd doesn't need to be in /sbin
-		dodir /usr/bin
-		mv "${ED}"/sbin/arpd "${ED}"/usr/bin/ || die
-	elif [[ -d "${ED}"/var/lib/arpd ]]; then
-		rmdir --ignore-fail-on-non-empty -p "${ED}"/var/lib/arpd || die
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.1.0-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.4.0-r1.ebuild
similarity index 92%
rename from sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.1.0-r1.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.4.0-r1.ebuild
index 72f3265dd8e..f03d49fa174 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.1.0-r1.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.4.0-r1.ebuild
@@ -18,7 +18,9 @@ HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables libbsd minimal nfs selinux split-usr"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux split-usr"
+# Needs root
+RESTRICT="test"
 
 # We could make libmnl optional, but it's tiny, so eh
 RDEPEND="
@@ -30,7 +32,6 @@ RDEPEND="
 	caps? ( sys-libs/libcap )
 	elf? ( virtual/libelf:= )
 	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
 	nfs? ( net-libs/libtirpc:= )
 	selinux? ( sys-libs/libselinux )
 "
@@ -48,11 +49,10 @@ BDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-3.1.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug #643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
+	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
 	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
-	"${FILESDIR}"/${PN}-default-color-auto.patch
-	"${FILESDIR}"/${PN}-6.1.0-strncpy-overlap.patch
+	"${FILESDIR}"/${PN}-6.4.0-add-missing-limits.h-include.patch
+	"${FILESDIR}"/${PN}-6.4.0-disable-libbsd-fallback.patch # bug #911727
 )
 
 src_prepare() {
@@ -138,10 +138,6 @@ src_configure() {
 		sed -i -e '/HAVE_SELINUX/d' config.mk || die
 	fi
 
-	if ! use libbsd ; then
-		sed -i -e '/HAVE_LIBBSD/d' config.mk || die
-	fi
-
 	# ...Now switch on/off requested features via USE flags
 	# this is only useful if the test did not set other things, per bug #643722
 	# Keep in sync with ifs above, or refactor to be unified.
@@ -160,7 +156,6 @@ src_configure() {
 	IP_CONFIG_SETNS := ${setns}
 	# Use correct iptables dir, bug #144265, bug #293709
 	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
 	EOF
 }
 
@@ -168,6 +163,10 @@ src_compile() {
 	emake V=1 NETNS_RUN_DIR=/run/netns
 }
 
+src_test() {
+	emake check
+}
+
 src_install() {
 	if use minimal ; then
 		into /
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.3.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.5.0.ebuild
similarity index 91%
rename from sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.3.0.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.5.0.ebuild
index dc076ef7f9c..92b9a7188d8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.3.0.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-6.5.0.ebuild
@@ -10,7 +10,7 @@ if [[ ${PV} == 9999 ]] ; then
 	inherit git-r3
 else
 	SRC_URI="https://www.kernel.org/pub/linux/utils/net/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 fi
 
 DESCRIPTION="kernel routing and traffic control utilities"
@@ -18,7 +18,7 @@ HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables libbsd minimal nfs selinux split-usr"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux split-usr"
 # Needs root
 RESTRICT="test"
 
@@ -32,7 +32,6 @@ RDEPEND="
 	caps? ( sys-libs/libcap )
 	elf? ( virtual/libelf:= )
 	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
 	nfs? ( net-libs/libtirpc:= )
 	selinux? ( sys-libs/libselinux )
 "
@@ -49,10 +48,10 @@ BDEPEND="
 "
 
 PATCHES=(
-	"${FILESDIR}"/${PN}-3.1.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug #643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
+	"${FILESDIR}"/${PN}-6.5.0-mtu.patch # bug #291907
+	"${FILESDIR}"/${PN}-6.5.0-configure-nomagic-nolibbsd.patch # bug #643722 & #911727
 	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
+	"${FILESDIR}"/${PN}-6.4.0-disable-libbsd-fallback.patch # bug #911727
 )
 
 src_prepare() {
@@ -138,10 +137,6 @@ src_configure() {
 		sed -i -e '/HAVE_SELINUX/d' config.mk || die
 	fi
 
-	if ! use libbsd ; then
-		sed -i -e '/HAVE_LIBBSD/d' config.mk || die
-	fi
-
 	# ...Now switch on/off requested features via USE flags
 	# this is only useful if the test did not set other things, per bug #643722
 	# Keep in sync with ifs above, or refactor to be unified.
@@ -160,7 +155,6 @@ src_configure() {
 	IP_CONFIG_SETNS := ${setns}
 	# Use correct iptables dir, bug #144265, bug #293709
 	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
 	EOF
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
index 32423402a1c..04c74af7ff2 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/iproute2/iproute2-9999.ebuild
@@ -18,7 +18,7 @@ HOMEPAGE="https://wiki.linuxfoundation.org/networking/iproute2"
 
 LICENSE="GPL-2"
 SLOT="0"
-IUSE="atm berkdb bpf caps elf +iptables libbsd minimal nfs selinux split-usr"
+IUSE="atm berkdb bpf caps elf +iptables minimal nfs selinux split-usr"
 # Needs root
 RESTRICT="test"
 
@@ -32,7 +32,6 @@ RDEPEND="
 	caps? ( sys-libs/libcap )
 	elf? ( virtual/libelf:= )
 	iptables? ( >=net-firewall/iptables-1.4.20:= )
-	libbsd? ( dev-libs/libbsd )
 	nfs? ( net-libs/libtirpc:= )
 	selinux? ( sys-libs/libselinux )
 "
@@ -50,9 +49,9 @@ BDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-3.1.0-mtu.patch # bug #291907
-	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic.patch # bug #643722
-	#"${FILESDIR}"/${PN}-5.1.0-portability.patch
+	"${FILESDIR}"/${PN}-5.12.0-configure-nomagic-nolibbsd.patch # bug #643722 & 911727
 	"${FILESDIR}"/${PN}-5.7.0-mix-signal.h-include.patch
+	"${FILESDIR}"/${PN}-6.4.0-disable-libbsd-fallback.patch # bug #911727
 )
 
 src_prepare() {
@@ -138,10 +137,6 @@ src_configure() {
 		sed -i -e '/HAVE_SELINUX/d' config.mk || die
 	fi
 
