Adding metadata

5 files changed, 512 insertions, 0 deletions

diff --git a/sys-firmware/edk2-bin/Manifest b/sys-firmware/edk2-bin/Manifest
index 50cce1f73972..45b124eb191d 100644
--- a/sys-firmware/edk2-bin/Manifest
+++ b/sys-firmware/edk2-bin/Manifest
@@ -7,4 +7,8 @@ DIST edk2-202511-1-qemu-aarch64.xpak 4052801 BLAKE2B 79fb12322613286fc0733da774e
 DIST edk2-202511-1-qemu-loongarch64.xpak 1994972 BLAKE2B 98ef04fa0042f82458b48e5edee4ee271196bdc73ab3e7c0c97397c2a989240881fa1d0d3ed5e24f35731a37be43c1f140914965fb04b2f03aabd00e0615782d SHA512 deac522183b2c2a4ca54dacad087a753866b66cef148b481f77c9a4d163fd972ab043340880d66be523b99ba40e7e7bb0efaf4282cc6cbd41e6f0bdff05fe485
 DIST edk2-202511-1-qemu-riscv64.xpak 1847391 BLAKE2B ef1070607e4e937a211c39e558e7012a02387f29d876680b9b05aaeffb8d7dda9c56a20d05d607319def68e1677a2c8985fb498a2c55bb607251a4fbe6c3d5eb SHA512 e9bdc4141dc0ded6b7620eadfda89fc7009823e7762759cd925cfc6d178a50638aa09f088b7d195b1bf18b70d8e920ee00d4ed35a65fa39b6061729ebd828c66
 DIST edk2-202511-1-qemu-x86_64.xpak 8985483 BLAKE2B 752351a7ccdb7e16274e94bd1d43d605c31b6babe0dbe4af189aeedbb70a0d943c7be8c4b9b1808cf4229603ca2ffeb4e90d6419000fb3691af7fa73e9792881 SHA512 aca265ad79cb0a835e7dc2bbf3fdcdfce43d2f03a5fd9663f0d3b719620ae4adc4f16453759c547adf508d7a549463875788a0913e0fae8b7e630915ad7c33b5
+DIST edk2-202605-1-qemu-aarch64.xpak 4073020 BLAKE2B 00756e94cb7bae3a964f05aa9ef0d28662aecd262abd6e424870f19aa02869e5b7a10883f2325d5b717af7d31b6bf93c2236aab4f04816061a5d096e062044b2 SHA512 237b11036753eaa5529c61ef9c093ca1f394352c67e8695a29ed876a75f903f21583aa3f3f2c088afe84562f0a16d9b19b80206338449af194a25d2258ff62fa
+DIST edk2-202605-1-qemu-loongarch64.xpak 2141697 BLAKE2B 41a28e42a82ee5b40dd9baf196bd7dfe88b016a6a918e88fc685d52480307ebedbbf4fb45b37221165bcccaa35375b49cbc18c99ebfc420f7430837b6eaa7780 SHA512 18f46175aaff2d4b1ee4de133c05180b4e888e0a7d841d88fdbf6e52f2a195371b63c6c6c7868c0c4ab5406feaae40beb460701432f37bf6efa0f7b706851f82
+DIST edk2-202605-1-qemu-riscv64.xpak 1864003 BLAKE2B 458876ccc9efb0259b2f9aced9eeb8aace5a3cd76dac45d724060a06a949d73bde84fd216ebee4345fe6e39edbec96e51e4ac3c37c955ba2725c1991bb17f2a4 SHA512 c665001d0d7e8ec5ac8fb0018905322f74ca192fcbda8d1223e206dd1e01d7e1f78399afba22db37dd46fe8f4798d13deb467d97388d8f969bfa7d24626ac165
+DIST edk2-202605-1-qemu-x86_64.xpak 9018459 BLAKE2B f79e65496247c5b1b2506440b0773800d13392edb8cf1a940a49b39a577eb90cea41f84d6dbb4a70bf240633a87326699c4a9620cd597f450646477cc8983f25 SHA512 19e1d1cbfd66830787c77a3c434907348fcb070c0f423e4d53817f3b18d958e009d7d249b916fe615ecbaef650c3cdc59269168e727deb4025ef32c38489d277
 DIST edk2-ovmf-202202-1.xpak 2672386 BLAKE2B 75c15d4379610ab2af85b78166e350d52f4f1bc1fff5b2eb693ad0d7b1f6648e65d8ae3e2c5467f93f1557ad3b4fa664ab2d76ff10794667de22c2ea8cca6b2d SHA512 06783b89c96bada0fd025ff39eaee501a027abcb03c0bdcf3ff497d52be22927ab03013d90f145ee94a8662cfffe4f8c154dcd06db1bb1acef8a85ae43de14a3
diff --git a/sys-firmware/edk2-bin/edk2-bin-202605.ebuild b/sys-firmware/edk2-bin/edk2-bin-202605.ebuild
new file mode 100644
index 000000000000..bf887f6d1b15
--- /dev/null
+++ b/sys-firmware/edk2-bin/edk2-bin-202605.ebuild
@@ -0,0 +1,75 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1 secureboot
+
+BINPKG="${P/-bin/}-1"
+QEMU_TARGETS="aarch64 loongarch64 riscv64 x86_64"
+
+DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
+HOMEPAGE="https://github.com/tianocore/edk2"
+for a in ${QEMU_TARGETS}; do
+	SRC_URI+=" qemu_softmmu_targets_${a}? ( https://dev.gentoo.org/~chewi/distfiles/${BINPKG}-qemu-${a}.xpak )"
+done
+S="${WORKDIR}"
+LICENSE="BSD-2-with-patent MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+printf -v IUSE ' qemu_softmmu_targets_%s' ${QEMU_TARGETS}
+REQUIRED_USE="|| ( ${IUSE} )"
+
+RDEPEND="!sys-firmware/edk2"
+
+DOC_CONTENTS="This package includes the TianoCore EDK II UEFI firmware for virtual \
+machines of these QEMU architectures: ${QEMU_TARGETS}. See each architecture's README \
+for usage details."
