6 files changed, 617 insertions, 8 deletions
diff --git a/dev-lang/python/Manifest b/dev-lang/python/Manifest
index 3398644956..1f45842d37 100644
--- a/dev-lang/python/Manifest
+++ b/dev-lang/python/Manifest
@@ -4,6 +4,8 @@ DIST Python-3.11.3.tar.xz 19906156 BLAKE2B c23815e09a0012b2af03f3e18471389382978
 DIST Python-3.11.3.tar.xz.asc 833 BLAKE2B 1846858480428293047bfaf87a74f5a6cf28227f63dbc36e658ab68444a5b91c2178fca42f35a413591103a0ceeea3cd5f8b757fb2f42cbcad023c62970ab950 SHA512 34bfb6e74e2bbec15bf3f653e32a3d705961b5f724e3f4713cf9b6b530f9c9e7e94f5cf855798bdf9763235b97a60ec9ad554d24cdc793e21a0c39540b5818d8
 DIST Python-3.11.7.tar.xz 20074108 BLAKE2B 3414118d30076e4223571825b5c595c5795422244de20dc70d07389a03b2c2b03b98a9ff562a8fd164db8f776dd741a9d7beb1c2ae4087ec6af677619a9dfd80 SHA512 11e06f2ffe1f66888cb5b4e9f607de815294d6863a77eda6ec6d7c724ef158df9f51881f4a956d4a6fa973c2fb6fd031d495e3496e9b0bb53793fb1cc8434c63
 DIST Python-3.11.7.tar.xz.asc 833 BLAKE2B 32d6984631d7b4b064e2c2588835a89098842a0ecc3d8ccb893830c9946124a159123e2082e6da3abcdb97d27dde0fb68c1fd11e4ed2bf2e0641fa95191354bb SHA512 7b342990c6e32897047f8ba33c4d264f1be987b73843b61bd7db08bfa1a7280c616e9dcd96225f37602f876549d011ff82a4d79f1e32a5ab7d7cc22651bba44f
+DIST Python-3.12.3.tar.xz 20625068 BLAKE2B fc4f57ae50183db4c8cb37d94c37a7e58da5d031e03866841a678b986f01bbb8afdefb38124ba82b0a4988445b647214be43338dea13b0f063d3c2bf81c48c0b SHA512 4a2213b108e7f1f1525baa8348e68b2a2336d925e60d0a59f0225fc470768a2c8031edafc0b8243f94dbae18afda335ee5adf2785328c2218fd64cbb439f13a4
+DIST Python-3.12.3.tar.xz.asc 963 BLAKE2B f9668dde210793f8da0e0bb026b8ec3e0b4bc3abc58e72732f8faf356b19ca88a59b9d89b4b10f77b3602d9a967f0f2f44a0f091d698bc28ba9bad8049e5e006 SHA512 c291ec5b5e4f8deba867cc517624dd9a174745f04061ef737e58f3d52b9b30318264aec350e339fe88ccb493809ca1a90a378e86d86b8ec4a4f578b1a5843624
 DIST Python-3.8.8.tar.xz 18271736 BLAKE2B af0ff1acd919b365a58278e82678324ff884cc8120bcaf12e0e3afb1bd978e6469e256335df131935f51ff481fb83dda04e4b6f1cd1746611f9ec944db73d692 SHA512 64181db5aa48281284a3230436ebfb8cb91b645a9dec956fd48c0048334498477073fc4e14d6b426d0ef7fbcdcfd5d59cbf01a504e6c9014dc9529494b9309fb
 DIST Python-3.8.8.tar.xz.asc 833 BLAKE2B a11188f9f68c518259de1a4e271bf56409d7356a7eb3dd8cbea7bbb0b5bc1b43f9aeb85bda4add65bbae906bef65cb20a30bcc77da04c0d383cd5b527821fd85 SHA512 0e6f11a310c1796dd056d9a4b63b5e03aa8dbd290088966e04a590a78c00003887dbfd7a7029a6cf8c5626ecd6ca91c1c16433bb0a41bf1225b02b8db8541b95
 DIST Python-3.9.12.tar.xz 19740524 BLAKE2B 05f2469aa53ca36221ef4976b17bfde3e5b86afd5a8114e5a7fd899f975a8e55022555ef718d5352ab68de1b7b23865a0bf713768c9c2b30d591438c9a396d25 SHA512 081981901e14149748fd35228db0b3b1d96fef227ae7404f07b8bad0fda4b02649bf31c348c94aefdaf3327565d78f9489437c2c02f647b15d41376a27a23e97
@@ -13,12 +15,14 @@ DIST Python-3.9.6.tar.xz.asc 833 BLAKE2B 41901bfb80a901f2f14e86769e6d08ded8f7565
 DIST python-gentoo-patches-3.10.4.tar.xz 8592 BLAKE2B 67fba3e1fedb17430e5cd93da995b4acaf714db512031b5a2f775a25f793f007941561663cfa413d645ccddc2e22d65d250a40fa166cafda8805488d877ff57d SHA512 3ed2b8ff8f1eb8febe7dcd4b5d13d6d54468be1d525f8f1118977d3bbc78f690a597b09383939d023b03380a306e4bff1693382e29ff562312d803305b1709b2