-	if ! use libbsd ; then
-		sed -i -e '/HAVE_LIBBSD/d' config.mk || die
-	fi
-
 	# ...Now switch on/off requested features via USE flags
 	# this is only useful if the test did not set other things, per bug #643722
 	# Keep in sync with ifs above, or refactor to be unified.
@@ -160,7 +155,6 @@ src_configure() {
 	IP_CONFIG_SETNS := ${setns}
 	# Use correct iptables dir, bug #144265, bug #293709
 	IPT_LIB_DIR   := $(use iptables && ${PKG_CONFIG} xtables --variable=xtlibdir)
-	HAVE_LIBBSD   := $(usex libbsd y n)
 	EOF
 }
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
index 50659e27479..4763bd1a80f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/Manifest
@@ -1,3 +1,4 @@
 DIST kbd-2.5.1.tar.xz 1491952 BLAKE2B aab4c3d78c28709bf562b54fe94c0533d5c33185e183bf3eb944f89147b250d9df9b30b64a06eb4742feafe8c05a6aa491a7f007b4d6d9077bc19a4628ba05ae SHA512 74855f486aff5fc2f93a6cb29460a590c94eac653b001574e1b4eb1300ea99dfed9222f9e5d1d3a05a112a6880591d5c44ed6e76b8a64edf744ecb0892f562d0
 DIST kbd-2.6.1.tar.xz 1591240 BLAKE2B 15c738379cfa9420e218ddbf6562e2c75b6bf5eb31ce159d798d49546991ca0c02bf9a11486d99bd2ba7d99f3bf6abb53ad799c6314df6d9ca9b1e8cf808b738 SHA512 8d7f39efa91ef16f4c0601c1744e7f00e411c121607660c8f585d3e085d8e8bea4ea095f6c7f491af763097a9844fb4a07d4b78a8358cb7caafbfda0626acf91
 DIST kbd-2.6.2.tar.xz 1503532 BLAKE2B aa146177b2ffd9d6d396c253ce54d0ee42e1a1a2ba471ae0f8950a72b49f2f83aa4660337a581150cfd9fae0b9a4415725f4d152e83c0bdf26b833a31f6e2696 SHA512 afcac33e2e8eecd6f9cfa20bb39254deffc4d8924c4f722d003bdfaf286dac7d87f55ed0a5a35d341ae88fc48162966d5aa1ab8125b11e845bf3c2589a17c8d2
+DIST kbd-2.6.3.tar.xz 1503048 BLAKE2B 9c3f9e2ec9abd3a18bd4159b3a223deee6aee74610ed843582dc2a0397bb80075ae5e76a67d030fcd7a706641a8fb4604840eec67057271ce3e75a0630145942 SHA512 7daf59557408e1cd29140130094b43d8d89b25b3094fd03912d878483f27d128ad25163ea7023e5a10b7d8b8bf8434447927b69fe0094f8db97484881f23ed60
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.3.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.3.ebuild
new file mode 100644
index 00000000000..23a50e0bfa3
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/kbd/kbd-2.6.3.ebuild
@@ -0,0 +1,86 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://github.com/legionus/kbd.git https://git.kernel.org/pub/scm/linux/kernel/git/legion/kbd.git"
+	EGIT_BRANCH="master"
+else
+	if [[ $(ver_cut 3) -lt 90 ]] ; then
+		SRC_URI="https://www.kernel.org/pub/linux/utils/kbd/${P}.tar.xz"
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	else
+		inherit autotools
+		SRC_URI="https://github.com/legionus/kbd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	fi
+fi
+
+DESCRIPTION="Keyboard and console utilities"
+HOMEPAGE="https://kbd-project.org/"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="nls selinux pam test"
+RESTRICT="!test? ( test )"
+
+# Testsuite's Makefile.am calls missing(!)
+# ... but this seems to be consistent with the autoconf docs?
+# Needs more investigation: https://www.gnu.org/software/autoconf/manual/autoconf-2.67/html_node/autom4te-Invocation.html
+QA_AM_MAINTAINER_MODE=".*--run autom4te --language=autotest.*"
+
+DEPEND="
+	app-alternatives/gzip
+	pam? (
+		!app-misc/vlock
+		sys-libs/pam
+	)
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-loadkeys )
+"
+BDEPEND="
+	virtual/pkgconfig
+	test? ( dev-libs/check )
+"
+
+src_prepare() {
+	default
+
+	# Rename conflicting keymaps to have unique names, bug #293228
+	# See also https://github.com/legionus/kbd/issues/76.
+	pushd "${S}"/data/keymaps/i386 &> /dev/null || die
+	mv fgGIod/trf.map fgGIod/trf-fgGIod.map || die
+	mv olpc/es.map olpc/es-olpc.map || die
+	mv olpc/pt.map olpc/pt-olpc.map || die
+	mv qwerty/cz.map qwerty/cz-qwerty.map || die
+	popd &> /dev/null || die
+
+	if [[ ${PV} == 9999 ]] || [[ $(ver_cut 3) -ge 90 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		--disable-werror
+
+		$(use_enable nls)
+		$(use_enable pam vlock)
+		$(use_enable test tests)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	docinto html
+	dodoc docs/doc/*.html
+
+	# USE="test" installs .la files
+	find "${ED}" -type f -name "*.la" -delete || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-db/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/Manifest
index 9e27345894d..7af2d115867 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/man-db/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/Manifest
@@ -1 +1,2 @@
 DIST man-db-2.11.2.tar.xz 1953276 BLAKE2B 80ac565cdb69736c0f922b9cbfddcae753d176329781deaf9434d87d7718f9b6ce0b6d4642a03f22a04c7f042dda7f8986b5bce0038f0748461ca55d66964ccc SHA512 edb71cce7249c7b7f2f524e92f682047a77ed9ae8856763dfc8e18e239444651ff4c505e697f5a8b1be3b85678e714fbb1a520defe72a4eb685bc2cecc0e4391
+DIST man-db-2.12.0.tar.xz 1987444 BLAKE2B a6258c1fc9cd81be5d288298660f5b9bda22d726ef98dd5c0a1998809a32391f7244be6897ee8e03483e705a426d6a59d442de3dc2e84f45500daa825ac639db SHA512 4b644a508cf10ef6d27b6325b08f8a89e0695bbc1409bf420efd27649c6851860cc472c4d86063f7b71dccd01fb158faa82afa1e2b91c9a20154acf66b0349bf
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.12.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.12.0.ebuild
new file mode 100644
index 00000000000..3aa96909e35
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/man-db/man-db-2.12.0.ebuild
@@ -0,0 +1,203 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd prefix tmpfiles
+
+DESCRIPTION="A man replacement that utilizes dbm instead of flat files"
+HOMEPAGE="https://gitlab.com/man-db/man-db https://www.nongnu.org/man-db/"
+if [[ ${PV} == *9999 ]] ; then
+	inherit autotools git-r3
+	EGIT_REPO_URI="https://gitlab.com/man-db/man-db"
+else
+	# TODO: Change tarballs to gitlab too...?
+	SRC_URI="mirror://nongnu/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="+manpager nls +seccomp selinux static-libs zlib"
+
+CDEPEND="
+	>=dev-libs/libpipeline-1.5.0
+	sys-apps/groff
+	sys-libs/gdbm:=
+	seccomp? ( sys-libs/libseccomp )
+	zlib? ( sys-libs/zlib )"
+DEPEND="${CDEPEND}"
+BDEPEND="app-arch/xz-utils
+	virtual/pkgconfig
+	nls? (
+		>=app-text/po4a-0.45
+		sys-devel/gettext
+		virtual/libiconv
+		virtual/libintl
+	)"
+RDEPEND="${CDEPEND}
+	acct-group/man
+	acct-user/man
+	selinux? ( sec-policy/selinux-mandb )"
+PDEPEND="manpager? ( app-text/manpager )"
+
+PATCHES=(
+	"${FILESDIR}"/man-db-2.9.3-sandbox-env-tests.patch
+)
+
+src_unpack() {
+	if [[ ${PV} == *9999 ]] ; then
+		git-r3_src_unpack
+
+		# We need to mess with gnulib
+		EGIT_REPO_URI="https://git.savannah.gnu.org/r/gnulib.git" \
+		EGIT_CHECKOUT_DIR="${WORKDIR}/gnulib" \
+		git-r3_src_unpack
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == *9999 ]] ; then
+		local bootstrap_opts=(
+			--gnulib-srcdir=../gnulib
+			--no-bootstrap-sync
+			--copy
+			--no-git
+		)
+		AUTORECONF="/bin/true" \
+		LIBTOOLIZE="/bin/true" \
+		sh ./bootstrap "${bootstrap_opts[@]}" || die
+
+		eautoreconf
+	fi
+
+	hprefixify src/man_db.conf.in
+	if use prefix ; then
+		{
+			echo "#"
+			echo "# Added settings for Gentoo Prefix"
+			[[ ${CHOST} == *-darwin* ]] && \
+				echo "MANDATORY_MANPATH ${EPREFIX}/MacOSX.sdk/usr/share/man"
+			echo "MANDATORY_MANPATH /usr/share/man"
+		} >> src/man_db.conf.in
+	fi
+}
+
+src_configure() {
+	# Set sections we want to search by default
+	local sections="1 1p 8 2 3 3p 4 5 6 7 9 0p tcl n l p o"
+	sections+=" 1x 2x 3x 4x 5x 6x 7x 8x"
+	case ${CHOST} in
+		*-solaris*)
+			# Solaris tends to use sections named after the pkgs that
+			# owns them, in particular for libc functions we want those
+			# sections
+			local s
+			for s in $(cd /usr/share/man/ && echo man*) ; do
+				s=${s#man}
+				[[ " ${sections} " != *" ${s} "* ]] && sections+=" ${s}"
+			done
+			;;
+	esac
+
+	export ac_cv_lib_z_gzopen=$(usex zlib)
+	local myeconfargs=(
+		--with-systemdtmpfilesdir="${EPREFIX}"/usr/lib/tmpfiles.d
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+		--disable-setuid # bug #662438
+		--enable-cache-owner=man
+		--with-sections="${sections}"
+
+		$(use_enable nls)
+		$(use_enable static-libs static)
+		$(use_with seccomp libseccomp)
+
+		--with-db=gdbm
+	)
+
+	case ${CHOST} in
+		*-solaris*|*-darwin*)
+			myeconfargs+=(
+				$(use_with nls libiconv-prefix "${EPREFIX}"/usr)
+				$(use_with nls libintl-prefix "${EPREFIX}"/usr)
+			)
+			;;
+	esac
+
+	econf "${myeconfargs[@]}"
+
+	# Disable color output from groff so that the manpager can add it. bug #184604
+	if use manpager; then
+		sed -i \
+			-e '/^#DEFINE.*\<[nt]roff\>/{s:^#::;s:$: -c:}' \
+			src/man_db.conf || die
+	fi
+
+	cat > 15man-db <<-EOF || die
+	SANDBOX_PREDICT="/var/cache/man"
+	EOF
+}
+
+src_install() {
+	default
+	dodoc docs/{HACKING.md,TODO}
+	find "${ED}" -type f -name "*.la" -delete || die
+
+	exeinto /etc/cron.daily
+	newexe "${FILESDIR}"/man-db.cron-r1 man-db # bug #289884
+
+	insinto /etc/sandbox.d
+	doins 15man-db
+}
+
+pkg_preinst() {
+	local cachedir="${EROOT}/var/cache/man"
+	# If the system was already exploited, and the attacker is hiding in the
+	# cachedir of the old man-db, let's wipe them out.
+	# see bug  #602588 comment 18
+	local _replacing_version=
+	local _setgid_vuln=0
+	for _replacing_version in ${REPLACING_VERSIONS} ; do
+		if ver_test '2.7.6.1-r2' -le "${_replacing_version}" ; then
+			debug-print "Skipping security bug #602588 ... existing installation (${_replacing_version}) should not be affected!"
+		else
+			_setgid_vuln=1
+			debug-print "Applying cleanup for security bug #602588"
+		fi
+	done
+	[[ ${_setgid_vuln} -eq 1 ]] && rm -rf "${cachedir}"
+
+	# Fall back to recreating the cachedir
+	if [[ ! -d ${cachedir} ]] ; then
+		mkdir -p "${cachedir}" || die
+		chown man:man "${cachedir}" || die
+	fi
+
+	# Update the whatis cache
+	if [[ -f ${cachedir}/whatis ]] ; then
+		einfo "Cleaning ${cachedir} from sys-apps/man"
+		find "${cachedir}" -type f '!' '(' -name index.bt -o -name index.db ')' -delete
+	fi
+}
+
+pkg_postinst() {
+	tmpfiles_process man-db.conf
+
+	if [[ -n "${REPLACING_VERSIONS}" ]] ; then
+		local _replacing_version=
+
+		for _replacing_version in ${REPLACING_VERSIONS} ; do
+			if [[ $(ver_cut 2 ${_replacing_version}) -lt 7 ]] ; then
+				einfo "Rebuilding man-db from scratch with new database format!"
+				su man -s /bin/sh -c 'mandb --quiet --create' 2>/dev/null
+
+				# No need to run it again if we hit one
+				break
+			fi
+		done
+	fi
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/Manifest b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/Manifest
index 5414bcceddd..659666c9f22 100644
--- a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/Manifest
@@ -2,3 +2,4 @@ DIST texinfo-6.8.tar.xz 4961528 BLAKE2B 0256dac5ba9c7f171c970644907b763f7a88fd99
 DIST texinfo-7.0.2.tar.xz 4875424 BLAKE2B 23737cc800392c949add14c1d0a01a294e8c224d958c03325c96d6540dcfae49db5c2d4a8c29310c0603f8ac8477f6ee00a14db4aa6caab317b19e776139e617 SHA512 26dd5bb1392f2197ecde296ba157d4533f4b11fadf1238481da4cf2b3796c665ce96049df8d2f9a6d4fa22b7e9013d9978d195e525288663f0a54482bbc22b2b
 DIST texinfo-7.0.3.tar.xz 4886668 BLAKE2B 38710faba2f717f7990228d58924901ea7d7378cc02e2059a437b5127f9e2dc67f732584e3f45fc34e8ef6d7671a546fe66871dadbd29e772f3417768622a650 SHA512 7d14f7458f2b7d0ee0b740e00a5fc2a9d61d33811aa5905d649875ec518dcb4f01be46fb0c46748f7dfe36950597a852f1473ab0648d5add225bc8f35528a8ff
 DIST texinfo-7.0.90.tar.xz 5474032 BLAKE2B 6578671213309a6d0ee5fa6eec8d4515416d0fc7c9e37a741309caeffecb970796dfb9b7164f5377fcc368ecf1fa0bbaff46ed5345afdcc17fd0e624ee0cf47b SHA512 cfff7e340c211488cb38d0acdfea54d1c74007f3deeadedb097741225c54eb3c13a05811426807f75d4b517b7e4bdd21238f06e6ceabfe8e7ae73a9b753800af
+DIST texinfo-7.0.92.tar.xz 5513304 BLAKE2B 0661ac8f148319097c7226bda25bad4c1ae611240d5d275847be339adb13055d6b543a09447a16040ae27ea0054f1978f4c49c5fc9eb3576ac6c83380c038401 SHA512 89f0d32fa4f380afa714c96be0f75972821f746b23557a58e570f7f73a5f7e5fc3f411045582b7147c57c7bc3543c0afd3e6972018849d9725cc672e6442cf78
diff --git a/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.0.92.ebuild b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.0.92.ebuild
new file mode 100644
index 00000000000..7c36a927189
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-apps/texinfo/texinfo-7.0.92.ebuild
@@ -0,0 +1,92 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Note: if your package uses the texi2dvi utility, it must depend on the
+# virtual/texi2dvi package to pull in all the right deps.  The tool is not
+# usable out-of-the-box because it requires the large tex packages.
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs
+
+DESCRIPTION="The GNU info program and utilities"
+HOMEPAGE="https://www.gnu.org/software/texinfo/"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/texinfo.git"
+	REGEN_BDEPEND="
+		>=sys-devel/autoconf-2.62
+		>=sys-devel/automake-1.16
+		sys-devel/libtool
+	"
+elif [[ $(ver_cut 3) -ge 90 || $(ver_cut 4) -ge 90 ]] ; then
+	SRC_URI="https://alpha.gnu.org/gnu/${PN}/${P}.tar.xz"
+	REGEN_BDEPEND=""
+else
+	SRC_URI="mirror://gnu/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	REGEN_BDEPEND=""
+fi
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="nls +standalone static"
+
+RDEPEND="
+	!=app-text/tetex-2*
+	>=sys-libs/ncurses-5.2-r2:=
+	virtual/perl-Data-Dumper
+	virtual/perl-Encode
+	virtual/perl-Unicode-Collate
+	standalone? ( >=dev-lang/perl-5.8.1 )
+	!standalone?  (
+		>=dev-lang/perl-5.8.1:=
+		dev-libs/libunistring:=
+	)
+	nls? ( virtual/libintl )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${REGEN_BDEPEND}
+	nls? ( >=sys-devel/gettext-0.19.6 )
+"
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]]; then
+		./autogen.sh || die
+	fi
+
+	# Needed if a patch touches install-info.c
+	#touch man/install-info.1 || die
+
+	if use prefix ; then
+		sed -i -e '1c\#!/usr/bin/env sh' util/texi2dvi util/texi2pdf || die
+		touch {doc,man}/{texi2dvi,texi2pdf,pdftexi2dvi}.1 || die
+	fi
+}
+
+src_configure() {
+	# Respect compiler and CPPFLAGS/CFLAGS/LDFLAGS for Perl extensions
+	# bug #622576
+	local -x PERL_EXT_CC="$(tc-getCC)" PERL_EXT_CPPFLAGS="${CPPFLAGS}"
+	local -x PERL_EXT_CFLAGS="${CFLAGS}" PERL_EXT_LDFLAGS="${LDFLAGS}"
+
+	use static && append-ldflags -static
+
+	# TODO:
+	# --with-external-Unicode-EastAsianWidth
+	# --with-external-Text-Unidecode
+	#
+	# Also, 7.0.91 seemed to introduce a included-libunistring w/ USE=-standalone
+	# but it doesn't seem to do anything?
+	local myeconfargs=(
+		--cache-file="${S}"/config.cache
+		$(use_enable nls)
+		$(use_enable !standalone perl-xs)
+	)
+
+	econf "${myeconfargs[@]}"
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/files/thin-provisioning-tools-0.9.0-boost-gtest.patch b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/files/thin-provisioning-tools-0.9.0-boost-gtest.patch
new file mode 100644
index 00000000000..ae9288db8be
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/files/thin-provisioning-tools-0.9.0-boost-gtest.patch
@@ -0,0 +1,622 @@
+Bug: https://bugs.gentoo.org/911775
+
+--- a/base/base64.cc
++++ b/base/base64.cc
+@@ -68,13 +68,13 @@
+ 		throw std::runtime_error("internal error, in split");
+ 	}
+ 
+-	optional<unsigned> char_to_index(char c) {
++	boost::optional<unsigned> char_to_index(char c) {