+
+src_unpack() {
+	local a
+	for a in ${QEMU_TARGETS}; do
+		use "qemu_softmmu_targets_${a}" || continue
+		mkdir "${a}" || die
+		tar -C "${a}" -xf - < <(xz -c -d --single-stream "${DISTDIR}/${BINPKG}-qemu-${a}.xpak") ||
+			die "unpacking ${a} QEMU binpkg failed"
+	done
+}
+
+src_prepare() {
+	bunzip2 */usr/share/doc/*/README.gentoo.bz2 || die
+	default
+}
+
+src_install() {
+	insinto /usr/share
+	doins -r */usr/share/{edk2,qemu}/
+
+	# Compatibility with older package versions.
+	use qemu_softmmu_targets_x86_64 && dosym edk2/OvmfX64 /usr/share/edk2-ovmf
+
+	secureboot_auto_sign --in-place
+	readme.gentoo_create_doc
+
+	local a
+	for a in ${QEMU_TARGETS}; do
+		use "qemu_softmmu_targets_${a}" || continue
+		newdoc "${a}"/usr/share/doc/*/README.gentoo README-"${a}".gentoo
+	done
+}
+
+pkg_preinst() {
+	local OLD=${EROOT}/usr/share/edk2-ovmf NEW=${EROOT}/usr/share/edk2/OvmfX64
+	if use qemu_softmmu_targets_x86_64 && [[ -d ${OLD} && ! -L ${OLD} ]]; then
+		{
+			rm -vf "${OLD}"/{OVMF_{CODE,CODE.secboot,VARS}.fd,EnrollDefaultKeys.efi,Shell.efi,UefiShell.img} &&
+			mkdir -p "${NEW}" &&
+			find "${OLD}" -mindepth 1 -maxdepth 1 -execdir mv --update=none-fail -vt "${NEW}"/ {} + &&
+			rmdir "${OLD}"
+		} || die "unable to replace old directory with compatibility symlink"
+	fi
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/sys-firmware/edk2/Manifest b/sys-firmware/edk2/Manifest
index df45726be667..cb2200571dc4 100644
--- a/sys-firmware/edk2/Manifest
+++ b/sys-firmware/edk2/Manifest
@@ -1,17 +1,23 @@
 DIST amd64_DBXUpdate_v1.6.3.bin 24053 BLAKE2B 4796ce3218df9c29d88fe5a14975e0b7ac2dc1271dd89ba1e6b7c1f898d196deab698bf93e527aa4c5802a0a4092556c4480220baa349cd98ddf8b500767225a SHA512 0452d2c302f702eeb2d549fd5ac4b3c3623172de9559a881bc92875590f3c5b65e301b880f5f76786e22b1af145b2aa6e58c74fef00a279950f3d6641aef484e
+DIST amd64_DBXUpdate_v1.6.4.bin 24053 BLAKE2B 4796ce3218df9c29d88fe5a14975e0b7ac2dc1271dd89ba1e6b7c1f898d196deab698bf93e527aa4c5802a0a4092556c4480220baa349cd98ddf8b500767225a SHA512 0452d2c302f702eeb2d549fd5ac4b3c3623172de9559a881bc92875590f3c5b65e301b880f5f76786e22b1af145b2aa6e58c74fef00a279950f3d6641aef484e
 DIST arm64_DBXUpdate_05092023.bin 4610 BLAKE2B 4c6628e5c297a26ca5a1235e377a794fdc18f8201dc7bcb134eb5dd164cc16497ff8d7e598509a61dadf3aa6e8525c9c9e4ca597af62a1c93f97945594517303 SHA512 5a2816e3ff73fef1d258c1418a09b264291408493147399da6b71b6a20bd6b347c00153e22589b2635172cdc57de404ff423be41a6c382a9b25ee9a76922f397
 DIST arm64_DBXUpdate_v1.6.3.bin 4613 BLAKE2B 1a60e4e54416886111451e51bf9bdcc08f5da696050cc47cf941b1e040f7e872b1cf05e653366e31395e68bcafc689b30419e7c6133821434251341edf6f3d3c SHA512 2af6d22d139ff58cb2d0dc0883257b6131f1bd9cc04b4c062c21f1d0560508f8f4ea062e6946fd37c8ab47259772884e29c32a93844d5d6beadcf9e778e4ee51