 DIST python-gentoo-patches-3.11.3.tar.xz 7776 BLAKE2B 78bf26f554c608c68826b9ea3c63a1df2b45bff755860f39f14306ebb63f17f5111b117519c4a9cb30452a62a14a3a7393798b8920c3d108ec8b6a30db88641e SHA512 64b79c90055fd940590b72ffd3744fe02ab9e46caf7b46f4aa1d074bf3e62d355e128bb2ac68c42f228f2e1bcdee2b0b114d9e2b9bf8427512083c1c5f8680e8
 DIST python-gentoo-patches-3.11.7_p1.tar.xz 8364 BLAKE2B 246da406e6d58d85ab2ef79dd3a018a134e473f90d42f8dd9274629f998a6129f3b03da228aa5e65c1b4508a71979ceb1f752a28066c356f813be21c30a40f70 SHA512 c5c1448a2e9b15b8084125e07cee288b667267779d89da8aab9df4b1d014739ba9af4d09e51b3cdc37e8942821d7aee0d1998e55820b67b83ef654d0a442767e
+DIST python-gentoo-patches-3.12.3.tar.xz 6028 BLAKE2B 7953a48a1d95a6a33bd88060fbcac463a5469371aa0c882c3945f1fea64a63c4d45fca8451f51f4eaeea00a04267ad2e54e4cc720c95e8bb5a3477e00263b80a SHA512 4779bab2b24e59e4a77987ce3e9611d99e87c9c4d016309758c26a65fe2e11ef04d48d5af628c02b1552dc1f31b768f87448f8e19e716b4fe372941e6dacac3f
 DIST python-gentoo-patches-3.8.8_p1.tar.xz 15456 BLAKE2B 7d9f55f951f97ef7e08d0245dddd21f5b8d126735c1c392ba6326ad1c18023b477f62e9b6663d8e5b6f0362e442137d0b6ed3ea13b279cca6734d36dbe6e654f SHA512 7fff74d03a0c4cd4b5c977761179c2b9a0ed472847ee9544f54331cef7549557ac4d6b78e676058bd2b01c96ca59d84f04c55beca8ddc45f16b11ce349210eea
 DIST python-gentoo-patches-3.9.12.tar.xz 12848 BLAKE2B 5dd66fa94b136a463d2c4be3a5b7dfad770c3905467a1d81af02a35b2783ce7d614881c915ee8f8e764c1656963d6886d9c60c6e524f512e1bc496e42d01307b SHA512 07de63e47a8e547724099062239df8fcfd254f19d38be28131e6bbb094ffbab8483861fb6a5905e60d7fa7a1a5dc06785951fa31984ecad89516b0b742c47f91
 DIST python-gentoo-patches-3.9.6_p1.tar.xz 12764 BLAKE2B 927718f1aadb5d5ef67e647a639a10bffdd48474bf01e50bd37ef1242bce57606b7b54c4823c1da3585ee76e737028163e38e9b4e19037585cc53f925e1c5fa7 SHA512 f06fb55786bd942e72e3225ee9ce218724aeee29f301279743588749007e991851a8f29db5b5dfd85435e3d763c00942947909a6fc60581bd0f3e8a6e913bff8
 DIST python-prefix-gentoo-3.10.4-patches-r0.tar.xz 6772 BLAKE2B b807ae02242926d99c3823b73ce33193926d55891d54b5d214b4bdf24d2213b4d7b248030146a01698ceadd255affffef8937d84fc11e6d587ffcc91286e81b2 SHA512 a8f16d12b785a4b9ca884e4235cb298e4155273534a7957e517a679f0c2d4b35dcca08e445bed3fe2a80e3a6441f04004eae955a362eb1091ac1f9e2b9a5448f
 DIST python-prefix-gentoo-3.11.3-patches-r3.tar.xz 5404 BLAKE2B 7c76056854361a4dad879218d2e0f60f874d534ac354c6b47158b5b0de18e5c66a522e717efa8a0a8a0ca3c77dbe5e9297a2ea17b725cb9c7e59478defd951ae SHA512 1bfb1c5e9b53c0b2f5d5fbf112c1742cc91a5cc3f505dc0d8d54683b508063be3578e3e6b8ad617bb0ea0a311b9235d862867ec4e9ca3fbcefcda98613235c72
 DIST python-prefix-gentoo-3.11.7-patches-r1.tar.xz 5752 BLAKE2B 8d6ee07491b23d1947af748b0178fd5c81cce78e77e2153480425d38a6b9badeb3b42cd635d340ddf50a451f977f04f498ac25ad1a18250ddae851aac06b9a0d SHA512 c5687c97a41c2e1ed0eacac987a7ea4b38bb8b60b91a16d2ea36ce9aad2f3360d25295951c083386b791b33f18267e545bfcb8280172f878736fef57d7188d0f
+DIST python-prefix-gentoo-3.12.3-patches-r0.tar.xz 3464 BLAKE2B 965ccf0cc82b26e58adc332a2bcaa346578dfbec7abc1bed5451e0b8ac7c1e7612a7abe3ce757777f0fd6e38d1e0c7682c2ac3b617fb03fd2849686593b10e27 SHA512 a5648e7a9fc6fdc20f868d53c121d2e63ee370719b1b84d253df1fd472306879ab4b32d4d0685c576562ba6a8c06d3ac2250a8cbd44bbe2c7a1dd832e0c19d6d
