11 files changed, 798 insertions, 104 deletions
diff --git a/app-containers/buildah/Manifest b/app-containers/buildah/Manifest
index c085fcc5b1a2..e5c0f32b7762 100644
--- a/app-containers/buildah/Manifest
+++ b/app-containers/buildah/Manifest
@@ -1,2 +1,4 @@
-DIST buildah-1.25.1.tar.gz 14212065 BLAKE2B ec4f668654011f1b93745e1a1d575fdda0cd5f4d6f9f7f7b3106c24aa7d405951ecd645a54c2dd5a3ad2695069e66ad847bdb15f0e73a9c7efba2a7e283d4f58 SHA512 628f8095eb4488ae2be06a2a92de85dde4f3841e8ed9882132c119f27b0c93f26ba10f5dd259d63654b90539d762f6c1973d460f073c0b2450ac5d9582a6a68d
-DIST buildah-1.26.1.tar.gz 14159554 BLAKE2B bf17a51653bb07591c19fca449d6f4eeb87693a4d20ae5f12f669b10c328fadd763e0c0fa76605154a5a6439f4e250bc8f00c2d01c9fbf1e266aa67189aafdbd SHA512 07225ebb23e5a815be1ef8acb5d15ef9fb8c6e9324fa9b65ec024f7b6bbe892721f9feaac2911d1b466c2cf336bd0c68e3d1b4df953f13a3390da84a93f76723
+DIST buildah-1.33.7.tar.gz 18604354 BLAKE2B d2788096d8d6fd6cc528e8f33edc577778a2775a561ea3c4a983eb4a6fa1d5b570f6d8dc0f77e464d0c242add5d641e20afce83c9f5157021fbc82a009ea47c9 SHA512 1248ad1dcf0d10608674543caf4d78f5052db7932102226e23b73add5e129bd8c614672f3d06aa8052675dd83fa83ef2742ef08fe1a883037b41df8fde893ea1
+DIST buildah-1.34.3.tar.gz 18856476 BLAKE2B c91c995a2ff4be8b4e84a70c581a817cb2f1333b08ca297163d218f80d538905c41718cfc267c03173330234c3476344be44df799eaaac891395a22bc7a020b3 SHA512 26d5c48cb5b056a274c1a9c6820a6076337f625fc6dd6683000db871f3de9d37907bd962ced3400334bfc230718219cda2108e2e984be5f8c76ecfa4a2f1e1ac
+DIST buildah-1.35.3.tar.gz 19372597 BLAKE2B 014bea80b3a8c4482bbe098a0c5293892cf9f4f0d4d74ecaba8f155e49fab326689b95b690b413d64f6b576c7269bdb9d0f446244b832afe311e909b3f96856d SHA512 ca325ce1a878eb9e9a6caedf236add16702d8dcd83f15a1995b8215998821218104ea8cb7a5d11fc354ee01d9805c339578975d35db859f1d53b08e0a2139fe3
+DIST buildah-1.35.4.tar.gz 19370823 BLAKE2B 6dc8ad2a21c3ce41d4b8a2908d90bcbb32f5598c11fcde49a706334407370998731fedac7d8ee8e080a6a168c10b4a0404bf1120cab8b561e916a9df2bd2d115 SHA512 679f2328f675a39f9965128d51a6e8a3f82d64a6d3c3cdcb862cfcb7691eba272d869b6718147da1590aa573534081329ef05e879875024a11aa9ad52b2f292f
diff --git a/app-containers/buildah/buildah-1.25.1.ebuild b/app-containers/buildah/buildah-1.25.1.ebuild
deleted file mode 100644
index d84f33be7c3f..000000000000
--- a/app-containers/buildah/buildah-1.25.1.ebuild
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-inherit bash-completion-r1 go-module
-GIT_COMMIT=fcf94e39
-
-DESCRIPTION="A tool that facilitates building OCI images"
-HOMEPAGE="https://github.com/containers/buildah"
-SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
-SLOT="0"
-KEYWORDS="amd64 arm64"
-IUSE="selinux"
-
-RDEPEND="app-crypt/gpgme:=
-	app-containers/skopeo
-	dev-libs/libgpg-error:=
-	dev-libs/libassuan:=
-	sys-apps/shadow:=
-	sys-fs/lvm2:=
-	sys-libs/libseccomp:=
-	selinux? ( sys-libs/libselinux:= )"
-DEPEND="${RDEPEND}"
-
-RESTRICT+=" test"
-
-src_prepare() {
-	default
-	[[ -f selinux_tag.sh ]] || die
-	use selinux || { echo -e "#!/bin/sh\ntrue" > \
-		selinux_tag.sh || die; }
-	sed -i -e 's/make -C/$(MAKE) -C/' Makefile || die 'sed failed'
-}
-
-src_compile() {
-	emake GIT_COMMIT=${GIT_COMMIT} all
-}
-
-src_install() {