+DIST arm64_DBXUpdate_v1.6.4.bin 4613 BLAKE2B 1a60e4e54416886111451e51bf9bdcc08f5da696050cc47cf941b1e040f7e872b1cf05e653366e31395e68bcafc689b30419e7c6133821434251341edf6f3d3c SHA512 2af6d22d139ff58cb2d0dc0883257b6131f1bd9cc04b4c062c21f1d0560508f8f4ea062e6946fd37c8ab47259772884e29c32a93844d5d6beadcf9e778e4ee51
 DIST brotli-e230f474b87134e8c6c85b630084c612057f253e.tar.gz 646535 BLAKE2B cac5c68aa0c0ed1b47a1d97c86edc444ab21cdf66e51b66b5ce9f39af67640d3e0ac076c7b3e23be0a7c2c7e3436ea25e9972a2c577d0822a578e1720cd109e4 SHA512 007068eae049e80f91ffac3be12159f7278ce2237f969055dc1bc07b87e44eaa4f5dab70940710bf2e673134cb9ad9c0fd3f46c9f93d16905fb4ddc3e0f88c3e
 DIST brotli-f4153a09f87cbb9c826d8fc12c74642bb2d879ea.tar.gz 512229 BLAKE2B cd86cc2cc7eefad24f87cda8006409bf764922b5f23ccfb951e7a41214b12004ce532b11f94f5fb858b3bf71f9abf8ef17ba219fa96bd5be23b51873afad0fd5 SHA512 7f48e794e738b31c2005e7cef6d8c0cc0d543f1cd8c137ae8ba14602cac2873de6299a3f32ad52be869f513e7548341353ed049609daef1063975694d9a9b80b
 DIST edk2-202411.tar.gz 17669304 BLAKE2B 2aa1d5c5d7b99a1abccf0c8b0b04a74006319a269ec03814ab9a28d38299f7d00f57d457c4e011067ad8dfc816430372ab02130ec138b148999662764a411483 SHA512 633483a1ff915f6e5f5a6d3c329f517d6c070368855f1d5348a80e22e71ac13ff4c6774c8620482a4e5cefe03907edc3a904ae405cbfe2dcd025ddd82f039eaf
 DIST edk2-202502.tar.gz 18217115 BLAKE2B a72fd05398b32377f6a0b80fa2c3c84ed4f53039174f8e814dc6c57617d21a3c99603d5c572a372295399658a42e3ff1ab642f8cbaa8782301268344443f6502 SHA512 1421b3e14acf6aa51c84cf0a12716990f08815fff631f4657bb9907fd8d620e9fac7794e05c2eed54d5f8966f8e9267d32bf2256237a959bd727629163b8c00d
 DIST edk2-202511.tar.gz 18471528 BLAKE2B c3d484061c1360bb2f3f08114875699ecc1cb03c90949c6cbfa140865c83fef5dabe3df4e37d12a8d71f2484c18ae0fbae6c28b56c0404ce6fa8112b5961ef8d SHA512 0a9d70b9fa72457eac0937cbca1f02ed101ffc50dd67be6ca0f4d290b0ade32d9000637060242a5980890e29818186c7bc77b8ff940541759089519302ab1c20
+DIST edk2-202605.tar.gz 19124502 BLAKE2B b0c4a295da31d9f6a363549620a784ec9ac45100355c5382101d083bf51eb433538f36c05d510b4cfa6ab0ff4cf0e68c80a57e278f3fedab399e272dd13cae75 SHA512 8efa22812e5cee78f2934a68bf6515528885c9133d1b1b138193eefa664e77232ee6af6219538db6e5f82bc81f6b2d7ca53be82657ed4ea415fb17676d250746
+DIST libspdm-1be116c7b7713fa9003e1bd53b53a34758549eb9.tar.gz 2050057 BLAKE2B a792993811fd9781342164e6619659d70c8bbe5d82a2938ca75532bdfd4948925fd9c773b23117b3f31c051b5dc1870c59d984c1f3e9f12fdbdbf2028dae6dde SHA512 860a8b39df7db8a82134dd28e71507e4a7da411c410b419470abc89e898d6be2ffd9326dd7c43fd801de9c7028a2920863a76e616582e4f73fa5048463c3f763
 DIST libspdm-50924a4c8145fc721e17208f55814d2b38766fe6.tar.gz 1967479 BLAKE2B fe15ac34fa65a86b13ed3a44959d860dc1bf39fd9a4bd2dcde2d2ec6ad9490f5d7d53320c481f9cf931a636527719c29eb315d178f2bd48cb905216849b633b4 SHA512 f11e748e40b66c37365175ff0ef9c0a695db2e7da50da2cf8a33267064b53e5938cfb1363d27e5ce0a174b2059533352bb8a44c48003db900c6b844167473198