+ 		// FIXME: very slow
+ 		for (unsigned i = 0; i < 64; i++)
+ 			if (table_[i] == c)
+-				return optional<unsigned>(i);
++				return boost::optional<unsigned>(i);
+ 
+-		return optional<unsigned>();
++		return boost::optional<unsigned>();
+ 	}
+ 
+ 	decoded_or_error success(vector<unsigned char> const &decoded) {
+@@ -92,7 +92,7 @@
+ 	}
+ 
+ 	decoded_or_error decode_quad(char c1, char c2, char c3, char c4) {
+-		typedef optional<unsigned> oi;
++		typedef boost::optional<unsigned> oi;
+ 		unsigned char d1, d2, d3;
+ 		vector<unsigned char> decoded;
+ 
+--- a/base/run.h
++++ b/base/run.h
+@@ -1,7 +1,7 @@
+ #ifndef BASE_DATA_RANGE_H
+ #define BASE_DATA_RANGE_H
+ 
+-#include <boost/optional.hpp>
++#include <boost/optional/optional_io.hpp>
+ #include <ostream>
+ 
+ //----------------------------------------------------------------
+--- a/block-cache/copier.cc
++++ b/block-cache/copier.cc
+@@ -90,19 +90,19 @@
+ copier::wait_complete()
+ {
+ 	if (complete_.empty()) {
+-		return optional<copy_op>();
++		return boost::optional<copy_op>();
+ 
+ 	} else {
+ 		auto op = complete_.front();
+ 		complete_.pop_front();
+-		return optional<copy_op>(op);
++		return boost::optional<copy_op>(op);
+ 	}
+ }
+ 
+ void
+ copier::wait_(unsigned &micro)
+ {
+-	optional<io_engine::wait_result> mp;
++	boost::optional<io_engine::wait_result> mp;
+ 
+ 	if (!pending())
+ 		return;
+--- a/block-cache/io_engine.cc
++++ b/block-cache/io_engine.cc
+@@ -125,13 +125,13 @@
+ 	return r == 1;
+ }
+ 
+-optional<io_engine::wait_result>
++boost::optional<io_engine::wait_result>
+ aio_engine::wait()
+ {
+ 	return wait_(NULL);
+ }
+ 
+-optional<io_engine::wait_result>
++boost::optional<io_engine::wait_result>
+ aio_engine::wait(unsigned &microsec)
+ {
+ 	timespec start = micro_to_ts(microsec);
+@@ -156,7 +156,7 @@
+ 	}
+ 
+ 	if (r == 0) {
+-		return optional<wait_result>();
++		return boost::optional<wait_result>();
+ 	}
+ 
+ 	iocb *cb = reinterpret_cast<iocb *>(event.obj);
+@@ -164,19 +164,19 @@
+ 
+ 	if (event.res == cb->u.c.nbytes) {
+ 		cbs_.free(cb);
+-		return optional<wait_result>(make_pair(true, context));
++		return boost::optional<wait_result>(make_pair(true, context));
+ 
+ 	} else if (static_cast<int>(event.res) < 0) {
+ 		cbs_.free(cb);
+-		return optional<wait_result>(make_pair(false, context));
++		return boost::optional<wait_result>(make_pair(false, context));
+ 
+ 	} else {
+ 		cbs_.free(cb);
+-		return optional<wait_result>(make_pair(false, context));
++		return boost::optional<wait_result>(make_pair(false, context));
+ 	}
+ 
+ 	// shouldn't get here
+-	return optional<wait_result>(make_pair(false, 0));
++	return boost::optional<wait_result>(make_pair(false, 0));
+ }
+ 
+ struct timespec
+--- a/caching/cache_restore.cc
++++ b/caching/cache_restore.cc
+@@ -40,8 +40,8 @@
+ 			  override_version(1) {
+ 		}
+ 
+-		optional<string> input;
+-		optional<string> output;
++		boost::optional<string> input;
++		boost::optional<string> output;
+ 
+ 		uint32_t metadata_version;
+ 		bool clean_shutdown;
+@@ -154,11 +154,11 @@
+ 			return 0;
+ 
+ 		case 'i':
+-			fs.input = optional<string>(string(optarg));
++			fs.input = boost::optional<string>(string(optarg));
+ 			break;
+ 
+ 		case 'o':
+-			fs.output = optional<string>(string(optarg));
++			fs.output = boost::optional<string>(string(optarg));
+ 			break;
+ 
+ 		case 'q':
+--- a/caching/cache_writeback.cc
++++ b/caching/cache_writeback.cc
+@@ -150,7 +150,7 @@
+ 		}
+ 
+ 		void check_for_completed_copies(bool block = false) {
+-			optional<copy_op> mop;
++			boost::optional<copy_op> mop;
+ 
+ 			do {
+ 				if (block)
+--- a/era/era_invalidate.cc
++++ b/era/era_invalidate.cc
+@@ -27,7 +27,7 @@
+ 		}
+ 
+ 		bool metadata_snapshot_;
+-		optional<uint32_t> era_threshold_;
++		boost::optional<uint32_t> era_threshold_;
+ 	};
+ 
+ 	//--------------------------------
+@@ -88,7 +88,7 @@
+ 		walk_writeset_tree(md.tm_, *md.writeset_tree_, v, dv);
+ 	}
+ 
+-	void mark_blocks_since(metadata const &md, optional<uint32_t> const &threshold, set<uint32_t> &result) {
++	void mark_blocks_since(metadata const &md, boost::optional<uint32_t> const &threshold, set<uint32_t> &result) {
+ 		if (!threshold)
+ 			// Can't get here, just putting in to pacify the compiler
+ 			throw std::runtime_error("threshold not set");
+--- a/era/era_restore.cc
++++ b/era/era_restore.cc
+@@ -28,8 +28,8 @@
+ 			: quiet(false) {
+ 		}
+ 
+-		optional<string> input;
+-		optional<string> output;
++		boost::optional<string> input;
++		boost::optional<string> output;
+ 		bool quiet;
+ 	};
+ 
+@@ -99,11 +99,11 @@
+ 			return 0;
+ 
+ 		case 'i':
+-			fs.input = optional<string>(string(optarg));
++			fs.input = boost::optional<string>(string(optarg));
+ 			break;
+ 
+ 		case 'o':
+-			fs.output = optional<string>(string(optarg));
++			fs.output = boost::optional<string>(string(optarg));
+ 			break;
+ 
+ 		case 'q':
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -162,7 +162,7 @@
+ TOP_BUILDDIR:=@top_builddir@
+ CFLAGS+=-fPIC
+ CFLAGS+=@LFS_FLAGS@
+-CXXFLAGS+=-fPIC -fno-strict-aliasing -std=c++11
++CXXFLAGS+=-fPIC -fno-strict-aliasing
+ 
+ ifeq ("@DEVTOOLS@", "yes")
+ CXXFLAGS+=-DDEV_TOOLS
+--- a/persistent-data/hex_dump.h
++++ b/persistent-data/hex_dump.h
+@@ -19,6 +19,7 @@
+ #ifndef HEX_DUMP_H
+ #define HEX_DUMP_H
+ 
++#include <cstddef>
+ #include <iosfwd>
+ 
+ //----------------------------------------------------------------
+--- a/persistent-data/transaction_manager.cc
++++ b/persistent-data/transaction_manager.cc
+@@ -48,7 +48,7 @@
+ transaction_manager::write_ref
+ transaction_manager::new_block(validator v)
+ {
+-	optional<block_address> mb = sm_->new_block();
++	boost::optional<block_address> mb = sm_->new_block();
+ 	if (!mb)
+ 		throw runtime_error("transaction_manager::new_block() couldn't allocate new block");
+ 
+@@ -67,7 +67,7 @@
+ 		return make_pair(bm_->write_lock(orig, v), need_inc);
+ 
+ 	read_ref src = bm_->read_lock(orig, v);
+-	optional<block_address> mb = sm_->new_block();
++	boost::optional<block_address> mb = sm_->new_block();
+ 	if (!mb)
+ 		throw runtime_error("transaction_manager::shadow() couldn't allocate new block");
+ 
+--- a/thin-provisioning/metadata_checker.cc
++++ b/thin-provisioning/metadata_checker.cc
+@@ -182,7 +182,7 @@
+ 	error_state examine_mapping_tree_(transaction_manager::ptr tm,
+ 					  superblock_detail::superblock const &sb,
+ 					  nested_output &out,
+-                                          optional<space_map::ptr> data_sm,
++                                          boost::optional<space_map::ptr> data_sm,
+ 					  bool ignore_non_fatal) {
+ 		out << "examining mapping tree" << end_message();
+ 		nested_output::nest _ = out.push();
+@@ -213,7 +213,7 @@
+ 	error_state examine_mapping_tree(transaction_manager::ptr tm,
+ 					 superblock_detail::superblock const &sb,
+ 					 nested_output &out,
+-	                                 optional<space_map::ptr> data_sm,
++	                                 boost::optional<space_map::ptr> data_sm,
+ 					 bool ignore_non_fatal) {
+ 		error_state err = examine_devices_tree_(tm, sb, out, ignore_non_fatal);
+ 		err << examine_mapping_tree_(tm, sb, out, data_sm, ignore_non_fatal);
+@@ -403,7 +403,7 @@
+ 				// until that there's a better solution in space
+ 				// and time complexity
+ 				space_map::ptr data_sm{open_disk_sm(*tm, &sb.data_space_map_root_)};
+-				optional<space_map::ptr> core_sm;
++				boost::optional<space_map::ptr> core_sm;
+ 				err_ << examine_data_mappings(tm, sb, options_.data_mapping_opts_, out_, core_sm);
+ 
+ 				if (err_ == FATAL)
+@@ -418,7 +418,7 @@
+ 					err_ << compare_space_maps(data_sm, *core_sm, out_);
+ 			} else
+ 				err_ << examine_data_mappings(tm, sb, options_.data_mapping_opts_, out_,
+-							      optional<space_map::ptr>());
++							      boost::optional<space_map::ptr>());
+
+ 			metadata_checked_ = true;
+ 		}
+@@ -509,7 +509,7 @@
+ 				      superblock_detail::superblock const &sb,
+ 				      check_options::data_mapping_options option,
+ 				      nested_output &out,
+-                                      optional<space_map::ptr> data_sm) {
++                                      boost::optional<space_map::ptr> data_sm) {
+ 			error_state err = NO_ERROR;
+ 
+ 			switch (option) {
+--- a/thin-provisioning/metadata_dumper.cc
++++ b/thin-provisioning/metadata_dumper.cc
+@@ -125,7 +125,7 @@
+ 	};
+ 
+ 	// See comment on get_map_ids
+-	optional<set<uint32_t> >
++	boost::optional<set<uint32_t> >
+ 	get_dev_ids(transaction_manager &tm, block_address root) {
+ 		d_thin_id_extractor de;
+ 		fatal_details_damage dv;
+@@ -134,7 +134,7 @@
+ 		try {
+ 			walk_device_tree(tree, de, dv, true);
+ 		} catch (...) {
+-			return optional<set<uint32_t>>();
++			return boost::optional<set<uint32_t>>();
+ 		}
+ 
+ 		return de.dd_;
+@@ -150,7 +150,7 @@
+ 
+ 	// The walk will do more sanity checks than we did when scanning the metadata, so
+ 	// it's possible that it will fail and throw a metadata damage exception.
+-	optional<set<uint32_t> >
++	boost::optional<set<uint32_t> >
+ 	get_map_ids(transaction_manager &tm, block_address root) {
+ 		m_thin_id_extractor me;
+ 		fatal_mapping_damage mv;
+@@ -159,7 +159,7 @@
+ 		try {
+ 			walk_mapping_tree(tree, me, mv, true);
+ 		} catch (...) {
+-			return optional<set<uint32_t>>();
++			return boost::optional<set<uint32_t>>();
+ 		}
+ 
+ 		return me.dd_;
+@@ -288,7 +288,7 @@
+ 			uint32_t time;
+ 		};
+ 
+-		optional<roots>
++		boost::optional<roots>
+ 		find_best_roots(transaction_manager &tm) {
+ 			vector<node_info> mapping_roots;
+ 			vector<node_info> device_roots;
+@@ -334,7 +334,7 @@
+ 			if (pairs.size())
+ 				return mk_roots(pairs[0]);
+ 			else
+-				return optional<roots>();
++				return boost::optional<roots>();
+ 		}
+ 
+ 	private:
+@@ -623,12 +623,12 @@
+ 			}
+ 		}
+ 
+-		optional<node_info> lookup_info(block_address b) const {
++		boost::optional<node_info> lookup_info(block_address b) const {
+ 			auto it = infos_.find(b);
+ 			if (it == infos_.end())
+-				return optional<node_info>();
++				return boost::optional<node_info>();
+ 
+-			return optional<node_info>(it->second);
++			return boost::optional<node_info>(it->second);
+ 		}
+ 
+ 		block_manager &bm_;
+@@ -846,16 +846,16 @@
+ 		return sb;
+ 	}
+ 
+-	optional<superblock_detail::superblock>
++	boost::optional<superblock_detail::superblock>
+ 	maybe_read_superblock(block_manager::ptr bm)
+ 	{
+ 		try {
+ 			auto sb = read_superblock(bm);
+-			return optional<superblock_detail::superblock>(sb);
++			return boost::optional<superblock_detail::superblock>(sb);
+ 		} catch (...) {
+ 		}
+ 
+-		return optional<superblock_detail::superblock>();
++		return boost::optional<superblock_detail::superblock>();
+ 	}
+ 
+ 	void
+--- a/thin-provisioning/thin_dump.cc
++++ b/thin-provisioning/thin_dump.cc
+@@ -50,7 +50,7 @@
+ 		string format;
+ 		bool repair;
+ 		bool use_metadata_snap;
+-		optional<block_address> snap_location;
++		boost::optional<block_address> snap_location;
+ 	};
+ 
+ 	metadata::ptr open_metadata(string const &path, struct flags &flags) {
+--- a/thin-provisioning/thin_ls.cc
++++ b/thin-provisioning/thin_ls.cc
+@@ -238,7 +238,7 @@
+ 
+ 	void pass1(metadata::ptr md, mapping_set &mappings, ::uint64_t dev_id) {
+ 		dev_tree::key k = {dev_id};
+-		optional<::uint64_t> dev_root = md->mappings_top_level_->lookup(k);
++		boost::optional<::uint64_t> dev_root = md->mappings_top_level_->lookup(k);
+ 
+ 		if (!dev_root)
+ 			throw runtime_error("couldn't find mapping tree root");
+@@ -254,7 +254,7 @@
+ 
+ 	block_address count_exclusives(metadata::ptr md, mapping_set const &mappings, ::uint64_t dev_id) {
+ 		dev_tree::key k = {dev_id};
+-		optional<::uint64_t> dev_root = md->mappings_top_level_->lookup(k);
++		boost::optional<::uint64_t> dev_root = md->mappings_top_level_->lookup(k);
+ 
+ 		if (!dev_root)
+ 			throw runtime_error("couldn't find mapping tree root");
+@@ -324,7 +324,7 @@
+ 		metadata::ptr md;
+ 
+ 		if (flags.use_metadata_snap)
+-			md.reset(new metadata(bm, optional<block_address>()));
++			md.reset(new metadata(bm, boost::optional<block_address>()));
+ 		else
+ 			md.reset(new metadata(bm));
+ 
+--- a/unit-tests/bitset_t.cc
++++ b/unit-tests/bitset_t.cc
+@@ -60,14 +60,14 @@
+ 			  tm_(bm_, sm_) {
+ 		}
+ 
+-		bitset::ptr
++		persistent_data::bitset::ptr
+ 		create_bitset() {
+-			return bitset::ptr(new bitset(tm_));
++			return persistent_data::bitset::ptr(new persistent_data::bitset(tm_));
+ 		}
+ 
+-		bitset::ptr
++		persistent_data::bitset::ptr
+ 		open_bitset(block_address root, unsigned count) {
+-			return bitset::ptr(new bitset(tm_, root, count));
++			return persistent_data::bitset::ptr(new persistent_data::bitset(tm_, root, count));
+ 		}
+ 
+ 	private:
+@@ -81,7 +81,7 @@
+ 
+ TEST_F(BitsetTests, create_empty_bitset)
+ {
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 	ASSERT_THROW(bs->get(0), runtime_error);
+ }
+ 
+@@ -89,7 +89,7 @@
+ {
+ 	unsigned const COUNT = 100000;
+ 
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 	bs->grow(COUNT, false);
+ 
+ 	for (unsigned i = 0; i < COUNT; i++)
+@@ -100,7 +100,7 @@
+ {
+ 	unsigned const COUNT = 100000;
+ 
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 	bs->grow(COUNT, true);
+ 
+ 	for (unsigned i = 0; i < COUNT; i++)
+@@ -111,7 +111,7 @@
+ {
+ 	unsigned const COUNT = 100000;
+ 
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 	bs->grow(COUNT, false);
+ 	ASSERT_THROW(bs->grow(COUNT / 2, false), runtime_error);
+ }
+@@ -120,7 +120,7 @@
+ {
+ 	unsigned const COUNT = 100000;
+ 	unsigned const STEP = 37;
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 
+ 	vector<unsigned> chunks;
+ 	unsigned c;
+@@ -150,7 +150,7 @@
+ TEST_F(BitsetTests, set_out_of_bounds_throws)
+ {
+ 	unsigned const COUNT = 100000;
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 
+ 	ASSERT_THROW(bs->set(0, true), runtime_error);
+ 	bs->grow(COUNT, true);
+@@ -160,7 +160,7 @@
+ TEST_F(BitsetTests, set_works)
+ {
+ 	unsigned const COUNT = 100000;
+-	bitset::ptr bs = create_bitset();
++	persistent_data::bitset::ptr bs = create_bitset();
+ 
+ 	bs->grow(COUNT, true);
+ 	for (unsigned i = 0; i < COUNT; i += 7)
+@@ -176,7 +176,7 @@
+ 	block_address root;
+ 
+ 	{
+-		bitset::ptr bs = create_bitset();
++		persistent_data::bitset::ptr bs = create_bitset();
+ 
+ 		bs->grow(COUNT, true);
+ 		for (unsigned i = 0; i < COUNT; i += 7)
+@@ -186,7 +186,7 @@
+ 	}
+ 
+ 	{
+-		bitset::ptr bs = open_bitset(root, COUNT);
++		persistent_data::bitset::ptr bs = open_bitset(root, COUNT);
+ 		for (unsigned i = 0; i < COUNT; i++)
+ 			ASSERT_THAT(bs->get(i), Eq(i % 7 ? true : false));
+ 	}
+@@ -198,7 +198,7 @@
+ 	block_address root;
+ 
+ 	{
+-		bitset::ptr bs = create_bitset();
++		persistent_data::bitset::ptr bs = create_bitset();
+ 
+ 		bs->grow(COUNT, true);
+ 		for (unsigned i = 0; i < COUNT; i += 7)
+@@ -211,7 +211,7 @@
+ 	}
+ 
+ 	{
+-		bitset::ptr bs = open_bitset(root, COUNT);
++		persistent_data::bitset::ptr bs = open_bitset(root, COUNT);
+ 		bitset_checker c(COUNT, 7);
+ 		bs->walk_bitset(c);
+ 	}
+--- a/unit-tests/copier_t.cc