-	dodoc CHANGELOG.md CONTRIBUTING.md README.md install.md troubleshooting.md
-	doman docs/*.1
-	dodoc -r docs/tutorials
-	dobin bin/{${PN},imgtype}
-	dobashcomp contrib/completions/bash/buildah
-}
-
-src_test() {
-	emake test-unit
-}
diff --git a/app-containers/buildah/buildah-1.26.1.ebuild b/app-containers/buildah/buildah-1.26.1.ebuild
deleted file mode 100644
index 016059edd2b4..000000000000
--- a/app-containers/buildah/buildah-1.26.1.ebuild
+++ /dev/null
@@ -1,51 +0,0 @@
-# Copyright 1999-2022 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-inherit bash-completion-r1 go-module
-GIT_COMMIT=6e2ec2eb
-
-DESCRIPTION="A tool that facilitates building OCI images"
-HOMEPAGE="https://github.com/containers/buildah"
-SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
-SLOT="0"
-KEYWORDS="~amd64 ~arm64"
-IUSE="selinux"
-
-RDEPEND="app-crypt/gpgme:=
-	app-containers/skopeo
-	dev-libs/libgpg-error:=
-	dev-libs/libassuan:=
-	sys-apps/shadow:=
-	sys-fs/lvm2:=
-	sys-libs/libseccomp:=
-	selinux? ( sys-libs/libselinux:= )"
-DEPEND="${RDEPEND}"
-
-RESTRICT+=" test"
-
-src_prepare() {
-	default
-	[[ -f selinux_tag.sh ]] || die
-	use selinux || { echo -e "#!/bin/sh\ntrue" > \
-		selinux_tag.sh || die; }
-	sed -i -e 's/make -C/$(MAKE) -C/' Makefile || die 'sed failed'
-}
-
-src_compile() {
-	emake GIT_COMMIT=${GIT_COMMIT} all
-}
-
-src_install() {
-	dodoc CHANGELOG.md CONTRIBUTING.md README.md install.md troubleshooting.md
-	doman docs/*.1
-	dodoc -r docs/tutorials
-	dobin bin/{${PN},imgtype}
-	dobashcomp contrib/completions/bash/buildah
-}
-
-src_test() {
-	emake test-unit
-}
diff --git a/app-containers/buildah/buildah-1.33.7.ebuild b/app-containers/buildah/buildah-1.33.7.ebuild
new file mode 100644
index 000000000000..a24bd18a767c
--- /dev/null
+++ b/app-containers/buildah/buildah-1.33.7.ebuild
@@ -0,0 +1,160 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	app-containers/containers-common
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	"${T}"/dont-call-as-directly-upstream-pr-5436.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	cat <<'EOF' > "${T}/dont-call-as-directly-upstream-pr-5436.patch"
+--- a/Makefile
++++ b/Makefile
+@@ -10,6 +10,8 @@
+ BASHINSTALLDIR = $(PREFIX)/share/bash-completion/completions
+ BUILDFLAGS := -tags "$(BUILDTAGS)"
+ BUILDAH := buildah
++AS ?= as
++STRIP ?= strip
+
+ GO := go
+ GO_LDFLAGS := $(shell if $(GO) version|grep -q gccgo; then echo "-gccgoflags"; else echo "-ldflags"; fi)
+@@ -72,11 +74,11 @@
+ bin/buildah: $(SOURCES) cmd/buildah/*.go internal/mkcw/embed/entrypoint.gz
+	$(GO_BUILD) $(BUILDAH_LDFLAGS) $(GO_GCFLAGS) "$(GOGCFLAGS)" -o $@ $(BUILDFLAGS) ./cmd/buildah
+
+-ifneq ($(shell as --version | grep x86_64),)
++ifneq ($(shell $(AS) --version | grep x86_64),)
+ internal/mkcw/embed/entrypoint: internal/mkcw/embed/entrypoint.s
+	$(AS) -o $(patsubst %.s,%.o,$^) $^
+	$(LD) -o $@ $(patsubst %.s,%.o,$^)
+-	strip $@
++	$(STRIP) $@
+ else
+ .PHONY: internal/mkcw/embed/entrypoint
+ endif
+EOF
+
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || {
+		cat <<-'EOF' > "${T}/disable_seccomp.patch"
+		 --- a/Makefile
+		 +++ b/Makefile
+		 @@ -5 +5 @@
+		 -SECURITYTAGS ?= seccomp $(APPARMORTAG)