 DIST libspdm-98ef964e1e9a0c39c7efb67143d3a13a819432e0.tar.gz 2017163 BLAKE2B 312528eb0af2cffb4d3557354ada87302b471a4c1cc73bad74a60162cdbb057be392fd57f18bef99a437ccb879583c69afb2596bf120656787b4b6530005316d SHA512 366155f146f47f7fe81c2b7863c3dff6339dd017b3d8ebe2e843ee04fedb6911193248cea2d048547a4389b4727c1576d5b6c1f26bbe83362299b52d72527f52
+DIST mbedtls-0bebf8b8c7f07abe3571ded48a11aa907a1ffb20.tar.gz 5720744 BLAKE2B 5b434cd922ca16f4a7afae155c5ce8db1e18607e719db9f9a25b60dd2557e93b5596f32eaa201e4706bc25b2dd5e575067687094d5e0cecb54f1f18c7091f4b0 SHA512 9e25ca4e3fd497c41821aa904219c5a49bc7a6b765be6aa4b19626fb70ee75ba60bb4e02806a7a840c8c3f5954631fa6b6aeeff0592647083795ad02971fe73e
 DIST mbedtls-8c89224991adff88d53cd380f42a2baa36f91454.tar.gz 4587796 BLAKE2B c28df5c52ac3ed5ef6a2b9eba29f3894d3f5f11083869e8b137cd66d4f72b2a0971c91636ce4626869bd06eeb5e661d90160021f92564b9449fb13001b8e379f SHA512 a421c03c740867210f9e30457bc951928cafec3622e1e304f8c18ce5c5e27c5c8e6c7715180ecb74c6a997e4b91ee160e52b357e1bb65ff76ce8414a87ec4889
 DIST mipi-sys-t-370b5944c046bab043dd8b133727b2135af7747a.tar.gz 378522 BLAKE2B d3f1033e78ad814ebb991e66d8c1437aa3583e91481af9785b97b6021c7c45fb9dcb8d2d58d0a0fe84fbd9f108d24a27234df298eb8a2ba2340e5c9c85c89c40 SHA512 de6888577ceab7ab6915d792f3c48248cfa53357ccd310fc7f7eae4d25a932de8c7c23e5b898c9ebf61cf86cb538277273f2eb131a628b3bf0d46c9a3b9b6686
 DIST openssl-3.0.15.tar.gz 15318633 BLAKE2B f2900d0894b97e86c709079ca4336d5dc508d69e91d3a4de4420c8d9344cb54dada6ea2cdd408166e53db0c652b06654e670701166b67a0a40578676e1cea535 SHA512 acd80f2f7924d90c1416946a5c61eff461926ad60f4821bb6b08845ea18f8452fd5e88a2c2c5bd0d7590a792cb8341a3f3be042fd0a5b6c9c1b84a497c347bbf
 DIST openssl-3.4.1.tar.gz 18346056 BLAKE2B 328a2a4f0536b15ffe6421afc99bdb5dcdf3d29f44437fdd80bbf4089f5f2658ca10907e033eda2e04c6b862e49b150ea59d8ab1807d14a3dcf64e10c32e78af SHA512 1de6307c587686711f05d1e96731c43526fa3af51e4cd94c06c880954b67f6eb4c7db3177f0ea5937d41bc1f8cadcf5bce75025b5c1a46a469376960f1001c5f
 DIST openssl-3.5.1.tar.gz 53158817 BLAKE2B 172db56ac41cee78bcb5d2223c33d78baf3326d8d466115f39be414384d265ad4541e00096d3f53435f9f89119882ae587b20b1ac05dc2ace46a0d43d7cc6996 SHA512 0fa152ae59ab5ea066319de039dfb1d24cbb247172d7512feb5dd920db3740f219d76b0195ea562f84fe5eae36c23772302eddfbb3509df13761452b4dafb9d3
+DIST openssl-3.5.7.tar.gz 53153930 BLAKE2B e19d7e40e9aaed0e4b4a405866ac56f37a03dc5c57cf1a2452ca547a5a9cab7771254d6ab8ce7df36b20d8145ba435aa5158c80be97d3887b3ef51db3cdd7428 SHA512 de5351d2d532e1a3908a738f7d8aae448d32bc60bdb24808c556a24bc37a3f53daedf12b5d432eeb8c235e16939d842f908332ede8a447ca103ad1c493c820d7
 DIST pylibfdt-cfff805481bdea27f900c32698171286542b8d3c.tar.gz 49659 BLAKE2B 05e954fc2d72618b3f56c08bdfcd64479259902ee2613d034b66ebe50e33b02b243bed1191d8dcdcea9fcb2553f84a737ae12514d30c48e776efc858a4879894 SHA512 c2f4cbda24bc4a2140135de2db19fd7ad0b6eff2a748862b4166bf0e65f3e324e2855ea4331dafa2c82f44b4d01309c8ac50159cbcc076a968a1169c8709a523