++++ b/unit-tests/copier_t.cc
+@@ -32,23 +32,27 @@
+ namespace {
+ 	unsigned const BLOCK_SIZE = 64u;
+ 	using wait_result = io_engine::wait_result;
++}
+ 
+-	ostream &operator <<(ostream &out, optional<wait_result> const &mwr) {
++namespace boost {
++	ostream &operator <<(ostream &out, boost::optional<wait_result> const &mwr) {
+ 		if (mwr) {
+ 			out << "Just[wait_result[" << mwr->first << ", " << mwr->second << "]]";
+ 		} else
+ 			out << "Nothing";
+ 		return out;
+ 	}
++}
+ 
++namespace {
+ 	class io_engine_mock : public io_engine {
+ 	public:
+ 		MOCK_METHOD3(open_file, handle(string const &, mode, sharing));
+ 		MOCK_METHOD1(close_file, void(handle));
+ 		MOCK_METHOD6(issue_io, bool(handle, dir, sector_t, sector_t, void *, unsigned));
+ 
+-		MOCK_METHOD0(wait, optional<wait_result>());
+-		MOCK_METHOD1(wait, optional<wait_result>(unsigned &));
++		MOCK_METHOD0(wait, boost::optional<wait_result>());
++		MOCK_METHOD1(wait, boost::optional<wait_result>(unsigned &));
+ 	};
+ 
+ 	class CopierTests : public Test {
+@@ -72,8 +76,8 @@
+ 							     BLOCK_SIZE, 1 * 1024 * 1024));
+ 		}
+ 
+-		static optional<wait_result> make_wr(bool success, unsigned context) {
+-			return optional<wait_result>(wait_result(success, context));
++		static boost::optional<wait_result> make_wr(bool success, unsigned context) {
++			return boost::optional<wait_result>(wait_result(success, context));
+ 		}
+ 
+ 		void issue_successful_op(copier &c, copy_op &op, unsigned context) {
+@@ -258,7 +262,7 @@
+ 		WillOnce(Return(true));
+ 
+ 	EXPECT_CALL(engine_, wait(micro)).
+-		WillOnce(DoAll(SetArgReferee<0>(0u), Return(optional<wait_result>())));
++		WillOnce(DoAll(SetArgReferee<0>(0u), Return(boost::optional<wait_result>())));
+ 
+ 	auto mop = c->wait(micro);
+ 	ASSERT_FALSE(mop);
+--- a/unit-tests/rolling_hash_t.cc
++++ b/unit-tests/rolling_hash_t.cc
+@@ -127,10 +127,10 @@
+ 	unsigned min = 100000, max = 0;
+
+ 	bytes bs = random_bytes(1024 * 1024 * 100);
+-	vector<unsigned> counts(window_size_, 0);
++	vector<unsigned> counts(window_size_ + 1, 0);
+ 
+ 	for (unsigned i = 0; i < bs.size(); i++) {
+-		optional<unsigned> b = h_.step(bs[i]);
++		boost::optional<unsigned> b = h_.step(bs[i]);
+ 		if (b) {
+ 			counts[*b]++;
+ 
+--- a/unit-tests/span_iterator_t.cc
++++ b/unit-tests/span_iterator_t.cc
+@@ -81,7 +81,9 @@
+ 
+ 		base::run_set<block_address> forbidden;
+ 	};
++}
+ 
++namespace boost {
+ 	ostream &operator <<(ostream &out, maybe_span const &m) {
+ 		out << "maybe_span[";
+ 		if (m)
diff --git a/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-0.9.0-r4.ebuild b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-0.9.0-r4.ebuild
new file mode 100644
index 00000000000..ce538347406
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-block/thin-provisioning-tools/thin-provisioning-tools-0.9.0-r4.ebuild
@@ -0,0 +1,70 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic
+
+DESCRIPTION="A suite of tools for thin provisioning on Linux"
+HOMEPAGE="https://github.com/jthornber/thin-provisioning-tools"
+
+if [[ ${PV} != *9999 ]]; then
+	SRC_URI="https://github.com/jthornber/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+else
+	inherit git-r3
+	EGIT_REPO_URI='https://github.com/jthornber/thin-provisioning-tools.git'
+fi
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="static test"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="dev-libs/expat[static-libs(+)]
+	dev-libs/libaio[static-libs(+)]"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(+)]} )"
+DEPEND="${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+	test? (
+		>=dev-cpp/gtest-1.8.0
+	)
+	dev-libs/boost"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.7.0-build-fixes.patch
+	"${FILESDIR}"/${PN}-0.9.0-build-fixes.patch
+	"${FILESDIR}"/0.9.0-remove-boost_iostreams.patch
+	"${FILESDIR}"/${PN}-0.9.0-metadata_checker-Rename-function-to-reflect-command-.patch
+	"${FILESDIR}"/${PN}-0.9.0-thin_check-Allow-using-clear-needs-check-and-skip-ma.patch
+	"${FILESDIR}"/${PN}-0.9.0-boost-gtest.patch
+)
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	use static && append-ldflags -static
+	local myeconfargs=(
+		--prefix="${EPREFIX}"/
+		--bindir="${EPREFIX}"/sbin
+		--with-optimisation=''
+		$(use_enable test testing)
+	)
+	STRIP=true econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	emake V=
+}
+
+src_test() {
+	emake V= unit-test
+}
+
+src_install() {
+	emake V= DESTDIR="${D}" DATADIR="${ED}/usr/share" install
+	dodoc README.md TODO.org
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
index f9cff1890d4..de1dcd4ed1a 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/Manifest
@@ -1,2 +1 @@
-DIST binutils-config-5.4.1.tar.xz 7328 BLAKE2B 51f0ca625abfd964cc1b6c902017edc9790da1d33a44b3da64e3b2c68ed245fc1c0eb8b3fb999f6acb88e614f47e2f53e19b456b03c069bb61cd0f39e85d786d SHA512 af12644d591152f45d573bee0499b21c293b68a9b81626e9e1d46d5a7dc40e9a24642364bdb2bce52d61cbe3d2e045f4ab6e50a9827648a820bac885f20239cd
 DIST binutils-config-5.5.tar.xz 7344 BLAKE2B decef43013ca2f7c6d36c12d08d55f499d866b6b1b55ed58f8b2df3761077b5e2c4d09d1f2c40762d42c2d3b9827575833a502b79180ef13b845f1a39a5f2feb SHA512 6f6e21799b47e38cd61621e4ec018dc0db4811f363c0817025c3e3be651d3790b30a0cab233f35fe40b1d57c88daa246037f24a7488187f4e47cca589d87d45b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.4.1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.4.1.ebuild
deleted file mode 100644
index eafb482fa18..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.4.1.ebuild
+++ /dev/null
@@ -1,43 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit prefix
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/binutils-config.git"
-	inherit git-r3
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="Utility to change the binutils version being used"
-HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Toolchain"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+native-symlinks"
-
-# We also RDEPEND on sys-apps/findutils which is in base @system
-RDEPEND="sys-apps/gentoo-functions"
-
-src_compile() {
-	emake PV="${PV}" USE_NATIVE_LINKS="$(usex native-symlinks)"
-}
-
-src_install() {
-	emake DESTDIR="${D}" PV="${PV}" install
-
-	use prefix && eprefixify "${ED}"/usr/bin/${PN}
-}
-
-pkg_postinst() {
-	# Re-register all targets. USE flags or new versions can change
-	# installed symlinks.
-	local x
-	for x in $(binutils-config -C -l 2>/dev/null | awk '$NF == "*" { print $2 }') ; do
-		binutils-config ${x}
-	done
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.ebuild
index b6c0c1958e9..b6729edc835 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-5.5.ebuild
@@ -14,7 +14,7 @@ fi
 DESCRIPTION="Utility to change the binutils version being used"
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Toolchain"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2 GPL-2+"
 SLOT="0"
 IUSE="+native-symlinks"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-9999.ebuild
index 4a85f28d4cd..c1bb9c114e9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/binutils-config/binutils-config-9999.ebuild
@@ -14,7 +14,7 @@ fi
 DESCRIPTION="Utility to change the binutils version being used"
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Toolchain"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2 GPL-2+"
 SLOT="0"
 IUSE="+native-symlinks"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
index ad4c3f1ad0c..4a3b4caa6f9 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/Manifest
@@ -1,3 +1,4 @@
 DIST crossdev-20230321.tar.xz 29620 BLAKE2B a5070ccf8b5e4fd9a6f63f6a903126a6eb199d7dfdcfbe93f0917a66894c4eef2df5749c0fddaf564fe013b40a14d88b2686700034642fb1d876b51731964a49 SHA512 c300b506bb7ed4aa5d43601b37c8298367f6e5307a97b19a23f39e9559e54d2bfdb6e2b7a5fde4d5ff0b4a9b02c1b6f05be92d1857352db6cde9a469c9159e5f
 DIST crossdev-20230616.tar.xz 29628 BLAKE2B 856f24f6afcdff8e9283ef9a90ff78312123aaad8386f7003d120b5c00cd74f6ba3a911979739434696ceedc13f432d05b60ef3349ade03aa4b49afa9e59a3fa SHA512 373ebd0c776a8d687bd11faa502a7b513f1e1dce5e310a1783349c7c2ad5b2b7e9bc51a59fdcb4414cb94faabc14ec3d723b187658ce35b4ebf73e4386d69930
 DIST crossdev-20230831.tar.xz 30792 BLAKE2B d8c738ff37dca4de64964fa51fec9981fd4b6ef101cd15d05a15ba8aa08d7e7fd3ad9dd56fdcd103b31fff2e458e94ffa22d586313f7c620fe7099cf0d9a662b SHA512 4e41e6ce37670f908d28adc76badd46532d89351240fe77e47aaf660f14da52320e30e55fee047464876bf7b6aab6968232d88fd8c69b62a3e4a83a8a8aad1dc
+DIST crossdev-20230923.tar.xz 30824 BLAKE2B f67d57cfcffcbefe56c9150e97b7189c79a87a8d75e41a2e47441ed23ec248d1b0fd6ef774f81e6086544b9d1551a14a4a49917fdb5366dfc9d1a2439f87d68e SHA512 b9048a19b388eebfe42b2fcb27c100fc574d81a4a2d6a11ef08f8552b49b5690c6e076a379a6c50cf45567faa00dface225a8539dacf44d1bfae12d4ab05ee2b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20230923.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20230923.ebuild
new file mode 100644
index 00000000000..8938d96f9d5
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/crossdev/crossdev-20230923.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+if [[ ${PV} == "99999999" ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="
+		https://anongit.gentoo.org/git/proj/crossdev.git
+		https://github.com/gentoo/crossdev
+	"
+else
+	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+fi
+
+DESCRIPTION="Gentoo Cross-toolchain generator"
+HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Crossdev"
+
+LICENSE="GPL-2"
+SLOT="0"
+
+RDEPEND="
+	>=sys-apps/portage-2.1
+	app-shells/bash
+	sys-apps/gentoo-functions
+	sys-apps/config-site
+"
+BDEPEND="app-arch/xz-utils"
+
+src_install() {
+	default
+
+	if [[ ${PV} == "99999999" ]] ; then
+		sed -i "s:@CDEVPV@:${EGIT_VERSION}:" "${ED}"/usr/bin/crossdev || die
+	fi
+
+	dodir /usr/share/config.site.d
+	mv "${ED}"/usr/share/config.site{,.d/80crossdev.conf} || die
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
index 766d8b19aee..d36547d79eb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/Manifest
@@ -1,3 +1 @@
-DIST gcc-config-2.10.tar.xz 18040 BLAKE2B de902fcf9169290a09988b56fa75f1bf24f702ce98a8fe37b6d4fe090bab615716c32a9e219d25a2257c60099eb4424b86cc1a1565c1b4f3dbcd6c9acad6f340 SHA512 cced56c52d97cbace5fb7e1fc9c73b413454bc5c53641c9429a7da88a0b31db2c70a8b90a4b4b0fbe1e732f21a5f979a4721a7bc8537666f8277b7755bd4af52
 DIST gcc-config-2.11.tar.xz 18068 BLAKE2B 0d76321adea9eff545e042ad847b70a5b3d8ecb8c248fdf58f71c88a7b03c0aca39f7d39e332808b89c3f6d0fb3fc3114bc2d8dfa1ade6460c0b12c3420d876f SHA512 38ea52c2d16287fc2c8efa0ee76e24563851b4fa1ee7dce601507df1530e7a867281f178ad4228505eb2aaf46164024a18825cd6771d847ff1a60a85d6e96d3e
-DIST gcc-config-2.8.tar.xz 17968 BLAKE2B aa34e681ef0c86bb846d89b816b46276f5c7c32974c785a9611a903a4fe165c997a34664abe17aa4d8720a96f194054e5d8c371a6c9270b1c235d7539094436c SHA512 5e91df44fb7782b9ad41ed06fbd53f74868c059f892c6c2b8195ebaa899905dd9f502562887f1a3765dd6b61698e956d01c6fa6f97a535cf16e26e70fcd902ba
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.10.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.10.ebuild
deleted file mode 100644
index c83d173cad6..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.10.ebuild
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/gcc-config.git"
-	inherit git-r3
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="Utility to manage compilers"
-HOMEPAGE="https://gitweb.gentoo.org/proj/gcc-config.git/"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+cc-wrappers +native-symlinks"
-
-RDEPEND=">=sys-apps/gentoo-functions-0.10"
-
-_emake() {
-	emake \
-		PV="${PVR}" \
-		SUBLIBDIR="$(get_libdir)" \
-		USE_CC_WRAPPERS="$(usex cc-wrappers)" \
-		USE_NATIVE_LINKS="$(usex native-symlinks)" \
-		TOOLCHAIN_PREFIX="${CHOST}-" \
-		"$@"
-}
-
-src_compile() {
-	_emake
-}
-
-src_install() {
-	_emake DESTDIR="${D}" install
-}
-
-pkg_postinst() {
-	# Do we have a valid multi ver setup ?
-	local x
-	for x in $(gcc-config -C -l 2>/dev/null | awk '$NF == "*" { print $2 }') ; do
-		gcc-config ${x}
-	done
-
-	# USE flag change can add or delete files in /usr/bin worth recaching
-	if [[ ! ${ROOT} && -f ${EPREFIX}/usr/share/eselect/modules/compiler-shadow.eselect ]] ; then
-		eselect compiler-shadow update all
-	fi
-
-	if ! has_version "sys-devel/gcc[gcj(-)]" && [[ -x "${EROOT}"/usr/bin/gcj ]] ; then
-		# Warn about obsolete /usr/bin/gcj for bug #804178
-		ewarn "Obsolete GCJ wrapper found: ${EROOT}/usr/bin/gcj!"
-		ewarn "Please delete this file unless you know it is needed (e.g. custom gcj install)."
-		ewarn "If you have no idea what this means, please delete the file:"
-		ewarn " rm ${EROOT}/usr/bin/gcj"
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild
index c83d173cad6..f387c81e5cb 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.11.ebuild
@@ -14,7 +14,7 @@ fi
 DESCRIPTION="Utility to manage compilers"
 HOMEPAGE="https://gitweb.gentoo.org/proj/gcc-config.git/"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2 GPL-2+"
 SLOT="0"
 IUSE="+cc-wrappers +native-symlinks"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.8.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.8.ebuild
deleted file mode 100644
index e9660497da1..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-2.8.ebuild
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://anongit.gentoo.org/git/proj/gcc-config.git"
-	inherit git-r3
-else
-	SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-DESCRIPTION="Utility to manage compilers"
-HOMEPAGE="https://gitweb.gentoo.org/proj/gcc-config.git/"
-
-LICENSE="GPL-2"
-SLOT="0"
-IUSE="+cc-wrappers +native-symlinks"
-
-RDEPEND=">=sys-apps/gentoo-functions-0.10"
-
-_emake() {
-	emake \
-		PV="${PVR}" \
-		SUBLIBDIR="$(get_libdir)" \
-		USE_CC_WRAPPERS="$(usex cc-wrappers)" \
-		USE_NATIVE_LINKS="$(usex native-symlinks)" \
-		TOOLCHAIN_PREFIX="${CHOST}-" \
-		"$@"
-}
-
-src_compile() {
-	_emake
-}
-
-src_install() {
-	_emake DESTDIR="${D}" install
-}
-
-pkg_postinst() {
-	# Do we have a valid multi ver setup ?
-	local x
-	for x in $(gcc-config -C -l 2>/dev/null | awk '$NF == "*" { print $2 }') ; do
-		gcc-config ${x}
-	done
-
-	# USE flag change can add or delete files in /usr/bin worth recaching
-	if [[ ! ${ROOT} && -f ${EPREFIX}/usr/share/eselect/modules/compiler-shadow.eselect ]] ; then
-		eselect compiler-shadow update all
-	fi
-
-	if ! has_version "sys-devel/gcc[gcj(-)]" && [[ -x "${EROOT}"/usr/bin/gcj ]] ; then
-		# Warn about obsolete /usr/bin/gcj for bug #804178
-		ewarn "Obsolete GCJ wrapper found: ${EROOT}/usr/bin/gcj!"
-		ewarn "Please delete this file unless you know it is needed (e.g. custom gcj install)."
-		ewarn "If you have no idea what this means, please delete the file:"
-		ewarn " rm ${EROOT}/usr/bin/gcj"
-	fi
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-9999.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-9999.ebuild
index 7ff12f007e3..a314266369e 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-9999.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc-config/gcc-config-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -14,7 +14,7 @@ fi
 DESCRIPTION="Utility to manage compilers"
 HOMEPAGE="https://gitweb.gentoo.org/proj/gcc-config.git/"
 