+		 +SECURITYTAGS ?= $(APPARMORTAG)
+		EOF
+		eapply "${T}/disable_seccomp.patch" || die
+	}
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || {
+		cat <<-'EOF' > "${T}/disable_tests.patch"
+		--- a/Makefile
+		+++ b/Makefile
+		@@ -54 +54 @@
+		-all: bin/buildah bin/imgtype bin/copy bin/tutorial docs
+		+all: bin/buildah docs
+		@@ -123 +123 @@
+		-docs: install.tools ## build the docs on the host
+		+docs: ## build the docs on the host
+		EOF
+		eapply "${T}/disable_tests.patch" || die
+	}
+
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-1.34.3.ebuild b/app-containers/buildah/buildah-1.34.3.ebuild
new file mode 100644
index 000000000000..cc06bf2ff42d
--- /dev/null
+++ b/app-containers/buildah/buildah-1.34.3.ebuild
@@ -0,0 +1,161 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="amd64 arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	app-containers/containers-common
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	"${T}"/dont-call-as-directly-upstream-pr-5436.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	cat <<'EOF' > "${T}/dont-call-as-directly-upstream-pr-5436.patch"
+--- a/Makefile
++++ b/Makefile
+@@ -14,6 +14,8 @@
+ BASHINSTALLDIR = $(PREFIX)/share/bash-completion/completions
+ BUILDFLAGS := -tags "$(BUILDTAGS)"
+ BUILDAH := buildah
++AS ?= as
++STRIP ?= strip
+
+ GO := go
+ GO_LDFLAGS := $(shell if $(GO) version|grep -q gccgo; then echo "-gccgoflags"; else echo "-ldflags"; fi)
+@@ -76,14 +78,14 @@
+ bin/buildah: $(SOURCES) cmd/buildah/*.go internal/mkcw/embed/entrypoint_amd64.gz
+	$(GO_BUILD) $(BUILDAH_LDFLAGS) $(GO_GCFLAGS) "$(GOGCFLAGS)" -o $@ $(BUILDFLAGS) ./cmd/buildah
+
+-ifneq ($(shell as --version | grep x86_64),)
++ifneq ($(shell $(AS) --version | grep x86_64),)
+ internal/mkcw/embed/entrypoint_amd64.gz: internal/mkcw/embed/entrypoint_amd64
+	gzip -k9nf $^
+
+ internal/mkcw/embed/entrypoint_amd64: internal/mkcw/embed/entrypoint_amd64.s
+	$(AS) -o $(patsubst %.s,%.o,$^) $^
+	$(LD) -o $@ $(patsubst %.s,%.o,$^)
+-	strip $@
++	$(STRIP) $@
+ endif
+EOF
+
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || {
+		cat <<-'EOF' > "${T}/disable_seccomp.patch"
+		 --- a/Makefile
+		 +++ b/Makefile
+		 @@ -5 +5 @@
+		 -SECURITYTAGS ?= seccomp $(APPARMORTAG)
+		 +SECURITYTAGS ?= $(APPARMORTAG)
+		EOF
+		eapply "${T}/disable_seccomp.patch" || die
+	}
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || {
+		cat <<-'EOF' > "${T}/disable_tests.patch"
+		--- a/Makefile
+		+++ b/Makefile
+		@@ -54 +54 @@
+		-all: bin/buildah bin/imgtype bin/copy bin/tutorial docs
+		+all: bin/buildah docs
+		@@ -123 +123 @@
+		-docs: install.tools ## build the docs on the host
+		+docs: ## build the docs on the host
+		EOF
+		eapply "${T}/disable_tests.patch" || die
+	}
+
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-1.35.3.ebuild b/app-containers/buildah/buildah-1.35.3.ebuild
new file mode 100644
index 000000000000..e1c7e23390e5
--- /dev/null
+++ b/app-containers/buildah/buildah-1.35.3.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	"${FILESDIR}"/dont-call-as-directly-upstream-pr-5436.patch
+	"${FILESDIR}"/softcode-strip-upstream-pr-5446.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || {
+		cat <<-'EOF' > "${T}/disable_seccomp.patch"