 DIST python-prefix-gentoo-3.8.7-patches-r2.tar.xz 8312 BLAKE2B 268f3cff62dc51d4f91994c3f6b05cea0e29edb1ccf39476ba52485fb94c3cad72b54ed5cd941c227bdad004a7ae0069d60ee6bbde5a30d16115263d0dc2a5c3 SHA512 e43ce1e9e851bebce968ee025f765fc9a558c8edc4ee2d51616043183fd12301ab3d5c7f92915238e53b5cf92f6c00617ab0fcf9859d4cebe0966271e6f64725
 DIST python-prefix-gentoo-3.9.12-patches-r1.tar.xz 7124 BLAKE2B afff1a574e13515084b0bee3aee1d0f0796ed885451086485f54f3c9a2498de6b4f403fdec1fe7fc5718a45fd89773720a4ef24d700b494337665b3f6d74e2de SHA512 4a12e8be1b38217d66e4a6374e09f93f956fdf4970130edcea2fedd6989c9a1af309fa939c213f8645676401c6d10b5e8789dbe902de9c03b8ea2b57c1632b72
 DIST python-prefix-gentoo-3.9.6_p1-patches-r0.tar.xz 6984 BLAKE2B 8b032d3000fd2dfcb8e099ac071c1a911ba2a0e30343788f7191043800f9d0088307cd7007b2b3f6cc7d2f315fc22bbac5990fed81f0dd8d60dca0314bd59b88 SHA512 76c56895c99ee203bd266f475766d2572659939abaf478932e7c9c65ddc52cb5e012e23c9455dd0a4bf0281a07c70e23a2fea8337c693b8a4ac8abb534e21982
diff --git a/dev-lang/python/python-3.10.4.ebuild b/dev-lang/python/python-3.10.4.ebuild
index 53e206db6f..fa646ffba1 100644
--- a/dev-lang/python/python-3.10.4.ebuild
+++ b/dev-lang/python/python-3.10.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -80,7 +80,7 @@ RDEPEND+="
 	build? ( app-misc/mime-types )
 "
 
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
 CHECKREQS_DISK_BUILD=5500M
diff --git a/dev-lang/python/python-3.11.3.ebuild b/dev-lang/python/python-3.11.3.ebuild
index 5becaebadc..39522bf64c 100644
--- a/dev-lang/python/python-3.11.3.ebuild
+++ b/dev-lang/python/python-3.11.3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -96,7 +96,7 @@ if [[ ${PV} != *_alpha* ]]; then
 	"
 fi
 
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
 CHECKREQS_DISK_BUILD=5500M
diff --git a/dev-lang/python/python-3.12.3.ebuild b/dev-lang/python/python-3.12.3.ebuild
new file mode 100644
index 0000000000..01e1834a66
--- /dev/null
+++ b/dev-lang/python/python-3.12.3.ebuild
@@ -0,0 +1,605 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+WANT_LIBTOOL="none"
+
+inherit autotools check-reqs flag-o-matic multiprocessing pax-utils
+inherit prefix python-utils-r1 toolchain-funcs verify-sig
+
+MY_PV=${PV/_rc/rc}
+MY_P="Python-${MY_PV%_p*}"
+PYVER=$(ver_cut 1-2)
+PATCHSET="python-gentoo-patches-${MY_PV}"
+PREFIX_PATCHSET="python-prefix-gentoo-${MY_PV%_p*}-patches-r0"
+
+DESCRIPTION="An interpreted, interactive, object-oriented programming language"
+HOMEPAGE="
+	https://www.python.org/
+	https://github.com/python/cpython/
+"
+SRC_URI="
+	https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz
+	https://dev.gentoo.org/~mgorny/dist/python/${PATCHSET}.tar.xz
+	https://dev.gentoo.org/~grobian/distfiles/${PREFIX_PATCHSET}.tar.xz
+	verify-sig? (
+		https://www.python.org/ftp/python/${PV%%_*}/${MY_P}.tar.xz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="PSF-2"
+SLOT="${PYVER}"
+KEYWORDS="~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	aqua
+	bluetooth build debug +ensurepip examples gdbm libedit
+	+ncurses pgo +readline +sqlite +ssl test tk valgrind
+"
+RESTRICT="!test? ( test )"
+
+# Do not add a dependency on dev-lang/python to this ebuild.