-LICENSE="GPL-2"
+LICENSE="GPL-2 GPL-2+"
 SLOT="0"
 IUSE="+cc-wrappers +native-symlinks"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
index caf170e30e3..59f6d5ba9a8 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/Manifest
@@ -1,55 +1,25 @@
 DIST gcc-10-20230426.tar.xz 72118868 BLAKE2B d87cfd78d96585877abc20ed213e4d2fba36556279a5bce5d185de34a59f8cde1250d7322543533922ef224ac8508c1d3fe597c652a648e6e7f08bc19cb2f11c SHA512 805fbb840e6bd8cdd53f954b13c768c0ea0635c099094f6f0b0b04f00120dcde7cf3950a01e199d674b39ff764e9119a548b2f7a156ab2b5d598bd68ed56ce24
-DIST gcc-10-20230621.tar.xz 72149848 BLAKE2B 83d367c1fb8e68b3e61273a324cd3829ccd3091a1346bc88f76ee2d6c86fb4c644d30c0594a024df4d53c6c6a02eb2b98ba44ac6db7e8ea4ddb96c795e202d9b SHA512 b03520cf64643ac887e4c32c7e3a31ed54ff96bd5421ff2892675e26ae188ed8dcba88edbca79ec13bed3a052a98eea92fdd6bdd76ad1131a16f7c637a36360d
 DIST gcc-10.5.0-musl-patches-2.tar.xz 3452 BLAKE2B 5387e516d07d81477b3f39b8b3bd986bf861d32cd25dc5481c97bd3620d00c918c5661e86857f66dbf28a655401a53e43417f638c443e44cbfdbf5e950caac4d SHA512 86f2ce31cc4fc4fb5a6043fb527bf822d895e1a6220652024f78a1cbd5a962edb6be8dc5f43c32053e075f39bb2350ea8f14e7d57e0473dd2933a7b44676bde5
 DIST gcc-10.5.0-patches-6.tar.xz 18208 BLAKE2B 4cac3340108fb378c76ad62b728429f3c97f348d178744e7536575f3576ca8aa682b878b7df3b1c162dccae64a3cb56c66d8d60eae323e1ece2de4278084fdbd SHA512 9d6c84325fbc118cee01347468ce729c278e5b026b16da945fe54050726e26f86a46ee7b71a01a47cf927b70bfcce459c49a6bc4fb93dcfaa047c76d4c5bc5bc
 DIST gcc-10.5.0.tar.xz 77846412 BLAKE2B 9b71761f4015649514677784443886e59733ac3845f7dfaa4343f46327d36c08c403c444b9e492b870ac0b3f2e3568f972b7700a0ef05a497fb4066079b3143b SHA512 d86dbc18b978771531f4039465e7eb7c19845bf607dc513c97abf8e45ffe1086a99d98f83dfb7b37204af22431574186de9d5ff80c8c3c3a98dbe3983195bffd
 DIST gcc-11-20230427.tar.xz 76165128 BLAKE2B dd896b418c1fce35a61005d5b5c90cfd1246d37d23c2a8fc08bacd7d7ca84c353f3ccf5de2370ae5e5ca95c7ae3deab3565b3f65eb78b611dbe5ad4a256516f0 SHA512 fada917a832be5d2e15ee32f24e19fc87b851dc8e6fc75d1be6d25d3510dba408ae3ef3b245ff239c51aa3d243c95f12269695611e5c8965ba55f5aa4730778d
 DIST gcc-11-20230622.tar.xz 76199316 BLAKE2B a769dc6be63eabca3bc33944b471d727bf230e506773c85977156b187f12664f2cd3e0992a1faefda8ec88ff85d1a8d12795121baadc7e8b9653d69a8025e46e SHA512 8dbc5a4b54f2bc52458914705af40a00b33e46061dd5b335b4b4a6e96d17206fe480d3fec564dd11ebcca6168f054984d706b1b26b7e694e8b327692a13ae7d1
-DIST gcc-11-20230727.tar.xz 76213292 BLAKE2B 8d15efab47a39695997b15d606c27929794c3b8a96da0243f336c78076daad4b322d37ddfca3d928b73ca7a68c25b05a7834596a27ac79d11d2c77777573f118 SHA512 e64b10ab59548695d538d0ca471efb7bb29dd751e719a8e7c1434182a8cf7433e28348fb08c3babe90bda952ee2e739a9fd055ac8b9ed883417066c836d2ffd3
-DIST gcc-11-20230803.tar.xz 76202192 BLAKE2B e268c236873635c7059a4f0c88f192eb3634eeba9d8f4d1cf974a2ceae60237024097f4b7a2015694144509492dc3a412c8f77af6f20e0611f2f73f25ce48e36 SHA512 df25cff801f93a858a8326baf74e0d3060208cfde85bce2c1ac1ed38860de04ca1c2c509ca1d43b413bcb4b12cb429cd7aa193bc38fb8a42128e31f0ac92ac21
-DIST gcc-11-20230810.tar.xz 76213220 BLAKE2B a58fc332238352bb5d30201451c1cd2505243f6c5f8c16c8a3373dba304fbbbc60cfccbac030783b3831d8c329c1e58b5014fc6304bee80c8d0b8689761b9805 SHA512 90ee5db43f978fba60231d0c2e0c8c1e9d4bff3f486226ccbf765e9b38fcf11e039bc1dd23f3fde1ff1ce22e9d9e5765b5198da41f61de47da1ab434abc4f1d8
-DIST gcc-11-20230817.tar.xz 76219020 BLAKE2B cb1c97f415e098765fc6b958617046f52f66ad193ea85109e89e9eb880c1dc9ceaf0c88bc11c58f7b8426f1156effe6ff78fa29cf3fae73ba2b043f125f6f1f0 SHA512 1e0d88ec6c877c427288d676719a0c945850197226d878b9c4c354473e1a9bc73558391b30c7450547526a99026b273dac2eb9e6ba4709452665e071a2fc7805
 DIST gcc-11-20230824.tar.xz 76202120 BLAKE2B 243ce16e28c66d681bb27df32866947309f8fa386e258896651b6853e390da79304250669096fd55cafe0a9d5adf4b3a3cf5989302f4ad13660ece80639b545a SHA512 a9cab8bf61f2a572baba73a2a11271eeb61d43f07411df376a8568820c1373f64f635d747933fda1e942ae717b0ae9f1c810f662fc09ccb075940248bc48b582
-DIST gcc-11-20230831.tar.xz 76211908 BLAKE2B 5feec7b77049dfb2d6372f869d99bd6ed4d2f6cf463e10b503cddf986c38f0c1b4fadcd53bf19e7ca763cf54fbf12766528f99e303f7691dd04f2b43e4d61eeb SHA512 210d61c90fbedf3c52de17d7d2792a90d8e1ad0498dc5fdbb2c21f90ba3d19bb69f0a94766b436121eb149be585358cbf10de66065e40eebb3750d78d165eef9
-DIST gcc-11-20230907.tar.xz 76271328 BLAKE2B 8bd407d603487dfaa52e28562e57a5895dbc3e76462d21de1a9671c3cf0306d0725129ea8468c9e28627329650745c29412f56a065e00188cc81df6fb78b8c64 SHA512 6b11dc113746a323a41bb52c33ec6a4af85818782fe4ba31fe553c5c723d2b8bcd20f4cb9552daf012ba45e0050112e7e6a51bab7c99b0305a17ffdf854b99ec
+DIST gcc-11-20230921.tar.xz 76227940 BLAKE2B b086b35bc7192be078d08f6c9363a9b343f8d97a1bc781870796cf564b829febeccb5f94739fb14a88357f7f66530ff3c23f298eed9341ffb6927a5ac4a40546 SHA512 20fd7e680303a8328e9c017ab21dc3cab46fe5684a08bfc48a342ec4e95cc94675db2e450483499f126b2d5943e3ef8115287a5b4da8718b966c0ffe9f79b925
 DIST gcc-11.4.0-musl-patches-2.tar.xz 4308 BLAKE2B a2335e155fc57816fed822a648e0eaefafcba9d04e1ad0fd7baeea5a694ab6f5e3c1678cb406f2a1bd17bab25cb01699d032713a1ccf337948dfda2093844607 SHA512 17b84f907cb1bd763873655e6f35fd3ed55a40b602b70a626f04f83b4cc89c6261db1661de78d4d969187a8c56e9f6305b742515a3836b962248a21df0df5d0c
 DIST gcc-11.4.0-patches-10.tar.xz 13852 BLAKE2B 54937d13e30e2a5303c7e197fae09eeed35ca0b9783625e02578fcee829b5503fb22d664366322b304df7d01ae807d00af7c93db3e3ceebe4851e15647724f87 SHA512 31b4d7a2e7cc589e92e12c3583d13d41c523cafbd309bc0532df9b68ea2473c89daef4c0edd3ce2917b5823d81a7792f145b9449f16277d0d64c22ceff50bbb9
 DIST gcc-11.4.0-patches-9.tar.xz 14704 BLAKE2B 9aa2ecbac493d3040694e9930738e57d59a764b90ab92b91709c319b883f28ad108767e5d11e8b62af40bf1e583d5ff83a03e8c895f904bc6f41315ce9ab4f0a SHA512 ac8b7c6c382ffacc4e9d08299440fc237fa366ec36fb8eb7a8d426b64a4186384a262e6380dc83ed7f7240125ce26a8435c8a4e0e13976ef2652067a7129bd17
-DIST gcc-11.4.0.tar.xz 79837032 BLAKE2B 6e3b095a5837d4b5512719f848f4b9c4b4a6d7dc40ba96b269023ea5ea84f632c42a13855c030e255f3265445a45e6d2648dfe0e2cc0ea47da87c4660b052e24 SHA512 a5018bf1f1fa25ddf33f46e720675d261987763db48e7a5fdf4c26d3150a8abcb82fdc413402df1c32f2e6b057d9bae6bdfa026defc4030e10144a8532e60f14
-DIST gcc-12-20230428.tar.xz 79744932 BLAKE2B f9d0000cdd2f1b0af79f281851b3b0fe0ac50f14468844e1ee596f8ed1ccf33f55c7617464d88df7e4b3435d58fedecf640592e0661fd1be9ba163acd26dae68 SHA512 992f9cd71f9910efea401048540ba2b43360170f76ce992cf356b1ab383240f481e29c5b0ad32fa4efb2bdbb397477506cb83a825268cfbdd2cde7044d43c758
 DIST gcc-12-20230526.tar.xz 79780444 BLAKE2B 6f6eca272ab506e16a231003c399e28572595c82fbaaec9deb14b78ff9fc493fb24afe1c375d4f2fd75e9813805934857ef2ceb6c05b7977dbfe2e50abdc3ec9 SHA512 fb190ce5bf3d38a1899016475c1551550d44c6f71f1f1a71ced545cbb2aff0446bd2765230b0920379579a13103a507ffc1e197ac69afb0a4f08efe11b50918d
-DIST gcc-12-20230623.tar.xz 79782948 BLAKE2B 6eeabdd1495482b8bc5a6f2f90cd7d7967b66664d277c5f755f1ee98ac2c99db1552ab13b1c69f4c47d1d0b8de584e6a5f024b45e3c5934f49179cf65ca30acc SHA512 09aa0304a8a916aea7a4714eb3a7541b2015e3bdb8ae9bd40bc289553c4ec86f91b054925d2af45f33af9d20a7422949e691c0f552d68ee1d5206b4007310a88
-DIST gcc-12-20230728.tar.xz 79813460 BLAKE2B 89db12fbdc7d75d298335fdd61b15439c161090deb94e224d13592d25fa64fd21c289f75fbe77e5c0d10f90e18019a12c343014e73ef446281ac8c471a39b937 SHA512 20c8bbe3918ed41b05b00cc3fa90e1ee59faf9ece876faf3e93ab01b2a79e6b83b55812e41d662ad1b9a420ca3f891f46cd70aa9f7f6bcf292dda0f57b56681e
-DIST gcc-12-20230804.tar.xz 79785996 BLAKE2B 6af25c245bed3affa42a265e56afc59afe7001603572223226b236efb67c804697a53b8f31ad68a5ddcaee1533212de87725bbad4acbb67a75e9b007e69fc071 SHA512 44b0c202f913913c586313a0f76bd721566e4519824a18b5569339e3996d556c866e7b980c341aa1d433f56fc8f18d2a11fc47e5bc91b693a3ecfdce37b9082b
-DIST gcc-12-20230811.tar.xz 79789344 BLAKE2B eac77a22bf93524e60320db7aeb7ecbfceb0f2e84596ed81b0e8f8ea985fbf412a88c42bf2d58f1aa42698e4cf2037d24fa5457ba4a7d18a5c14fde509b56399 SHA512 e9de50607ae2f8b1800346c1e7f85a042f363c5da00497fc7355d3e89f2e2196df8e04ee1514153cae4bbcc8c8dba187558f062a30ff977f7725576b624f5e42
-DIST gcc-12-20230818.tar.xz 79797008 BLAKE2B f838f69b699d74fedc2e9b038211bd0089d0ff38811ccbc45911dc2ef21452481216329b5398275ea36b1fc54052086daf5c7a86a7cdb53a14784b90d56c0dc7 SHA512 7a86639efb41fd2c9092729e9ebcdbb49d12bffb1ed6052b595892d2c3fab78955dda4d4fdbb89b4fb4ab2f827f458eb97ab01d76995267f2d7f1ee8cb6a0aad
 DIST gcc-12-20230825.tar.xz 79804260 BLAKE2B 4d3eb40eb5954d497b3e9586dad0d18c9e561d3fdd0bdccc5c9572edfbe024a235e30371a10116d98c77f0b6042739600c57ac99253d34f0fbb8b8465b187e1f SHA512 a6cd868f474c356886460b95263807828f9a379ce97524611ec504d6a9149ca1f92585128e6ffd03fa2647442e72fde6ebe987fd49f2fc49d8df39ab056905c5
-DIST gcc-12-20230901.tar.xz 79798068 BLAKE2B 2ed8b52dda448398e0c5954251f854c4051235c3c2364bdee1910ee513986f5b43cd776896b6a45f3479d7aef494aa0a956cee22338e004a7c0b8aa0d317ef99 SHA512 741e823916a025fe79779f40fb26518314eda45d004add8c6eaee7a6f32a25ac1afcfa1137d3cbec645a72cac83a759865dc37dee33d8fad2c742d6ce658fb8a
-DIST gcc-12-20230908.tar.xz 79788640 BLAKE2B 1ade0324dc16fba5ae410277d0af7ddfd1dc4bcce9bd6d887e955b9069cae986ffece4916313399d5439663ffb40b71aad236b8021b06cb2e777fa13f912f18f SHA512 f31e40d9c3683a6e35b6b0c5b40a8d12a14c964609244415ed4776179c3139a2aead3dde7df3c5e20691360656b98387acefb41c445c840fe3cb27ee05fa28df
+DIST gcc-12-20230922.tar.xz 79801244 BLAKE2B 9b7681a742ed7aa81f06f726d765d4b1259c199ec3fb5c3072b789491b99c966f1a5d90fbe357136b5f1dd8b046653c51653b8a7049ef0768049534b5364816a SHA512 41542d2ab1ebd3c5a342159bc58a2f891d89a6b87533a928193dd28dc8dc3e3b3e3e4e547be20c930f8e85014c76128cbedbe6f846524b67acd3af16e93c3189
 DIST gcc-12.3.0-musl-patches-1.tar.xz 3572 BLAKE2B c7bf65f7c9ea8023ddaac821ee2b778622fa310ac72a72b2f7032494a8f304eac86217f9204622e6c21aaef9952bece0d09bc126facd4f42b602927909815ab5 SHA512 babc279fea2c1fd4c018815f2f5630214fd46015ce9f365c28af242681d51818eaca30ce298eddcab1eed5ac5f2759e2b47b2335afab9d722b4469a6d4fec326
 DIST gcc-12.3.0-patches-2.tar.xz 14236 BLAKE2B 06c43662c9abb0fa3cf90d5e2273c69aecb9158e6cf6f23c04754ed5d686be2616e81e2502eb16f4298ddd50518ca7677e13249da9e9b091162d3931ff65e4fe SHA512 b0d4b85dbf1a54aaaa1997203b872e3106906b4ad49cde57e1428bc22b2f8e2d73b8cb10ae0d0b792aebaf664594da4d1dea04c44ddc34e59047410766db04d1
-DIST gcc-13-20230527.tar.xz 83956360 BLAKE2B 86a2131b88144817673a6300c73b29c2dbb8559a7057609601029aaf60aeb4c4926fa4b99c4e1768726cde09f994159685768b62b3ca73d7b606847788301e82 SHA512 87566c74258f9981742eae77f552361c220f79fa6f17c36d5b5a9e73f41c50d8a2cab16b9ffb17f07829005f0d42b4b1d524150d3dcba9710091532cbfad7152
-DIST gcc-13-20230729.tar.xz 84264252 BLAKE2B 85e0b8af941c6d57317bf68503ea278ecd9e0927e994e73b65b2a674610daa83d3081c9aa87326034b22e694e841d714734187a69ffc80d63d1f5e48d9514772 SHA512 46a42d79de118a16dc195605fd461034e9b41856fb11fee3bcce962517e713094935704aa88e1ca05f896176bee9eecfef835ee8858ea584421b924390fe3812
-DIST gcc-13-20230805.tar.xz 84271272 BLAKE2B a8898131c3d597417cd349a91d9015d27a7dcbd9bcdbf75c96da45b07fd48b0a2bb240e5e90cb138ebbe7ac9df7c43fc7ca768e88fc1ffe388ab38c4c07cd219 SHA512 386cf5ae6948f7dff45d82910bb52418e0e040a8d2802a658c05cc0bb0be16c880878a18af4fba7a5025132b77657c50b20e84e3ea77c1520a7a135013879750
-DIST gcc-13-20230812.tar.xz 84291228 BLAKE2B 5210e6d2dfc3250efb924ddd8ece283a568669878adc278bb38b7859085109a09881b610a85ecdaac144e5f600e1cf9ebcbbc9e8cb0ae2acb1805e89b0b62868 SHA512 31ff4b3f7b30c1313918c3d492c3a83e321159864b85ac266fa027baf90e41e5cb88208cffa94a482bb898000d6f199556e34e93961a7b6f92566d62cc818613
-DIST gcc-13-20230819.tar.xz 84298080 BLAKE2B 6488fef3c12f5f521c956294092117ab25bc1c0d5ba1691e3d57300aefa28219ebff9e8ed107f41a605253575c455884d3c7b637fbbfb4285afe488530c0553b SHA512 324b914a772a505b79906cff013c1c7a1bfa207ba05f080b4531a5ce5ba0d0c38747021b4f8fd5a0aac3ea225d972f0a4471897fbab82c372506210769350152
 DIST gcc-13-20230826.tar.xz 84285788 BLAKE2B c25be594e322dd7145245c42ae21b98aa9e3e6ae69f1fa313830e40bf2e8fcb8435762f1c9d3f1ca1dbf31653bdc76a658bec708b7850fe40a7c55504ac30618 SHA512 3d47632e90651bd50a881c727c1ef2aa3322b4fc3e082919ae430270901abf8a05a34fe93f8b678c10dc9a0758f93dc3b33ed5947c8743dab453d2b50c063722
-DIST gcc-13-20230902.tar.xz 84303384 BLAKE2B 75ffca5b36145d25e26ef2fc0afc611ecb1c4bbb11ef54bfed30fdd174d157acc9d2f7055e1d290be32eebe5e63380cfd361a3f0bc5f396fbf2c624f39cafcbe SHA512 81aff20ced3d973183a214d6936662c32b76edaa72fe6d12849ced988acb1aab78a013e6050e6b79a845fabb08486b552ec2e61826d52abc053bb6aeb571b5e9
-DIST gcc-13-20230909.tar.xz 84307500 BLAKE2B 05c12b18f5ee0b0c76050f95bf979a9b0cf01422e26328abe6d1d58b31bc6b96f2767873b990cdfa432b2cd24a9c4690d13688af884177087fe783e6c9b0b48a SHA512 4c51f64b23a7e52e835c3127e2df94b14653ac3a13d1823e4531506018727a458c505b79aeadcb18877ab70991bfa4946a1621934b43fff5d5aaf7b0cb0e19f5
+DIST gcc-13-20230923.tar.xz 84304612 BLAKE2B 3820746f13c5b0dd741506c758ed8de4650fa5330b60802b627a7254f5b4b08da2493f12120aa24b712f98ae39fe2f188f05c79ad22ffdb3de67b2ebe49005aa SHA512 12c0aafb7e91a18224b9b94e7e7e34b57c2e447cc85f51c8ddab672fa3fe31c784d42c15a8a1eb0da8fc9cc321c24163b12fb4f71e7da91b0169a278f2b83713
 DIST gcc-13.2.0-musl-patches-2.tar.xz 5292 BLAKE2B c057d6574d03c05854edaa9f3fd40e9149662b04f3ac7a7db3eb078d73a7b535726d1bf52e5b12736dedb2f9898ad731f2e48a6421fcfbf7b90f929dee072fcb SHA512 a691da0c87c443a5e9d23731f4005f27871c5b12bc9102873ffa24d374aa7b9fbd187c4f5635d23fa9ffb17e351e76173c2d3fdf40646e355c4cb314b538de69
-DIST gcc-13.2.0-patches-3.tar.xz 30956 BLAKE2B 29ce043b46645640ca1e983397af3e158588ad87575f0bc59451ea4a7dd5e3bb5b190ed031de6a22cd790d423ba111e95d222187dd09985dceb12db9f0a2d907 SHA512 4ffecae7be320124ad0c4e71e39e142b7aa8db0e70b5f486f491d7a33ea31efc6464c6abeea77df02a8bd5cf81f08225d625c8af5c27f9afa32c0d7d989f7a3c
-DIST gcc-13.2.0-patches-4.tar.xz 35284 BLAKE2B 230932b5df961518dc0c1aea219e65bd49a64bfcbe0621f90012d8fa18c099fbaa9ce865fb7b95e403e9b227d4cc86bf701668837519a3962a76769f49cd1356 SHA512 5464a6de67ed16a5b3200d513069e8ea10d57d0c78eb84523d30f7abfcaa2611c5462e83f9bbdb079e42b4f702e5f2ecd1db0f370fdf0fe6c0216a08cf2801d7
-DIST gcc-13.2.0-patches-5.tar.xz 34672 BLAKE2B f675575477aab22b1ef4105ecbf636b53dde1fc463e8fc79645f0828ff57417a028100ce48eb8ac0b6ca6e8bae91072f3ed2878b9c00fb49397ffcf736606160 SHA512 15b7db29cc03dcdc023551a3cf01f3756724b7caf8fe0d5ed7831ca78f02d9f0a72fb96326cad79bcd9cb358005676d3cb4217dc1b8fccdcd7906ae1a4bee851