 DIST x64_DBXUpdate_05092023.bin 21170 BLAKE2B 9b74945ef441e65c50116122bc24578c22c8f5f7af94e46322a96bd15035b79c0af4c1fd5366017b347b9aaf3f5791b9d6ea84ef141500700ccf69f708f91389 SHA512 71fb6e8cd6918126b3acd78b95651913336df372e13fdfdfdd20d5d23f0e509050c6c88c8a2c43f8ac44f987df86bd45174bb3065d5a7a8c7e3b8772fd06d624
diff --git a/sys-firmware/edk2/edk2-202605.ebuild b/sys-firmware/edk2/edk2-202605.ebuild
new file mode 100644
index 000000000000..baeb98a3e533
--- /dev/null
+++ b/sys-firmware/edk2/edk2-202605.ebuild
@@ -0,0 +1,381 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_REQ_USE="sqlite"
+PYTHON_COMPAT=( python3_{13..14} )
+
+inherit edo prefix python-any-r1 readme.gentoo-r1 secureboot toolchain-funcs
+
+DESCRIPTION="TianoCore EDK II UEFI firmware for virtual machines"
+HOMEPAGE="https://github.com/tianocore/edk2"
+
+BUNDLED_BROTLI_SUBMODULE_SHA="e230f474b87134e8c6c85b630084c612057f253e"
+BUNDLED_LIBFDT_SUBMODULE_SHA="cfff805481bdea27f900c32698171286542b8d3c"
+BUNDLED_LIBSPDM_SUBMODULE_SHA="1be116c7b7713fa9003e1bd53b53a34758549eb9"
+BUNDLED_MBEDTLS_SUBMODULE_SHA="0bebf8b8c7f07abe3571ded48a11aa907a1ffb20"
+BUNDLED_MIPI_SYS_T_SUBMODULE_SHA="370b5944c046bab043dd8b133727b2135af7747a"
+BUNDLED_OPENSSL_SUBMODULE_P="openssl-3.5.7"
+
+SBO_VER="1.6.4" # https://github.com/microsoft/secureboot_objects/releases
+DBX_URI="https://github.com/microsoft/secureboot_objects/raw/refs/tags/v${SBO_VER}/PostSignedObjects/DBX/@ARCH@/DBXUpdate.bin -> @ARCH@_DBXUpdate_v${SBO_VER}.bin"
+
+SRC_URI="
+	https://github.com/tianocore/${PN}/archive/${PN}-stable${PV}.tar.gz
+		-> ${P}.tar.gz
+	https://github.com/google/brotli/archive/${BUNDLED_BROTLI_SUBMODULE_SHA}.tar.gz
+		-> brotli-${BUNDLED_BROTLI_SUBMODULE_SHA}.tar.gz
+	https://github.com/DMTF/libspdm/archive/${BUNDLED_LIBSPDM_SUBMODULE_SHA}.tar.gz
+		-> libspdm-${BUNDLED_LIBSPDM_SUBMODULE_SHA}.tar.gz
+	https://github.com/Mbed-TLS/mbedtls/archive/${BUNDLED_MBEDTLS_SUBMODULE_SHA}.tar.gz
+		-> mbedtls-${BUNDLED_MBEDTLS_SUBMODULE_SHA}.tar.gz
+	https://github.com/MIPI-Alliance/public-mipi-sys-t/archive/${BUNDLED_MIPI_SYS_T_SUBMODULE_SHA}.tar.gz
+		-> mipi-sys-t-${BUNDLED_MIPI_SYS_T_SUBMODULE_SHA}.tar.gz
+	https://github.com/openssl/openssl/releases/download/${BUNDLED_OPENSSL_SUBMODULE_P}/${BUNDLED_OPENSSL_SUBMODULE_P}.tar.gz
+
+	amd64? ( ${DBX_URI//@ARCH@/amd64} )
+	arm64? ( ${DBX_URI//@ARCH@/arm64} )
+
+	!amd64? (
+		https://github.com/devicetree-org/pylibfdt/archive/${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz
+			-> pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz
+	)
+"
+
+S="${WORKDIR}/${PN}-${PN}-stable${PV}"
+LICENSE="BSD-2-with-patent MIT"
+SLOT="0"
+KEYWORDS="-* ~amd64 ~arm64 ~loong ~riscv"
+
+BDEPEND="
+	${PYTHON_DEPS}
+	app-emulation/qemu
+	app-emulation/virt-firmware
+	>=sys-power/iasl-20160729
+	amd64? ( >=dev-lang/nasm-2.0.7 )
+"
+
+RDEPEND="
+	!sys-firmware/edk2-bin
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-202605-werror.patch"
+	"${FILESDIR}/${PN}-202505-UninstallMemAttrProtocol.patch"
+)
+
+DISABLE_AUTOFORMATTING="true"