+# If you need to apply a patch which requires python for bootstrapping, please
+# run the bootstrap code on your dev box and include the results in the
+# patchset. See bug 447752.
+
+RDEPEND="
+	app-arch/bzip2:=
+	app-arch/xz-utils:=
+	app-crypt/libb2
+	>=dev-libs/expat-2.1:=
+	dev-libs/libffi:=
+	dev-python/gentoo-common
+	>=sys-libs/zlib-1.1.3:=
+	virtual/libcrypt:=
+	virtual/libintl
+	ensurepip? ( dev-python/ensurepip-pip )
+	gdbm? ( sys-libs/gdbm:=[berkdb] )
+	kernel_linux? ( sys-apps/util-linux:= )
+	ncurses? ( >=sys-libs/ncurses-5.2:= )
+	readline? (
+		!libedit? ( >=sys-libs/readline-4.1:= )
+		libedit? ( dev-libs/libedit:= )
+	)
+	sqlite? ( >=dev-db/sqlite-3.3.8:3= )
+	ssl? ( >=dev-libs/openssl-1.1.1:= )
+	tk? (
+		>=dev-lang/tcl-8.0:=
+		>=dev-lang/tk-8.0:=
+		dev-tcltk/blt:=
+		dev-tcltk/tix
+	)
+	elibc_Darwin? ( sys-libs/native-uuid )
+	elibc_SunOS? ( sys-libs/libuuid )
+"
+# bluetooth requires headers from bluez
+DEPEND="
+	${RDEPEND}
+	bluetooth? ( net-wireless/bluez )
+	test? (
+		app-arch/xz-utils
+		dev-python/ensurepip-pip
+		dev-python/ensurepip-setuptools
+		dev-python/ensurepip-wheel
+	)
+	valgrind? ( dev-debug/valgrind )
+"
+# autoconf-archive needed to eautoreconf
+BDEPEND="
+	dev-build/autoconf-archive
+	app-alternatives/awk
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-python-20221025 )
+"
+RDEPEND+="
+	!build? ( app-misc/mime-types )
+"
+if [[ ${PV} != *_alpha* ]]; then
+	RDEPEND+="
+		dev-lang/python-exec[python_targets_python${PYVER/./_}(-)]
+	"
+fi
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
+
+# large file tests involve a 2.5G file being copied (duplicated)
+CHECKREQS_DISK_BUILD=5500M
+
+QA_PKGCONFIG_VERSION=${PYVER}
+# false positives -- functions specific to *BSD
+QA_CONFIG_IMPL_DECL_SKIP=( chflags lchflags )
+
+pkg_pretend() {
+	use test && check-reqs_pkg_pretend
+}
+
+pkg_setup() {
+	use test && check-reqs_pkg_setup
+}
+
+src_unpack() {
+	if use verify-sig; then
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.xz{,.asc}
+	fi
+	default
+}
+
+src_prepare() {
+	# Ensure that internal copies of expat and libffi are not used.