 DIST gcc-13.2.0-patches-7.tar.xz 37064 BLAKE2B 4a8700a8d44bfaa84926f8bfd0da4c5b0c0377f47fc0679456e909f7c9029b9cf1b72c0ba0bc505d9035d5c38e27f7e5b029727eaf2bc7aca417a6be966b2f43 SHA512 f440c97e6782ecb8581d41608e31a648ac426e2d870bc1d171da7794cdeff2fd0546cae0c7214e72fd3a00ead8a5c66f3f633b670b74553a2f3a40378b51f20c
-DIST gcc-13.2.0.tar.xz 87858592 BLAKE2B 0034b29d3d6cc05821f0c4253ce077805943aff7b370729dd203bda57d89c107edd657eeddc2fb1e69ea15c7b0323b961f46516c7f4af89a3ccf7fea84701be2 SHA512 d99e4826a70db04504467e349e9fbaedaa5870766cda7c5cab50cdebedc4be755ebca5b789e1232a34a20be1a0b60097de9280efe47bdb71c73251e30b0862a2
-DIST gcc-14-20230723.tar.xz 84677324 BLAKE2B d9bc3aeaac971984178eedc70bc4b1b1314a3c299c17a60992fe843e01c35aee63fd0742d97449f2bd14e1b2adda3c8a2095cc26b4e4eb3a8d1620af9706ea43 SHA512 53490f78fcebf3e795ad012fe7462390f0e40fc541e3ee6d9edcedba78d645029a35d74e5d16aa0d1ee487c43f7de10f5911043f875e8a5787603c37e1708a7c
-DIST gcc-14-20230730.tar.xz 85008220 BLAKE2B 93a253408aec27af68f98d00f63d0498445385bab2f324b615aba0f488cdbc55ea4d91a3a8934ba46e275aa7ebf3439ee76cfa0571948cbc9dbd6618760abfa2 SHA512 0314fbd44e359f9d183e8027c3f2c70cc6aff07b7a3f7d55b62718e5ec72a70698c30464460a5e3cebabc4bfb369ebde327fc1c13d7dd8667f597f1c4e143656
-DIST gcc-14-20230806.tar.xz 85043088 BLAKE2B 1026c65f39cb9930e996c865b80db9b7d3ba24ad7a56566a8a3fa49bf468d8ab1610d8235ff14ba469fb33448cca43cb997eb06692847515db3f6a773b799bbd SHA512 09fb47b3e7d2072095696e68e87f864cb1f14ef3027d904202bbc34a16df93a0c4805185fa0a8572155b11c40bc107074655c4dae078fe371593048f9318e1ab
-DIST gcc-14-20230813.tar.xz 85109912 BLAKE2B 7c1f05a377697925776f9166271c0bf4f5f41fc298f3dc39342d37f8f7d2aa6ebbe288fc48f16bfc8081a5aae09228cc41cd34764f71f622f1bcd519dd5d4ce7 SHA512 bdb27b503281d1196cd1d4ffbb043f67758e0018127dfba9c7f1aa19501f03add388c7223ae32098c4fa9d1f6839673b4e7cf0ac283a9940e24f1416047beb7a
-DIST gcc-14-20230820.tar.xz 85164168 BLAKE2B 21521a63faf043390283b3bdae8bb66f3a4926034e0089322c16d237f9fdbffeb58e372ce55c617b02866584c0414c02320246881cee64973686720d2283d428 SHA512 2964d8ef2c08f7f8e3bb2e403180a921c3b048c51159b47ce1e9c5dc0c3543a4ef583f4f274a631d0aec1f798d6923b92e9cc0990e24459c40b04a916f8a0fd9
-DIST gcc-14-20230827.tar.xz 85222804 BLAKE2B 5faba24eda2ca81d0cd3c3ea08353ef0047a10ff9be25503c46b4ea1fe9fbf729e3e8d20a5307d45c43250fcfeac6cc9f323aaeb62c81cd7cc9b3fda0ba56101 SHA512 d6c38cc3594e4a607adfd4b71b9af29f389d5a430aec01c4b4a76a71bdec3267798ea7cb3fcc2d1661886ac84636f0b9999c6bf4241a85eb7c238134dae02ab3
-DIST gcc-14-20230903.tar.xz 85250996 BLAKE2B 798500bd10f07dbab08059bc5885162300c1fb36057118bf14959184c6d98a13ccf335458720a9e7c93a6919be10473094d96dc2d1144e3c6f8e33941a8f14fd SHA512 1bac24b1441123ee0b9a48a749fbf7bee23a5fa8ae798053fb5003721a2922221c49fa379ea358575c180a0571e47145dde01c3bbee4df0ed569bd78f6ee439a
-DIST gcc-14-20230910.tar.xz 85633968 BLAKE2B 3abf0e0ca11cb5462380e8515167e43a43e44180d46df75092e46454244f76357357e3e3e6af7323b9e638ee24fe28283af26f6852bad691e8660e99f9ebdf78 SHA512 ddafbf862880b801dbfc3365d1d9416842d257b8f3d3a6d16acdf444ec13d4aa91f6c8fe062c26e01e8544339a7df20c42cff04beb1d9825a3fcee0744df4039
+DIST gcc-14-20230917.tar.xz 85875468 BLAKE2B afd39683b7ae9e84c6fa81d6ba6059a1411463ab45fce81eccf34dfafb29ff633a287826063da547014c12b9e0244d2a022ddb1fef1c73edd882249c5be695e3 SHA512 a1f79805278e61c9feb4020c62e07c666fa724d872fc55dd0372a7d17cc2c2e2e8d2d149e748499e75331bcb28a6b1a6641c20111a6d8b871dddc1efe957608d
+DIST gcc-14-20230924.tar.xz 85950048 BLAKE2B cc353b46f963eca7ad820fe35fb14ece3d76714466ee6ac227433fddc101e76c40d71ce4bc6363e2bc5c3fdf233ab7479bf18542be3df6e1f77690090d08d351 SHA512 19a93b35660f8960b5a9385b9312d9555d83bb8ca8662492b54ece3c1d634da0fd6614e677ce6f1738ac2eadc5dd18b2ce311d2adde6c41f34db8598373bd335
 DIST gcc-14.0.0-musl-patches-1.tar.xz 3576 BLAKE2B 692baee8a7709905d53aeb150d73a3721c4ba47ee5f397cfb1b5be905cf003ca02b60c94ee294d90ac39645cd5cdf186c7a3aa950c47d8cf680c128ed705b807 SHA512 0592ab98a7142e404623a6511c67dff61e9ade32c3fb2c0e75b456306e0af3799ad13252b50b3d2fdd31e5815d7f0b16b0ad63ab8386fe4d78729fc9c182d617
 DIST gcc-14.0.0-patches-2.tar.xz 11484 BLAKE2B 6ff968051d286f21eb7f4ec80303b232530c153cca8d9e61ddfdf3675ef8c5740223a8b720ec9d5c4561b505993c675cc6fc7a9bab659ee1db99e1d97911eb74 SHA512 b255338d6110d9bfe211ba14da7b186f69b81503dba6e4ec19ee6fa37d44c0690e713c763abe27ce934ff7f9e5d0c8788a54c30587f07f65858b1e817cbf7247
 DIST gcc-8.5.0-patches-4.tar.xz 18616 BLAKE2B 7594cbaea5daecf1a0b3d526c06aeba0a84c6da66aee2e105a51fda6be8d30a37ccc3814281b284a4582d892a1d556bca063551584edfc2525bed8ea5b6888e7 SHA512 1aa5742c361186637e7855f06feb1a4547e7d4d5de6e51f3d049e0ef3c19e2eff179465f52781739f59422035b7f8e4c0efa3844849f920f3c96acfdc37ca6a6
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.0_pre20230806-fix-bootstrap.patch b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.0_pre20230806-fix-bootstrap.patch
deleted file mode 100644
index 5d5747312b6..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/files/gcc-14.0.0_pre20230806-fix-bootstrap.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=af6cfd7b663909688c6ca55b6e9f859cdde4310f
-https://gcc.gnu.org/PR110926
-
-From af6cfd7b663909688c6ca55b6e9f859cdde4310f Mon Sep 17 00:00:00 2001
-From: liuhongt <hongtao.liu@intel.com>
-Date: Mon, 7 Aug 2023 11:10:52 +0800
-Subject: [PATCH] Fix ICE in rtl check when bootstrap.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=utf8
-Content-Transfer-Encoding: 8bit
-
-/var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/libgfortran/generated/matmul_i1.c: In function âmatmul_i1_avx512fâ:
-/var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/libgfortran/generated/matmul_i1.c:1781:1: internal compiler error: RTL check: expected elt 0 type 'i' or 'n', have 'w' (rtx const_int) in vpternlog_redundant_operand_mask, at config/i386/i386.cc:19460
- 1781 | }
-      | ^
-0x5559de26dc2d rtl_check_failed_type2(rtx_def const*, int, int, int, char const*, int, char const*)
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/rtl.cc:761
-0x5559de340bfe vpternlog_redundant_operand_mask(rtx_def**)
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/config/i386/i386.cc:19460
-0x5559dfec67a6 split_44
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/config/i386/sse.md:12730
-0x5559dfec67a6 split_63
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/config/i386/sse.md:28428
-0x5559deb8a682 try_split(rtx_def*, rtx_insn*, int)
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/emit-rtl.cc:3800
-0x5559deb8adf2 try_split(rtx_def*, rtx_insn*, int)
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/emit-rtl.cc:3972
-0x5559def69194 split_insn
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/recog.cc:3385
-0x5559def70c57 split_all_insns()
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/recog.cc:3489
-0x5559def70d0c execute
-        /var/tmp/portage/sys-devel/gcc-14.0.0_pre20230806/work/gcc-14-20230806/gcc/recog.cc:4413
-
-Use INTVAL (imm_op) instead of XINT (imm_op, 0).
-
-gcc/ChangeLog:
-
-	PR target/110926
-	* config/i386/i386-protos.h
-	(vpternlog_redundant_operand_mask): Adjust parameter type.
-	* config/i386/i386.cc (vpternlog_redundant_operand_mask): Use
-	INTVAL instead of XINT, also adjust parameter type from rtx*
-	to rtx since the function only needs operands[4] in vpternlog
-	pattern.
-	(substitute_vpternlog_operands): Pass operands[4] instead of
-	operands to vpternlog_redundant_operand_mask.
-	* config/i386/sse.md: Ditto.
---- a/gcc/config/i386/i386-protos.h
-+++ b/gcc/config/i386/i386-protos.h
-@@ -70,7 +70,7 @@ extern machine_mode ix86_cc_mode (enum rtx_code, rtx, rtx);
- extern int avx_vpermilp_parallel (rtx par, machine_mode mode);
- extern int avx_vperm2f128_parallel (rtx par, machine_mode mode);
- 
--extern int vpternlog_redundant_operand_mask (rtx[]);
-+extern int vpternlog_redundant_operand_mask (rtx);
- extern void substitute_vpternlog_operands (rtx[]);
- 
- extern bool ix86_expand_strlen (rtx, rtx, rtx, rtx);
---- a/gcc/config/i386/i386.cc
-+++ b/gcc/config/i386/i386.cc
-@@ -19454,10 +19454,10 @@ avx_vperm2f128_parallel (rtx par, machine_mode mode)
- /* Return a mask of VPTERNLOG operands that do not affect output.  */
- 
- int
--vpternlog_redundant_operand_mask (rtx *operands)
-+vpternlog_redundant_operand_mask (rtx pternlog_imm)
- {
-   int mask = 0;
--  int imm8 = XINT (operands[4], 0);
-+  int imm8 = INTVAL (pternlog_imm);
- 
-   if (((imm8 >> 4) & 0x0F) == (imm8 & 0x0F))
-     mask |= 1;
-@@ -19475,7 +19475,7 @@ vpternlog_redundant_operand_mask (rtx *operands)
- void
- substitute_vpternlog_operands (rtx *operands)
- {
--  int mask = vpternlog_redundant_operand_mask (operands);
-+  int mask = vpternlog_redundant_operand_mask (operands[4]);
- 
-   if (mask & 1) /* The first operand is redundant.  */
-     operands[1] = operands[2];
---- a/gcc/config/i386/sse.md
-+++ b/gcc/config/i386/sse.md
-@@ -12751,7 +12751,7 @@
- 	   (match_operand:V 3 "memory_operand")
- 	   (match_operand:SI 4 "const_0_to_255_operand")]
- 	  UNSPEC_VTERNLOG))]
--  "!reload_completed && vpternlog_redundant_operand_mask (operands) == 3"
-+  "!reload_completed && vpternlog_redundant_operand_mask (operands[4]) == 3"
-   [(set (match_dup 0)
- 	(match_dup 3))
-    (set (match_dup 0)
-@@ -12772,7 +12772,7 @@
- 	   (match_operand:V 3 "nonimmediate_operand")
- 	   (match_operand:SI 4 "const_0_to_255_operand")]
- 	  UNSPEC_VTERNLOG))]
--  "!reload_completed && vpternlog_redundant_operand_mask (operands) != 0"
-+  "!reload_completed && vpternlog_redundant_operand_mask (operands[4]) != 0"
-   [(set (match_dup 0)
- 	(unspec:V
- 	  [(match_dup 1)
--- 
-2.39.3
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230621.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230621.ebuild
deleted file mode 100644
index 72bc0e8a42e..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-10.4.1_p20230621.ebuild
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="10.5.0"
-PATCH_VER="6"
-MUSL_VER="2"
-MUSL_GCC_VER="10.5.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-RDEPEND=""
-BDEPEND="${CATEGORY}/binutils"
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	if has_version '>=sys-libs/glibc-2.32-r1'; then
-		rm -v "${WORKDIR}/patch/23_all_disable-riscv32-ABIs.patch" || die
-	fi
-
-	toolchain_src_prepare
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.0.ebuild
deleted file mode 100644
index 791c932e6fb..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.0.ebuild
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230803.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230803.ebuild
deleted file mode 100644
index 02c58f02f0a..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230803.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230810.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230810.ebuild
deleted file mode 100644
index 02c58f02f0a..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230810.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230817.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230817.ebuild
deleted file mode 100644
index 02c58f02f0a..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230817.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230831.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230831.ebuild
deleted file mode 100644
index 02c58f02f0a..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230831.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230907.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230907.ebuild
deleted file mode 100644
index 02c58f02f0a..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230907.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="11.4.0"
-PATCH_VER="10"
-MUSL_VER="2"
-MUSL_GCC_VER="11.4.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230727.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230921.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230727.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-11.4.1_p20230921.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild
deleted file mode 100644
index d1ff9bb6832..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.2.1_p20230428-r1.ebuild
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230623.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230623.ebuild
deleted file mode 100644
index 006c8231fd0..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230623.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230804.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230804.ebuild
deleted file mode 100644
index 1ffe2b97a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230804.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230811.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230811.ebuild
deleted file mode 100644
index 1ffe2b97a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230811.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230818.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230818.ebuild
deleted file mode 100644
index 1ffe2b97a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230818.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230901.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230901.ebuild
deleted file mode 100644
index 1ffe2b97a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230901.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230908.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230908.ebuild
deleted file mode 100644
index 1ffe2b97a4b..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230908.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="12.3.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="12.3.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-	        MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230728.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230922.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230728.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-12.3.1_p20230922.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230527.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230527.ebuild
deleted file mode 100644