+DIR="/usr/share/${PN}"
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+	secureboot_pkg_setup
+
+	local QEMU_ARCH ARCH_DIRS UNIT0 UNIT1 FMT
+
+	case "${ARCH}" in
+	amd64)
+		TARGET_ARCH="X64"
+		QEMU_ARCH="x86_64"
+		ARCH_DIRS="${DIR}/OvmfX64"
+		UNIT0="OVMF_CODE.fd"
+		UNIT1="OVMF_VARS.fd"
+		FMT="raw"
+		;;
+	arm64)
+		TARGET_ARCH="AARCH64"
+		QEMU_ARCH="aarch64"
+		ARCH_DIRS="${DIR}/ArmVirtQemu-AARCH64"
+		UNIT0="QEMU_EFI.qcow2"
+		UNIT1="QEMU_VARS.qcow2"
+		FMT="qcow2"
+		;;
+	loong)
+		TARGET_ARCH="LOONGARCH64"
+		QEMU_ARCH="loongarch64"
+		ARCH_DIRS="${DIR}/LoongArchVirtQemu"
+		UNIT0="QEMU_EFI.qcow2"
+		UNIT1="QEMU_VARS.qcow2"
+		FMT="qcow2"
+		;;
+	riscv)
+		TARGET_ARCH="RISCV64"
+		QEMU_ARCH="riscv64"
+		ARCH_DIRS="${DIR}/RiscVVirtQemu"
+		UNIT0="RISCV_VIRT_CODE.qcow2"
+		UNIT1="RISCV_VIRT_VARS.qcow2"
+		FMT="qcow2"
+		;;
+	esac
+
+	DOC_CONTENTS="This package includes the TianoCore EDK II UEFI firmware for ${QEMU_ARCH}
+virtual machines. The firmware is located under ${ARCH_DIRS}.
+
+In order to use the firmware, you can run QEMU like so:
+
+	$ qemu-system-${QEMU_ARCH} \\
+		-drive file=${EPREFIX}${ARCH_DIRS%% *}/${UNIT0},if=pflash,format=${FMT},unit=0,readonly=on \\
+		-drive file=/path/to/the/copy/of/${UNIT1},if=pflash,format=${FMT},unit=1 \\
+		..."
+
+	case "${ARCH}" in
+	amd64) DOC_CONTENTS+="
+
+The firmware does not support CSM due to the lack of a free
+implementation. If you need a firmware with CSM support, you have to
+download one for yourself. Firmware blobs are commonly labelled:
+
+	OVMF_CODE-with-csm.fd
+	OVMF_VARS-with-csm.fd"
+		;;
+	arm64) DOC_CONTENTS+="
+
+WARNING! QEMU_EFI.secboot_INSECURE.qcow2 does have Secure Boot
+enabled, but it must not be used in production. The lack of an SMM
+implementation for arm64 in this firmware means that the EFI
+variable store is unprotected, making the firmware unsafe."
+		;;
+	esac
+}
+
+link_mod() {
+	rmdir "$2" && ln -sfT "$1" "$2" || die "linking ${2##*/} failed"
+}
+
+src_prepare() {
+	# Bundled submodules
+	link_mod "${WORKDIR}/brotli-${BUNDLED_BROTLI_SUBMODULE_SHA}" \
+		BaseTools/Source/C/BrotliCompress/brotli
+	link_mod "${WORKDIR}/brotli-${BUNDLED_BROTLI_SUBMODULE_SHA}" \
+		MdeModulePkg/Library/BrotliCustomDecompressLib/brotli
+	link_mod "${WORKDIR}/libspdm-${BUNDLED_LIBSPDM_SUBMODULE_SHA}" \
+		SecurityPkg/DeviceSecurity/SpdmLib/libspdm
+	link_mod "${WORKDIR}/mbedtls-${BUNDLED_MBEDTLS_SUBMODULE_SHA}" \
+		CryptoPkg/Library/MbedTlsLib/mbedtls
+	link_mod "${WORKDIR}/public-mipi-sys-t-${BUNDLED_MIPI_SYS_T_SUBMODULE_SHA}" \
+		MdePkg/Library/MipiSysTLib/mipisyst
+	link_mod "${WORKDIR}/${BUNDLED_OPENSSL_SUBMODULE_P}" \
+		CryptoPkg/Library/OpensslLib/openssl
+
+	[[ -e ${DISTDIR}/pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}.tar.gz ]] &&
+		link_mod "${WORKDIR}/pylibfdt-${BUNDLED_LIBFDT_SUBMODULE_SHA}" \
+			MdePkg/Library/BaseFdtLib/libfdt
+
+	default
+
+	# Fix descriptor paths for prefix.