+	# TODO: Makefile has annoying deps on expat headers
+	#rm -r Modules/expat || die
+
+	local PATCHES=(
+		"${WORKDIR}/${PATCHSET}"
+		# Prefix' round of patches
+		"${WORKDIR}"/${PREFIX_PATCHSET}
+	)
+
+	default
+
+	# enable this to create a pre-patched (prefix bootstrap) tree
+	if [[ -n ${GENTOO_PREFIX_CREATE_TAR} ]] ; then
+		eautoreconf
+		tarfile="${T}"/Python-${PV}-gentoo-prefix-patched.tar.xz
+		tar --numeric-owner -Jcf "${tarfile}" -C .. Python-${PV}
+		die "${tarfile}"
+	fi
+
+	# force the correct number of jobs
+	# https://bugs.gentoo.org/737660
+	sed -i -e "s:-j0:-j$(makeopts_jobs):" Makefile.pre.in || die
+	# workaround a problem on ppc-macos with >=GCC-8 where dtoa gets
+	# miscompiled when optimisation is being used
+	if [[ ${CHOST} == powerpc*-darwin* ]] && \
+		tc-is-gcc && [[ $(gcc-major-version) -ge 8 ]] ;
+	then
+		sed -i \
+			-e '/^CFLAGS_ALIASING=/s/$/ -fno-tree-ter/' Makefile.pre.in || die
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# OpenIndiana/Solaris 11 defines inet_aton no longer in
+		# libresolv, so use hstrerror to check if we need -lresolv
+		sed -i -e '/AC_CHECK_LIB/s/inet_aton/hstrerror/' \
+			configure.ac configure || die
+	fi
+
+	eautoreconf
+}
+
+build_cbuild_python() {
+	# Hack to workaround get_libdir not being able to handle CBUILD, bug #794181
+	local cbuild_libdir=$(unset PKG_CONFIG_PATH ; $(tc-getBUILD_PKG_CONFIG) --keep-system-libs --libs-only-L libffi)
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	#
+	# -fno-lto to avoid bug #700012 (not like it matters for mini-CBUILD Python anyway)
+	local -x CFLAGS_NODIST="${BUILD_CFLAGS} -fno-lto"
+	local -x LDFLAGS_NODIST=${BUILD_LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+	local -x BUILD_CFLAGS="${CFLAGS_NODIST}"
+	local -x BUILD_LDFLAGS=${LDFLAGS_NODIST}
+
+	# We need to build our own Python on CBUILD first, and feed it in.
+	# bug #847910
+	local myeconfargs_cbuild=(
+		"${myeconfargs[@]}"
+
+		--prefix="${BROOT}"/usr
+		--libdir="${cbuild_libdir:2}"
+
+		# Avoid needing to load the right libpython.so.
+		--disable-shared
+
+		# As minimal as possible for the mini CBUILD Python
+		# we build just for cross to satisfy --with-build-python.
+		--without-lto
+		--without-readline
+		--disable-optimizations
+	)
+
+	mkdir "${WORKDIR}"/${P}-${CBUILD} || die
+	pushd "${WORKDIR}"/${P}-${CBUILD} &> /dev/null || die
+
+	# Avoid as many dependencies as possible for the cross build.
+	mkdir Modules || die
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		_dbm _gdbm
+		_sqlite3
+		_hashlib _ssl
+		_curses _curses_panel
+		readline
+		_tkinter
+		pyexpat
+		zlib
+		# We disabled these for CBUILD because Python's setup.py can't handle locating
+		# libdir correctly for cross. This should be rechecked for the pure Makefile approach,
+		# and uncommented if needed.
+		#_ctypes _crypt
+	EOF
+
+	ECONF_SOURCE="${S}" econf_build "${myeconfargs_cbuild[@]}"
+
+	# Unfortunately, we do have to build this immediately, and
+	# not in src_compile, because CHOST configure for Python
+	# will check the existence of the --with-build-python value
+	# immediately.
+	emake
+	popd &> /dev/null || die
+}
+
+src_configure() {
+	# disable automagic bluetooth headers detection
+	if ! use bluetooth; then
+		local -x ac_cv_header_bluetooth_bluetooth_h=no
+	fi
+
+	append-flags -fwrapv
+	filter-flags -malign-double
+
+	# Export CXX so it ends up in /usr/lib/python3.X/config/Makefile.
+	# PKG_CONFIG needed for cross.
+	tc-export CXX PKG_CONFIG
+
+	local dbmliborder=
+	if use gdbm; then
+		dbmliborder+="${dbmliborder:+:}gdbm"
+	fi
+
+	if use pgo; then
+		local profile_task_flags=(
+			-m test
+			"-j$(makeopts_jobs)"
+			--pgo-extended
+			-u-network
+
+			# We use a timeout because of how often we've had hang issues
+			# here. It also matches the default upstream PROFILE_TASK.
+			--timeout 1200
+
+			-x test_gdb
+			-x test_dtrace
+
+			# All of these seem to occasionally hang for PGO inconsistently
+			# They'll even hang here but be fine in src_test sometimes.
+			# bug #828535 (and related: bug #788022)
+			-x test_asyncio
+			-x test_concurrent_futures
+			-x test_httpservers
+			-x test_logging
+			-x test_multiprocessing_fork
+			-x test_socket
+			-x test_xmlrpc
+
+			# Hangs (actually runs indefinitely executing itself w/ many cpython builds)
+			# bug #900429
+			-x test_tools
+		)
+
+		if has_version "app-arch/rpm" ; then
+			# Avoid sandbox failure (attempts to write to /var/lib/rpm)
+			profile_task_flags+=(
+				-x test_distutils
+			)
+		fi
+		local -x PROFILE_TASK="${profile_task_flags[*]}"
+	fi
+
+	# flock on 32-bits sparc Solaris is broken
+	[[ ${CHOST} == sparc-*-solaris* ]] && \
+		export ac_cv_flock_decl=no
+	# Darwin 9's kqueue seems to act up (at least at this stage), so
+	# make Python's selectors resort to poll() or select()
+	[[ ${CHOST} == powerpc*-darwin9 ]] && \
+		export ac_cv_func_kqueue=no
+
+	local myeconfargs=(
+		# glibc-2.30 removes it; since we can't cleanly force-rebuild
+		# Python on glibc upgrade, remove it proactively to give
+		# a chance for users rebuilding python before glibc
+		# except on non-glibc systems this breaks the build, so be
+		# conservative!