index f064a201b3c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.1.1_p20230527.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="3"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
deleted file mode 100644
index 66a56715f95..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.0.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="3"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild
deleted file mode 100644
index 845eb61fac0..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230729.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="4"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild
deleted file mode 100644
index 3c29ee81845..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230805.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="5"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230819.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230819.ebuild
deleted file mode 100644
index fb3f9765eb8..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230819.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="7"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230826.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230826.ebuild
index b4f76ef68c1..4b2bb4c855f 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230826.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230826.ebuild
@@ -37,7 +37,7 @@ if tc_is_live ; then
 	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
 elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
 	# Don't keyword live ebuilds
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 	:;
 fi
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230902.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230902.ebuild
deleted file mode 100644
index fb3f9765eb8..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230902.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="7"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230909.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230909.ebuild
deleted file mode 100644
index fb3f9765eb8..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230909.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="13.2.0"
-PATCH_VER="7"
-MUSL_VER="2"
-MUSL_GCC_VER="13.2.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=releases/gcc-$(ver_cut 1)
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${PN}-13-fix-cross-fixincludes.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230812.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230923.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230812.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-13.2.1_p20230923.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230806-r1.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230806-r1.ebuild
deleted file mode 100644
index 3c3d844369c..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230806-r1.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply "${FILESDIR}"/${P}-fix-bootstrap.patch
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230813.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230813.ebuild
deleted file mode 100644
index 59534d9e96d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230813.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230820.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230820.ebuild
deleted file mode 100644
index 59534d9e96d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230820.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230827.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230827.ebuild
deleted file mode 100644
index 59534d9e96d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230827.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230903.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230903.ebuild
deleted file mode 100644
index 59534d9e96d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230903.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230910.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230910.ebuild
deleted file mode 100644
index 59534d9e96d..00000000000
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230910.ebuild
+++ /dev/null
@@ -1,64 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TOOLCHAIN_PATCH_DEV="sam"
-PATCH_GCC_VER="14.0.0"
-PATCH_VER="2"
-MUSL_VER="1"
-MUSL_GCC_VER="14.0.0"
-
-if [[ ${PV} == *.9999 ]] ; then
-	MY_PV_2=$(ver_cut 2)
-	MY_PV_3=1
-	if [[ ${MY_PV_2} == 0 ]] ; then
-		MY_PV_2=0
-		MY_PV_3=0
-	else
-		MY_PV_2=$((${MY_PV_2} - 1))
-	fi
-
-	# e.g. 12.2.9999 -> 12.1.1
-	TOOLCHAIN_GCC_PV=$(ver_cut 1).${MY_PV_2}.${MY_PV_3}
-elif [[ -n ${TOOLCHAIN_GCC_RC} ]] ; then
-	# Cheesy hack for RCs
-	MY_PV=$(ver_cut 1).$((($(ver_cut 2) + 1))).$((($(ver_cut 3) - 1)))-RC-$(ver_cut 5)
-	MY_P=${PN}-${MY_PV}
-	GCC_TARBALL_SRC_URI="mirror://gcc/snapshots/${MY_PV}/${MY_P}.tar.xz"
-	TOOLCHAIN_SET_S=no
-	S="${WORKDIR}"/${MY_P}
-fi
-
-inherit toolchain
-
-if tc_is_live ; then
-	# Needs to be after inherit (for now?), bug #830908
-	EGIT_BRANCH=master
-elif [[ -z ${TOOLCHAIN_USE_GIT_PATCHES} ]] ; then
-	# Don't keyword live ebuilds
-	#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
-	:;
-fi
-
-if [[ ${CATEGORY} != cross-* ]] ; then
-	# Technically only if USE=hardened *too* right now, but no point in complicating it further.
-	# If GCC is enabling CET by default, we need glibc to be built with support for it.
-	# bug #830454
-	RDEPEND="elibc_glibc? ( sys-libs/glibc[cet(-)?] )"
-	DEPEND="${RDEPEND}"
-	BDEPEND=">=${CATEGORY}/binutils-2.30[cet(-)?]"
-fi
-
-src_prepare() {
-	local p upstreamed_patches=(
-		# add them here
-	)
-	for p in "${upstreamed_patches[@]}"; do
-		rm -v "${WORKDIR}/patch/${p}" || die
-	done
-
-	toolchain_src_prepare
-
-	eapply_user
-}
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230723.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230917.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230723.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230917.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230730.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230924.ebuild
similarity index 100%
rename from sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230730.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-devel/gcc/gcc-14.0.0_pre20230924.ebuild
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/Manifest b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/Manifest
index 546310d160d..17a58b0a4e6 100644
--- a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/Manifest
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/Manifest
@@ -1,4 +1,6 @@
 DIST gettext-0.21.1.tar.xz 10054564 BLAKE2B e994924284b3fd5b3e3bf59d4bf43eb30c9b21cc213dc3b98616b4a9fc321c90911d94d314f323cfffd0d2c3e9371b5b8f7985b9a785adc61617dd042b6f4df5 SHA512 61e93bc9876effd3ca1c4e64ff6ba5bd84b24951ec2cc6f40a0e3248410e60f887552f29ca1f70541fb5524f6a4e8191fed288713c3e280e18922dd5bff1a2c9
 DIST gettext-0.21.1.tar.xz.sig 833 BLAKE2B f673436d315e972f9e110a1b5c8d1b2f20a32fc1b7ce027fcd3bc2fe7a81af183fb8db744cbed1a8c3a6ce1a13d55e19a8e8829fc944960fbfc7efcd9aaed91c SHA512 fba912830c57d0616fb66cf81da0cb7a3ab1e27497c45daa63249d3c9f85182a4f42dfeb1591d8f31c2a340ba0c519f04fd2f05429d1cf26a3ea316d047993d0
+DIST gettext-0.22.2.tar.xz 10238092 BLAKE2B 337597432af11ba082354e968fa7dd95aa6b568344b464d6bfb606d9f9bbe88fee035d39f29fdce62e28a9ece7da29cbde23093ca2af0cdd1955f26abd854036 SHA512 c5c24eca1c7e8e242e6b993a39068dc281b84fda7f06e5020dc7fc10ac7de5bfcc476b7e94711723a7f82cc7f5a0845616ddd553078ee69690e3a146fc3f8ae5
+DIST gettext-0.22.2.tar.xz.sig 833 BLAKE2B 47a3480c6ec5b379e2262588a358e69560477c5e8cdc13d82f879bf1c2381c4b176060e6e1d482b0a9b17d497ff5e7c1642646489f3829c879340b939d51de5c SHA512 b40f233d64001b13ab5d5b85bc87424bc873cbbd6e59e797997ed39404325a5a2dc945f7b6a3dfc25becaff788d5dd644779bf505d5141bfa437882931dcf22c
 DIST gettext-0.22.tar.xz 10008808 BLAKE2B e91c82eb793897bd7ed727503e9d6e72a47027adf51ca76cf5c936437c434e910508814b1d03b12694c5e87156018683cb2c8cc51637b121313ed41155bcd3e5 SHA512 c6368344aa4e0f6fd7c4a93023a5f7b377c7bb97b8ea688fd54f4c385c069d9ff27611d8763b1aed6328b6d3c4db7b34bd89bfbf6525ecaef11eb58434a4d4fa
 DIST gettext-0.22.tar.xz.sig 833 BLAKE2B d1718f02100abc2c7c67e5c6a49000baee5244030fcef33f099fac255562211332b0c7838d329e2cdd2c99c5b4e5d4bfed6da81cdddd86a4adf9f24f626c8704 SHA512 2d4f0ea68150aa9f7da315545bd782f0c74d581ec89f60ca5138d069cc6ef0296f85df6e05f0c7f030dc8660a8db32529d237497473f6cef7c72034adcc58a9b
diff --git a/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.2.ebuild b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.2.ebuild
new file mode 100644
index 00000000000..3fc8822689b
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-devel/gettext/gettext-0.22.2.ebuild
@@ -0,0 +1,189 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Note: Keep version bumps in sync with dev-libs/libintl.
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH="${BROOT}"/usr/share/openpgp-keys/gettext.asc
+inherit java-pkg-opt-2 libtool multilib-minimal verify-sig toolchain-funcs
+
+DESCRIPTION="GNU locale utilities"
+HOMEPAGE="https://www.gnu.org/software/gettext/"
+
+if [[ ${PV} == *_rc* ]] ; then
+	SRC_URI="
+		https://alpha.gnu.org/gnu/${PN}/${P/_/-}.tar.xz
+		verify-sig? ( https://alpha.gnu.org/gnu/${PN}/${P/_/-}.tar.xz.sig )
+	"
+	S="${WORKDIR}/${P/_/-}"
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+# Only libasprintf is under the LGPL (and libintl is in a sep package),
+# so put that license behind USE=cxx.
+LICENSE="GPL-3+ cxx? ( LGPL-2.1+ )"
+SLOT="0"
+IUSE="acl +cxx doc emacs git java ncurses nls openmp static-libs xattr"
+
+# only runtime goes multilib
+# Note: The version of libxml2 corresponds to the version bundled via gnulib.
+# If the build detects too old of a system version, it will end up falling back
+# to the bundled copy.  #596918
+# Note: expat lacks a subslot because it is dynamically loaded at runtime.  We
+# would depend on older subslots if they were available (based on the ABIs that
+# are explicitly handled), but expat doesn't currently use subslots.
+DEPEND="
+	>=virtual/libiconv-0-r1[${MULTILIB_USEDEP}]
+	>=virtual/libintl-0-r2[${MULTILIB_USEDEP}]
+	>=dev-libs/libxml2-2.9.3:=
+	dev-libs/expat
+	acl? ( virtual/acl )
+	ncurses? ( sys-libs/ncurses:= )
+	java? ( virtual/jdk:1.8 )
+	xattr? ( sys-apps/attr )
+"
+RDEPEND="
+	${DEPEND}
+	git? ( dev-vcs/git )
+	java? ( virtual/jre:1.8 )
+"
+BDEPEND="
+	git? ( dev-vcs/git )
+	verify-sig? ( sec-keys/openpgp-keys-gettext )
+"
+PDEPEND="emacs? ( app-emacs/po-mode )"
+
+MULTILIB_WRAPPED_HEADERS=(
+	# only installed for native ABI
+	/usr/include/gettext-po.h
+
+	/usr/include/autosprintf.h
+	/usr/include/textstyle.h
+	/usr/include/textstyle/stdbool.h
+	/usr/include/textstyle/version.h
+	/usr/include/textstyle/woe32dll.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.21-CVE-2020-12825.patch
+)
+
+QA_SONAME_NO_SYMLINK=".*/preloadable_libintl.so"
+
+pkg_pretend() {
+	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
+}
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} != binary ]] && use openmp && tc-check-openmp
+	java-pkg-opt-2_pkg_setup
+}
+
+src_prepare() {
+	java-pkg-opt-2_src_prepare
+
+	default
+
+	# gettext-0.21.1-java-autoconf.patch changes
+	# gettext-{runtime,tools}/configure.ac and the corresponding
+	# configure scripts. Avoid regenerating other autotools output.
+	#touch -c gettext-{runtime,tools}/{aclocal.m4,Makefile.in,config.h.in,configure} || die
+	# Makefile.am adds a dependency on gettext-{runtime,tools}/configure.ac
+	#touch -c configure || die
+
+	elibtoolize
+
+	if use elibc_musl || use elibc_Darwin; then
+		eapply "${FILESDIR}"/${PN}-0.21-musl-omit_setlocale_lock.patch
+	fi
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# switches common to runtime and top-level
+		--cache-file="${BUILD_DIR}"/config.cache
+		#--docdir="\$(datarootdir)/doc/${PF}"
+
+		# Emacs support is now in a separate package
+		--without-emacs
+		--without-lispdir
+		# glib depends on us so avoid circular deps
+		--with-included-glib
+		# libcroco depends on glib which ... ^^^
+		--with-included-libcroco
+		# this will _disable_ libunistring (since it is not bundled),
+		# see bug #326477
+		--with-included-libunistring
+		# Never build libintl since it's in dev-libs/libintl now.
+		--without-included-gettext
+		# Never build bundled copy of libxml2.
+		--without-included-libxml
+
+		--disable-csharp
+		--without-cvs
+
+		$(use_enable acl)
+		$(use_enable cxx c++)
+		$(use_enable cxx libasprintf)
+		$(use_with git)
+		$(multilib_native_use_enable java)
+		$(use_enable ncurses curses)
+		$(use_enable nls)
+		$(use_enable openmp)
+		$(use_enable static-libs static)
+		$(use_enable xattr attr)
+	)
+
+	local ECONF_SOURCE="${S}"
+	if ! multilib_is_native_abi ; then
+		# for non-native ABIs, we build runtime only
+		ECONF_SOURCE+=/gettext-runtime
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if multilib_is_native_abi ; then
+		dosym msgfmt /usr/bin/gmsgfmt # bug #43435
+		dobin gettext-tools/misc/gettextize
+	fi
+
+	# 909041 never install libintl which upstream insists on building
+	rm -f "${ED}"/usr/$(get_libdir)/libintl.* "${ED}"/usr/include/libintl.h
+}
+
+multilib_src_install_all() {
+	find "${ED}" -type f -name "*.la" -delete || die
+
+	if use java ; then
+		java-pkg_dojar "${ED}"/usr/share/${PN}/*.jar
+		rm "${ED}"/usr/share/${PN}/*.jar || die
+		rm "${ED}"/usr/share/${PN}/*.class || die
+		if use doc ; then
+			java-pkg_dojavadoc "${ED}"/usr/share/doc/${PF}/html/javadoc2
+		fi
+	fi
+
+	dodoc AUTHORS ChangeLog NEWS README THANKS
+
+	if use doc ; then
+		docinto html
+		dodoc "${ED}"/usr/share/doc/${PF}/*.html
+	else
+		rm -rf "${ED}"/usr/share/doc/${PF}/{csharpdoc,examples,javadoc2,javadoc1}
+	fi
+	rm "${ED}"/usr/share/doc/${PF}/*.html || die
+}
+
+pkg_preinst() {
+	java-pkg-opt-2_pkg_preinst
+}
diff --git a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r2.ebuild b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r2.ebuild
index 10584f8bc29..e4e5eb9135c 100644
--- a/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r2.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-fs/e2fsprogs/e2fsprogs-1.47.0-r2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://www.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/v${PV}/$
 
