overlay stage1-hooks: Add hooks for libxcrypt migration

They are copying sys-libs/libxcrypt from new portage-stable and
updating package masks and USE flags in order to migrate from
glibc-provided libcrypt to libxcrypt-provided libcrypt.

The migration seems to be a bit complicated to do, because
bootstrapping a system using glibc with libxcrypt-provided libcrypt
using a build environment using glibc with glibc-provided libcrypt
results in some slot conflicts. Without the stage1 hooks the failure
happened in stage2. With the hooks, but without the seed SDK update,
the failure happened already in stage1.

Updating the seed SDK to use libxcrypt seems to do the trick. The
update of the seed SDK will happen only when transition happens - if
the seed SDK is already using libxcrypt, these hooks are noops.

sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0000-glibc-crypt-portage-stable.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo=${1}
+new_repo=${2}
+update_seed_file=${3}
+
+cat=sys-libs
+pkg=libxcrypt
+
+if [[ -d "${stage1_repo}/${cat}/${pkg}" ]]; then
+    # libxcrypt is already a part of portage-stable, nothing to do
+    exit 0
+fi
+
+mkdir -p "${stage1_repo}/${cat}"
+cp -a "${new_repo}/${cat}/${pkg}" "${stage1_repo}/${cat}/${pkg}"
+echo x >"${update_seed_file}"

sdk_container/src/third_party/coreos-overlay/coreos/stage1_hooks/0002-glibc-crypt-coreos-overlay.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+set -x
+set -euo pipefail
+
+stage1_repo=${1}
+new_repo=${2}
+update_seed_file=${3}
+
+base_profile_dir='profiles/coreos/base'
+
+declare -A fixups_old=(
+    ['package.mask']='>=virtual/libcrypt-2'
+    ['package.unmask']='=virtual/libcrypt-1-r1'
+    ['package.use.force']='sys-libs/glibc crypt'
+    ['package.use.mask']='sys-libs/glibc -crypt'
+)
+
+declare -A fixups_new=(
+    ['package.mask']='>=virtual/libcrypt-2'
+    ['package.unmask']='<virtual/libcrypt-2'
+    ['package.use.force']='sys-libs/glibc crypt'
+    ['package.use.mask']='sys-libs/glibc -crypt'
+)
+
+for var_name in fixups_old fixups_new; do
+    declare -n fixups="${var_name}"
+
+    skip=''
+    for f in "${!fixups[@]}"; do
+        l=${fixups["${f}"]}
+        ff="${stage1_repo}/${base_profile_dir}/${f}"
+        if ! grep --quiet --fixed-strings --line-regexp --regexp="${l}" -- "${ff}"; then
+            # fixup not applicable, try next one
+            skip=x
+            break
+        fi
+    done
+
+    if [[ -n ${skip} ]]; then
+        unset -n fixups
+        continue
+    fi
+
+    for f in "${!fixups[@]}"; do
+        l=${fixups["${f}"]}
+        ff="${stage1_repo}/${base_profile_dir}/${f}"
+        ffb="${ff}.bak"
+        mv "${ff}" "${ffb}"
+        grep --invert-match --fixed-strings --line-regexp --regexp="${l}" -- "${ffb}" >"${ff}"
+    done
+    echo x >"${update_seed_file}"
+    exit 0
+done