+		$(use elibc_glibc && echo ac_cv_header_stropts_h=no)
+
+		$(use aqua && echo --config-cache)
+		--enable-shared
+		--without-static-libpython
+		--enable-ipv6
+		--infodir='${prefix}/share/info'
+		--mandir='${prefix}/share/man'
+		--with-computed-gotos
+		--with-dbmliborder="${dbmliborder}"
+		--with-libc=
+		--enable-loadable-sqlite-extensions
+		--without-ensurepip
+		--without-lto
+		--with-system-expat
+		--with-platlibdir=lib
+		--with-pkg-config=yes
+		--with-wheel-pkg-dir="${EPREFIX}"/usr/lib/python/ensurepip
+
+		$(use_with debug assertions)
+		$(use_enable pgo optimizations)
+		$(use_with readline readline "$(usex libedit editline readline)")
+		$(use_with valgrind)
+	)
+
+	# https://bugs.gentoo.org/700012
+	if tc-is-lto; then
+		append-cflags $(test-flags-CC -ffat-lto-objects)
+		myeconfargs+=(
+			--with-lto
+		)
+	fi
+
+	# Force-disable modules we don't want built.
+	# See Modules/Setup for docs on how this works. Setup.local contains our local deviations.
+	cat > Modules/Setup.local <<-EOF || die
+		*disabled*
+		nis
+		$(usev !gdbm '_gdbm _dbm')
+		$(usev !sqlite '_sqlite3')
+		$(usev !ssl '_hashlib _ssl')
+		$(usev !ncurses '_curses _curses_panel')
+		$(usev !readline 'readline')
+		$(usev !tk '_tkinter')
+		$([[ ${CHOST} == *-apple-darwin* ]] && echo '_scproxy')
+		$([[ ${CHOST} != *-linux-* ]] && echo 'ossaudiodev')
+	EOF
+
+	# disable implicit optimization/debugging flags
+	local -x OPT=
+
+	if tc-is-cross-compiler ; then
+		build_cbuild_python
+		myeconfargs+=(
+			# Point the imminent CHOST build to the Python we just
+			# built for CBUILD.
+			--with-build-python="${WORKDIR}"/${P}-${CBUILD}/python
+		)
+	fi
+
+	# pass system CFLAGS & LDFLAGS as _NODIST, otherwise they'll get
+	# propagated to sysconfig for built extensions
+	local -x CFLAGS_NODIST=${CFLAGS}
+	local -x LDFLAGS_NODIST=${LDFLAGS}
+	local -x CFLAGS= LDFLAGS=
+
+	# Fix implicit declarations on cross and prefix builds. Bug #674070.
+	if use ncurses; then
+		append-cppflags -I"${ESYSROOT}"/usr/include/ncursesw
+	fi
+
+	if use aqua ; then
+		ECONF_SOURCE="${S}" OPT="" \
+			econf \
+			--enable-framework="${EPREFIX}" \
+			--config-cache
+	fi
+
+	econf "${myeconfargs[@]}"
+
+	if grep -q "#define POSIX_SEMAPHORES_NOT_ENABLED 1" pyconfig.h; then
+		eerror "configure has detected that the sem_open function is broken."
+		eerror "Please ensure that /dev/shm is mounted as a tmpfs with mode 1777."
+		die "Broken sem_open function (bug 496328)"
+	fi
+
+	# install epython.py as part of stdlib
+	echo "EPYTHON='python${PYVER}'" > Lib/epython.py || die
+}
+
+src_compile() {
+	# Ensure sed works as expected
+	# https://bugs.gentoo.org/594768
+	local -x LC_ALL=C
+	export PYTHONSTRICTEXTENSIONBUILD=1
+
+	# Save PYTHONDONTWRITEBYTECODE so that 'has_version' doesn't
+	# end up writing bytecode & violating sandbox.
+	# bug #831897
+	local -x _PYTHONDONTWRITEBYTECODE=${PYTHONDONTWRITEBYTECODE}
+
+	if use pgo ; then
+		# bug 660358
+		local -x COLUMNS=80
+		local -x PYTHONDONTWRITEBYTECODE=
+
+		addpredict "/usr/lib/python${PYVER}/site-packages"
+	fi
+
+	# also need to clear the flags explicitly here or they end up
+	# in _sysconfigdata*
+	emake CPPFLAGS= CFLAGS= LDFLAGS=
+
+	# Restore saved value from above.