+		 --- a/Makefile
+		 +++ b/Makefile
+		 @@ -5 +5 @@
+		 -SECURITYTAGS ?= seccomp $(APPARMORTAG)
+		 +SECURITYTAGS ?= $(APPARMORTAG)
+		EOF
+		eapply "${T}/disable_seccomp.patch" || die
+	}
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || {
+		cat <<-'EOF' > "${T}/disable_tests.patch"
+		--- a/Makefile
+		+++ b/Makefile
+		@@ -54 +54 @@
+		-all: bin/buildah bin/imgtype bin/copy bin/tutorial docs
+		+all: bin/buildah docs
+		@@ -123 +123 @@
+		-docs: install.tools ## build the docs on the host
+		+docs: ## build the docs on the host
+		EOF
+		eapply "${T}/disable_tests.patch" || die
+	}
+
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-1.35.4.ebuild b/app-containers/buildah/buildah-1.35.4.ebuild
new file mode 100644
index 000000000000..e1c7e23390e5
--- /dev/null
+++ b/app-containers/buildah/buildah-1.35.4.ebuild
@@ -0,0 +1,133 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	"${FILESDIR}"/dont-call-as-directly-upstream-pr-5436.patch
+	"${FILESDIR}"/softcode-strip-upstream-pr-5446.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || {
+		cat <<-'EOF' > "${T}/disable_seccomp.patch"
+		 --- a/Makefile
+		 +++ b/Makefile
+		 @@ -5 +5 @@
+		 -SECURITYTAGS ?= seccomp $(APPARMORTAG)
+		 +SECURITYTAGS ?= $(APPARMORTAG)
+		EOF
+		eapply "${T}/disable_seccomp.patch" || die
+	}
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || {
+		cat <<-'EOF' > "${T}/disable_tests.patch"
+		--- a/Makefile
+		+++ b/Makefile
+		@@ -54 +54 @@
+		-all: bin/buildah bin/imgtype bin/copy bin/tutorial docs
+		+all: bin/buildah docs
+		@@ -123 +123 @@
+		-docs: install.tools ## build the docs on the host
+		+docs: ## build the docs on the host
+		EOF
+		eapply "${T}/disable_tests.patch" || die
+	}
+
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/buildah-9999.ebuild b/app-containers/buildah/buildah-9999.ebuild
new file mode 100644
index 000000000000..987715de5560
--- /dev/null
+++ b/app-containers/buildah/buildah-9999.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info toolchain-funcs
+
+DESCRIPTION="A tool that facilitates building OCI images"
+HOMEPAGE="https://github.com/containers/buildah"
+
+# main pkg
+LICENSE="Apache-2.0"
+# deps
+LICENSE+=" BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+
+SLOT="0"
+IUSE="apparmor btrfs +seccomp systemd test"
+RESTRICT="test"
+DOCS=(
+	"CHANGELOG.md"
+	"troubleshooting.md"
+	"docs/tutorials"
+)
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/containers/buildah.git"
+else
+	SRC_URI="https://github.com/containers/buildah/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+RDEPEND="
+	systemd? ( sys-apps/systemd )
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp:= )
+	apparmor? ( sys-libs/libapparmor:= )
+	>=app-containers/containers-common-0.58.0-r1
+	app-crypt/gpgme:=
+	dev-libs/libgpg-error:=
+	dev-libs/libassuan:=
+	sys-apps/shadow:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-go/go-md2man"
+
+PATCHES=(
+	"${FILESDIR}"/softcode-strip-upstream-pr-5446.patch
+)
+
+pkg_pretend() {
+	local CONFIG_CHECK=""
+	use btrfs && CONFIG_CHECK+=" ~BTRFS_FS"
+	check_extra_config
+
+	linux_config_exists || ewarn "Cannot determine configuration of your kernel."