+	hprefixify "${FILESDIR}"/descriptors/*.json
+}
+
+my_build() {
+	edo build \
+		-t "${TOOLCHAIN}" \
+		-b "${BUILD_TARGET}" \
+		-a "${TARGET_ARCH}" \
+		-D NETWORK_HTTP_BOOT_ENABLE \
+		-D NETWORK_IP6_ENABLE \
+		-D NETWORK_TLS_ENABLE \
+		-D TPM1_ENABLE \
+		-D TPM2_ENABLE \
+		-D TPM2_CONFIG_ENABLE \
+		"${BUILD_ARGS[@]}" \
+		"${@}"
+}
+
+sb_build() {
+	# DO NOT enable the shell with Secure Boot as it can be used as a bypass!
+	my_build \
+		-D BUILD_SHELL=FALSE \
+		-D SECURE_BOOT_ENABLE \
+		--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD5 \
+		--pcd PcdImageProtectionPolicy=0x03 \
+		--pcd PcdNullPointerDetectionPropertyMask=0x03 \
+		--pcd PcdSetNxForStack=TRUE \
+		--pcd PcdUninstallMemAttrProtocol=FALSE \
+		"${@}"
+}
+
+# Add the MS and Red Hat Secure Boot certificates and update the revocation list
+# in the given raw variable images.
+mk_fw_vars_raw() {
+	local input args=() dbx="${DISTDIR}/${ARCH}_DBXUpdate_v${SBO_VER}.bin"
+	[[ -e ${dbx} ]] && args+=( --set-dbx "${dbx}" )
+
+	for input; do
+		edo virt-fw-vars --secure-boot --enroll-redhat "${args[@]}" \
+			--inplace "${input}"
+	done
+}
+
+# Write the MS and Red Hat Secure Boot certificates and the revocation list to a
+# JSON file for QEMU.
+mk_fw_vars_json() {
+	local args=() dbx="${DISTDIR}/${ARCH}_DBXUpdate_v${SBO_VER}.bin"
+	[[ -e ${dbx} ]] && args+=( --set-dbx "${dbx}" )
+
+	edo virt-fw-vars --secure-boot --enroll-redhat "${args[@]}" \
+		--output-json "${S}/${ARCH}.qemuvars.json"
+}
+
+# Convert the given images from raw to QCOW2 and resize them to the amount given
+# as the first argument. Specify 0 to not resize.
+raw_to_qcow2() {
+	local SIZE=$1 RAW
+	shift
+
+	for RAW in "${@}"; do
+		edo qemu-img convert -f raw -O qcow2 -o cluster_size=4096 -S 4096 "${RAW}" "${RAW%.fd}.qcow2"
+		[[ ${SIZE} != 0 ]] && edo qemu-img resize -f qcow2 "${RAW%.fd}.qcow2" "${SIZE}"
+		rm "${RAW}" || die
+	done
+}
+
+src_compile() {
+	TOOLCHAIN="GCC"
+	BUILD_TARGET="RELEASE"
+	BUILD_DIR="${BUILD_TARGET}_${TOOLCHAIN}"
+	BUILD_ARGS=()
+
+	tc-export_build_env
+	emake -C BaseTools \
+		CC="$(tc-getBUILD_CC)" \
+		CXX="$(tc-getBUILD_CXX)" \
+		EXTRA_OPTFLAGS="${BUILD_CFLAGS}" \
+		EXTRA_LDFLAGS="${BUILD_LDFLAGS}"
+
+	export \
+		"${TOOLCHAIN}_${TARGET_ARCH}_PREFIX=${CHOST}-" \
+		"${TOOLCHAIN}_BIN=${CHOST}-"
+
+	. ./edksetup.sh
+
+	case "${ARCH}" in
+	amd64)
+		local SIZE
+		for SIZE in _2M _4M; do
+			sb_build -p OvmfPkg/OvmfPkgX64.dsc \
+				-D FD_SIZE${SIZE}B \
+				-D SMM_REQUIRE
+
+			mv -T Build/OvmfX64{,${SIZE}.secboot} || die
+
+			# shim.efi has broken MemAttr code
+			my_build -p OvmfPkg/OvmfPkgX64.dsc \
+				-D FD_SIZE${SIZE}B \
+				--pcd PcdDxeNxMemoryProtectionPolicy=0 \
+				--pcd PcdUninstallMemAttrProtocol=TRUE
+
+			mv -T Build/OvmfX64{,${SIZE}} || die
+
+			mk_fw_vars_raw Build/OvmfX64${SIZE}.secboot/"${BUILD_DIR}"/FV/OVMF_VARS.fd
+		done
+
+		sb_build -p OvmfPkg/OvmfPkgX64.dsc \
+			-D FD_SIZE_4MB \
+			-D QEMU_PV_VARS
+
+		mv -T Build/OvmfX64{,.qemuvars} || die
+
+		# Fedora only converts newer images to QCOW2. 2MB images are raw.