+	local -x PYTHONDONTWRITEBYTECODE=${_PYTHONDONTWRITEBYTECODE}
+
+	# Work around bug 329499. See also bug 413751 and 457194.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E python
+	else
+		pax-mark m python
+	fi
+}
+
+src_test() {
+	# Tests will not work when cross compiling.
+	if tc-is-cross-compiler; then
+		elog "Disabling tests due to crosscompiling."
+		return
+	fi
+
+	# this just happens to skip test_support.test_freeze that is broken
+	# without bundled expat
+	# TODO: get a proper skip for it upstream
+	local -x LOGNAME=buildbot
+
+	local test_opts=(
+		-u-network
+		-j "$(makeopts_jobs)"
+
+		# fails
+		-x test_concurrent_futures
+		-x test_gdb
+	)
+
+	if use sparc ; then
+		# bug #788022
+		test_opts+=(
+			-x test_multiprocessing_fork
+			-x test_multiprocessing_forkserver
+		)
+	fi
+
+	# workaround docutils breaking tests
+	cat > Lib/docutils.py <<-EOF || die
+		raise ImportError("Thou shalt not import!")
+	EOF
+
+	# bug 660358
+	local -x COLUMNS=80
+	local -x PYTHONDONTWRITEBYTECODE=
+	# workaround https://bugs.gentoo.org/775416
+	addwrite "/usr/lib/python${PYVER}/site-packages"
+
+	nonfatal emake -Onone test EXTRATESTOPTS="${test_opts[*]}" \
+		CPPFLAGS= CFLAGS= LDFLAGS= < /dev/tty
+	local ret=${?}
+
+	rm Lib/docutils.py || die
+
+	[[ ${ret} -eq 0 ]] || die "emake test failed"
+}
+
+src_install() {
+	local libdir=${ED}/usr/lib/python${PYVER}
+
+	# the Makefile rules are broken
+	# https://github.com/python/cpython/issues/100221
+	mkdir -p "${libdir}"/lib-dynload || die
+
+	# -j1 hack for now for bug #843458
+	emake -j1 DESTDIR="${D}" altinstall
+
+	if use aqua ; then
+		# avoid config.status to be triggered
+		find Mac -name "Makefile" -exec touch \{\} + || die
+
+		# Python_Launcher is kind of a wrapper, and we should fix it for
+		# Prefix (it uses /usr/bin/pythonw) so useless
+		# IDLE doesn't run, no idea, but definitely not used
+		emake DESTDIR="${D}" -C Mac install_Python || die
+		rmdir "${ED}"/Applications/Python* || die
+		rmdir "${ED}"/Applications || die
+
+		local fwdir=/Frameworks/Python.framework/Versions/${PYVER}
+		ln -s "${EPREFIX}"/usr/include/python${PYVER} \
+			"${ED}${fwdir}"/Headers || die
+		ln -s "${EPREFIX}"/usr/lib/libpython${PYVER}.dylib \
+			"${ED}${fwdir}"/Python || die
+	fi
+
+	# Fix collisions between different slots of Python.
+	rm -f "${ED}/usr/$(get_libdir)/libpython3$(get_libname)" || die
+
+	# Cheap hack to get version with ABIFLAGS
+	local abiver=$(cd "${ED}/usr/include"; echo python*)
+	if [[ ${abiver} != python${PYVER} ]]; then
+		# Replace python3.X with a symlink to python3.Xm
+		rm "${ED}/usr/bin/python${PYVER}" || die
+		dosym "${abiver}" "/usr/bin/python${PYVER}"
+		# Create python3.X-config symlink
+		dosym "${abiver}-config" "/usr/bin/python${PYVER}-config"
+		# Create python-3.5m.pc symlink
+		dosym "python-${PYVER}.pc" "/usr/$(get_libdir)/pkgconfig/${abiver/${PYVER}/-${PYVER}}.pc"
+	fi
+
+	# python seems to get rebuilt in src_install (bug 569908)
+	# Work around it for now.