 LICENSE="GPL-2 BSD"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="cron fuse nls static-libs test +tools"
 RESTRICT="!test? ( test )"
 
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.5-free-segfault.patch b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.5-free-segfault.patch
new file mode 100644
index 00000000000..a41cf380f91
--- /dev/null
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/files/libnvme-1.5-free-segfault.patch
@@ -0,0 +1,36 @@
+From c56910f807795528fff7ba6b81f8efcdb4babe98 Mon Sep 17 00:00:00 2001
+From: Martin Belanger <martin.belanger@dell.com>
+Date: Wed, 5 Jul 2023 10:59:25 -0400
+Subject: [PATCH] tree: missing closedir() causes fd leak for
+ "/sys/bus/pci/slots"
+
+In nvme_ctrl_lookup_phy_slot(), we are missing a closedir(), which
+causes file descriptors to leak. Also, there was a missing free()
+when the function returns with ENOMEM.
+
+Signed-off-by: Martin Belanger <martin.belanger@dell.com>
+---
+ src/nvme/tree.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/nvme/tree.c b/src/nvme/tree.c
+index a2ac0698..805eff99 100644
+--- a/src/nvme/tree.c
++++ b/src/nvme/tree.c
+@@ -1292,6 +1292,8 @@ static char *nvme_ctrl_lookup_phy_slot(nvme_root_t r, const char *address)
+ 			ret = asprintf(&path, "/sys/bus/pci/slots/%s", entry->d_name);
+ 			if (ret < 0) {
+ 				errno = ENOMEM;
++				free(target_addr);
++				closedir(slots_dir);
+ 				return NULL;
+ 			}
+ 			addr = nvme_get_attr(path, "address");
+@@ -1306,6 +1308,7 @@ static char *nvme_ctrl_lookup_phy_slot(nvme_root_t r, const char *address)
+ 		}
+ 	}
+ 	free(target_addr);
++	closedir(slots_dir);
+ 	if (found)
+ 		return strdup(entry->d_name);
+ 	return NULL;
diff --git a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5.ebuild b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5-r2.ebuild
similarity index 94%
rename from sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5.ebuild
rename to sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5-r2.ebuild
index 094c188b9bf..9e2be0abd19 100644
--- a/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/sys-libs/libnvme/libnvme-1.5-r2.ebuild
@@ -28,16 +28,18 @@ DEPEND="
 	uuid? ( sys-apps/util-linux:= )
 "
 RDEPEND="${DEPEND}"
-
 BDEPEND="
 	dev-lang/swig
 "
 
+PATCHES=( "${FILESDIR}/${P}-free-segfault.patch" )
+
 src_configure() {
 	local emesonargs=(
 		-Dpython=false
 		$(meson_feature json json-c)
 		$(meson_feature dbus libdbus)
+		$(meson_feature keyutils)
 		$(meson_feature ssl openssl)
 		$(meson_feature python)
 	)
diff --git a/sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r5.ebuild b/sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r6.ebuild
similarity index 98%
rename from sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r5.ebuild
rename to sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r6.ebuild
index 67b4e56bfea..d7ebd37b046 100644
--- a/sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r5.ebuild
+++ b/sdk_container/src/third_party/portage-stable/virtual/editor/editor-0-r6.ebuild
@@ -1,7 +1,7 @@
 # Copyright 1999-2023 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="Virtual for editor"
 
@@ -28,7 +28,6 @@ RDEPEND="|| (
 	app-editors/joe
 	app-editors/jove
 	app-editors/kakoune
-	app-editors/le
 	app-editors/levee
 	app-editors/lpe
 	app-editors/mg