+}
+
+src_prepare() {
+	default
+
+	# ensure all  necessary files are there
+	local file
+	for file in docs/Makefile hack/libsubid_tag.sh hack/apparmor_tag.sh \
+		hack/systemd_tag.sh btrfs_installed_tag.sh btrfs_tag.sh; do
+		[[ -f "${file}" ]] || die
+	done
+
+	sed -i -e "s|/usr/local|/usr|g" Makefile docs/Makefile || die
+	echo -e '#!/usr/bin/env bash\necho libsubid' > hack/libsubid_tag.sh || die
+
+	cat <<-EOF > hack/apparmor_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex apparmor 'echo apparmor' echo)
+	EOF
+
+	use seccomp || {
+		cat <<-'EOF' > "${T}/disable_seccomp.patch"
+		 --- a/Makefile
+		 +++ b/Makefile
+		 @@ -5 +5 @@
+		 -SECURITYTAGS ?= seccomp $(APPARMORTAG)
+		 +SECURITYTAGS ?= $(APPARMORTAG)
+		EOF
+		eapply "${T}/disable_seccomp.patch" || die
+	}
+
+	cat <<-EOF > hack/systemd_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex systemd 'echo systemd' echo)
+	EOF
+
+	echo -e "#!/usr/bin/env bash\n echo" > btrfs_installed_tag.sh || die
+	cat <<-EOF > btrfs_tag.sh || die
+	#!/usr/bin/env bash
+	$(usex btrfs echo 'echo exclude_graphdriver_btrfs btrfs_noversion')
+	EOF
+
+	use test || {
+		cat <<-'EOF' > "${T}/disable_tests.patch"
+		--- a/Makefile
+		+++ b/Makefile
+		@@ -54 +54 @@
+		-all: bin/buildah bin/imgtype bin/copy bin/tutorial docs
+		+all: bin/buildah docs
+		@@ -123 +123 @@
+		-docs: install.tools ## build the docs on the host
+		+docs: ## build the docs on the host
+		EOF
+		eapply "${T}/disable_tests.patch" || die
+	}
+
+}
+
+src_compile() {
+	# For non-live versions, prevent git operations which causes sandbox violations
+	# https://github.com/gentoo/gentoo/pull/33531#issuecomment-1786107493
+	[[ ${PV} != 9999* ]] && export COMMIT_NO="" GIT_COMMIT=""
+
+	tc-export AS LD STRIP
+	export GOMD2MAN="$(command -v go-md2man)"
+	default
+}
+
+src_test() {
+	emake test-unit
+}
+
+src_install() {
+	emake DESTDIR="${ED}" install install.completions
+	einstalldocs
+}
diff --git a/app-containers/buildah/files/dont-call-as-directly-upstream-pr-5436.patch b/app-containers/buildah/files/dont-call-as-directly-upstream-pr-5436.patch
new file mode 100644
index 000000000000..0fc376b1d68b
--- /dev/null
+++ b/app-containers/buildah/files/dont-call-as-directly-upstream-pr-5436.patch
@@ -0,0 +1,32 @@
+From c1b43b57bb20f8796002e1d6f93bbdbc02e28f20 Mon Sep 17 00:00:00 2001
+From: Rahil Bhimjiani <me@rahil.rocks>
+Date: Wed, 27 Mar 2024 14:27:09 +0530
+Subject: [PATCH] Makefile - instead of calling `as` directly, use it from env
+ var
+
+Signed-off-by: Rahil Bhimjiani <me@rahil.rocks>
+---
+ Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index f1ab6b8bf4..7d27a41530 100644
+--- a/Makefile
++++ b/Makefile
+@@ -16,6 +16,7 @@ BUILDFLAGS := -tags "$(BUILDTAGS)"
+ BUILDAH := buildah