+	if has_version dev-libs/libffi[pax-kernel]; then
+		pax-mark E "${ED}/usr/bin/${abiver}"
+	else
+		pax-mark m "${ED}/usr/bin/${abiver}"
+	fi
+
+	rm -r "${libdir}"/ensurepip/_bundled || die
+	if ! use ensurepip; then
+		rm -r "${libdir}"/ensurepip || die
+	fi
+	if ! use sqlite; then
+		rm -r "${libdir}/"sqlite3 || die
+	fi
+	if ! use tk; then
+		rm -r "${ED}/usr/bin/idle${PYVER}" || die
+		rm -r "${libdir}/"{idlelib,tkinter,test/test_tk*} || die
+	fi
+
+	ln -s ../python/EXTERNALLY-MANAGED "${libdir}/EXTERNALLY-MANAGED" || die
+
+	dodoc Misc/{ACKS,HISTORY,NEWS}
+
+	if use examples; then
+		docinto examples
+		find Tools -name __pycache__ -exec rm -fr {} + || die
+		dodoc -r Tools
+	fi
+	insinto /usr/share/gdb/auto-load/usr/$(get_libdir) #443510
+	local libname=$(
+		printf 'e:\n\t@echo $(INSTSONAME)\ninclude Makefile\n' |
+		emake --no-print-directory -s -f - 2>/dev/null
+	)
+	newins Tools/gdb/libpython.py "${libname}"-gdb.py
+
+	newconfd "${FILESDIR}/pydoc.conf" pydoc-${PYVER}
+	newinitd "${FILESDIR}/pydoc.init" pydoc-${PYVER}
+	sed \
+		-e "s:@PYDOC_PORT_VARIABLE@:PYDOC${PYVER/./_}_PORT:" \
+		-e "s:@PYDOC@:pydoc${PYVER}:" \
+		-i "${ED}/etc/conf.d/pydoc-${PYVER}" \
+		"${ED}/etc/init.d/pydoc-${PYVER}" || die "sed failed"
+
+	# python-exec wrapping support
+	local pymajor=${PYVER%.*}
+	local EPYTHON=python${PYVER}
+	local scriptdir=${D}$(python_get_scriptdir)
+	mkdir -p "${scriptdir}" || die
+	# python and pythonX
+	ln -s "../../../bin/${abiver}" "${scriptdir}/python${pymajor}" || die
+	ln -s "python${pymajor}" "${scriptdir}/python" || die
+	# python-config and pythonX-config
+	# note: we need to create a wrapper rather than symlinking it due
+	# to some random dirname(argv[0]) magic performed by python-config
+	cat > "${scriptdir}/python${pymajor}-config" <<-EOF || die
+		#!/bin/sh
+		exec "${abiver}-config" "\${@}"
+	EOF
+	chmod +x "${scriptdir}/python${pymajor}-config" || die
+	ln -s "python${pymajor}-config" "${scriptdir}/python-config" || die
+	# 2to3, pydoc
+	ln -s "../../../bin/2to3-${PYVER}" "${scriptdir}/2to3" || die
+	ln -s "../../../bin/pydoc${PYVER}" "${scriptdir}/pydoc" || die
+	# idle
+	if use tk; then
+		ln -s "../../../bin/idle${PYVER}" "${scriptdir}/idle" || die
+	fi
+}
+
+pkg_postinst() {
+	local v
+	for v in ${REPLACING_VERSIONS}; do
+		if ver_test "${v}" -lt 3.11.0_beta4-r2; then
+			ewarn "Python 3.11.0b4 has changed its module ABI.  The .pyc files"
+			ewarn "installed previously are no longer valid and will be regenerated"
+			ewarn "(or ignored) on the next import.  This may cause sandbox failures"
+			ewarn "when installing some packages and checksum mismatches when removing"
+			ewarn "old versions.  To actively prevent this, rebuild all packages"
+			ewarn "installing Python 3.11 modules, e.g. using:"
+			ewarn
+			ewarn "  emerge -1v /usr/lib/python3.11/site-packages"
+		fi
+	done
+}
diff --git a/dev-lang/python/python-3.9.12.ebuild b/dev-lang/python/python-3.9.12.ebuild
index cee152c2bb..10c3b971fc 100644
--- a/dev-lang/python/python-3.9.12.ebuild
+++ b/dev-lang/python/python-3.9.12.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -75,7 +75,7 @@ RDEPEND+="
 	!build? ( app-misc/mime-types )
 "
 
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
 CHECKREQS_DISK_BUILD=5500M
diff --git a/dev-lang/python/python-3.9.6_p1-r1.ebuild b/dev-lang/python/python-3.9.6_p1-r1.ebuild
index 018f288e08..4c2c3f1d02 100644
--- a/dev-lang/python/python-3.9.6_p1-r1.ebuild
+++ b/dev-lang/python/python-3.9.6_p1-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2021 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -65,7 +65,7 @@ BDEPEND="
 	!sys-devel/gcc[libffi(-)]"
 RDEPEND+=" !build? ( app-misc/mime-types )"
 
-VERIFY_SIG_OPENPGP_KEY_PATH=${BROOT}/usr/share/openpgp-keys/python.org.asc
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/python.org.asc
 
 # large file tests involve a 2.5G file being copied (duplicated)
 CHECKREQS_DISK_BUILD=5500M