+ SELINUXOPT ?= $(shell test -x /usr/sbin/selinuxenabled && selinuxenabled && echo -Z)
+ SELINUXTYPE=container_runtime_exec_t
++AS ?= as
+ 
+ GO := go
+ GO_LDFLAGS := $(shell if $(GO) version|grep -q gccgo; then echo "-gccgoflags"; else echo "-ldflags"; fi)
+@@ -79,7 +80,7 @@ bin/buildah: $(SOURCES) cmd/buildah/*.go internal/mkcw/embed/entrypoint_amd64.gz
+ 	$(GO_BUILD) $(BUILDAH_LDFLAGS) $(GO_GCFLAGS) "$(GOGCFLAGS)" -o $@ $(BUILDFLAGS) ./cmd/buildah
+ 	test -z "${SELINUXOPT}" || chcon --verbose -t $(SELINUXTYPE) $@
+ 
+-ifneq ($(shell as --version | grep x86_64),)
++ifneq ($(shell $(AS) --version | grep x86_64),)
+ internal/mkcw/embed/entrypoint_amd64.gz: internal/mkcw/embed/entrypoint_amd64
+ 	gzip -k9nf $^
+ 
diff --git a/app-containers/buildah/files/softcode-strip-upstream-pr-5446.patch b/app-containers/buildah/files/softcode-strip-upstream-pr-5446.patch
new file mode 100644
index 000000000000..0ca0a6602a7d
--- /dev/null
+++ b/app-containers/buildah/files/softcode-strip-upstream-pr-5446.patch
@@ -0,0 +1,29 @@
+commit 2cd31a0698bea846366e8e153619a108484a1a2a
+Author: Rahil Bhimjiani <me@rahil.rocks>
+Date:   Mon Apr 1 09:25:21 2024 +0530
+
+    Makefile: softcode `strip`, use it from env var
+    
+    Signed-off-by: Rahil Bhimjiani <me@rahil.rocks>
+
+diff --git a/Makefile b/Makefile
+index 7d27a4153..3a955c85a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -17,6 +17,7 @@ BUILDAH := buildah
+ SELINUXOPT ?= $(shell test -x /usr/sbin/selinuxenabled && selinuxenabled && echo -Z)
+ SELINUXTYPE=container_runtime_exec_t
+ AS ?= as
++STRIP ?= strip
+ 
+ GO := go
+ GO_LDFLAGS := $(shell if $(GO) version|grep -q gccgo; then echo "-gccgoflags"; else echo "-ldflags"; fi)
+@@ -87,7 +88,7 @@ internal/mkcw/embed/entrypoint_amd64.gz: internal/mkcw/embed/entrypoint_amd64
+ internal/mkcw/embed/entrypoint_amd64: internal/mkcw/embed/entrypoint_amd64.s
+ 	$(AS) -o $(patsubst %.s,%.o,$^) $^
+ 	$(LD) -o $@ $(patsubst %.s,%.o,$^)
+-	strip $@
++	$(STRIP) $@
+ endif
+ 
+ 
diff --git a/app-containers/buildah/metadata.xml b/app-containers/buildah/metadata.xml
index f3f28d12b5c5..93c7c7c12936 100644
--- a/app-containers/buildah/metadata.xml
+++ b/app-containers/buildah/metadata.xml
@@ -5,7 +5,21 @@
 		<email>zmedico@gentoo.org</email>
 		<name>Zac Medico</name>
 	</maintainer>
+	<maintainer type="person" proxied="yes">
+		<email>me@rahil.rocks</email>
+		<name>Rahil Bhimjiani</name>
+	</maintainer>
+	<maintainer type="project" proxied="proxy">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
 	<upstream>
 		<remote-id type="github">containers/buildah</remote-id>
 	</upstream>
+	<use>
+		<flag name="btrfs">
+		Enables dependencies for the "btrfs" graph driver, including
+		necessary kernel flags.
+	</flag>
+	</use>
 </pkgmetadata>