+		raw_to_qcow2 0 Build/OvmfX64_4M*/"${BUILD_DIR}"/FV/OVMF_{CODE,VARS}.fd
+		mk_fw_vars_json
+		;;
+	arm64)
+		sb_build -p ArmVirtPkg/ArmVirtQemu.dsc
+		mv -T Build/ArmVirtQemu-AArch64{,.secboot_INSECURE} || die
+
+		sb_build -p ArmVirtPkg/ArmVirtQemu.dsc \
+			-D QEMU_PV_VARS
+
+		mv -T Build/ArmVirtQemu-AArch64{,.qemuvars} || die
+
+		# shim.efi has broken MemAttr code
+		my_build -p ArmVirtPkg/ArmVirtQemu.dsc \
+			--pcd PcdDxeNxMemoryProtectionPolicy=0xC000000000007FD1 \
+			--pcd PcdUninstallMemAttrProtocol=TRUE
+
+		mk_fw_vars_raw Build/ArmVirtQemu-AArch64.secboot_INSECURE/"${BUILD_DIR}"/FV/QEMU_VARS.fd
+		raw_to_qcow2 64m Build/ArmVirtQemu-AArch64{,.secboot_INSECURE}/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.fd
+		mk_fw_vars_json
+		;;
+	loong)
+		my_build -p OvmfPkg/LoongArchVirt/LoongArchVirtQemu.dsc
+		raw_to_qcow2 0 Build/LoongArchVirtQemu/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.fd
+		;;
+	riscv)
+		my_build -p OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc
+		raw_to_qcow2 32m Build/RiscVVirtQemu/"${BUILD_DIR}"/FV/RISCV_VIRT_{CODE,VARS}.fd
+		;;
+	esac
+
+	# The standalone shell is safe so always build it.
+	my_build -p ShellPkg/ShellPkg.dsc
+}
+
+src_install() {
+	local SIZE TYPE FMT
+
+	case "${ARCH}" in
+	amd64)
+		insinto ${DIR}/OvmfX64
+
+		for SIZE in _2M _4M; do
+			for TYPE in "" .secboot; do
+				[[ ${SIZE} = _4M ]] && FMT=qcow2 || FMT=fd
+				newins Build/OvmfX64${SIZE}${TYPE}/"${BUILD_DIR}"/FV/OVMF_CODE.${FMT} OVMF_CODE${SIZE#_2M}${TYPE}.${FMT}
+				newins Build/OvmfX64${SIZE}${TYPE}/"${BUILD_DIR}"/FV/OVMF_VARS.${FMT} OVMF_VARS${SIZE#_2M}${TYPE}.${FMT}
+			done
+		done
+
+		newins Build/OvmfX64.qemuvars/"${BUILD_DIR}"/FV/OVMF_CODE.fd OVMF_CODE.qemuvars.fd
+		newins amd64.qemuvars.json OVMF_VARS.qemuvars.json
+
+		# Compatibility with older package versions.
+		dosym ${PN}/OvmfX64 /usr/share/edk2-ovmf
+		;;
+	arm64)
+		insinto ${DIR}/ArmVirtQemu-AARCH64
+
+		for TYPE in "" .secboot_INSECURE; do
+			newins Build/ArmVirtQemu-AArch64${TYPE}/"${BUILD_DIR}"/FV/QEMU_EFI.qcow2 QEMU_EFI${TYPE}.qcow2
+			newins Build/ArmVirtQemu-AArch64${TYPE}/"${BUILD_DIR}"/FV/QEMU_VARS.qcow2 QEMU_VARS${TYPE}.qcow2
+		done
+
+		newins Build/ArmVirtQemu-AArch64.qemuvars/"${BUILD_DIR}"/FV/QEMU_EFI.fd QEMU_EFI.qemuvars.fd
+		newins arm64.qemuvars.json QEMU_VARS.qemuvars.json
+		;;
+	loong)
+		insinto ${DIR}/LoongArchVirtQemu
+		doins Build/LoongArchVirtQemu/"${BUILD_DIR}"/FV/QEMU_{EFI,VARS}.qcow2
+		;;
+	riscv)
+		insinto ${DIR}/RiscVVirtQemu
+		doins Build/RiscVVirtQemu/"${BUILD_DIR}"/FV/RISCV_VIRT_{CODE,VARS}.qcow2
+		;;
+	esac
+
+	newins Build/Shell/"${BUILD_DIR}/${TARGET_ARCH}"/Shell_EA4BB293-2D7F-4456-A681-1F22F42CD0BC.efi Shell.efi
+
+	insinto /usr/share/qemu/firmware
+	doins "${FILESDIR}"/descriptors/*"${TARGET_ARCH,,}"*.json
+
+	secureboot_auto_sign --in-place
+	readme.gentoo_create_doc
+}
+
+pkg_preinst() {
+	local OLD=${EROOT}/usr/share/edk2-ovmf NEW=${EROOT}/${DIR}/OvmfX64
+	if [[ -d ${OLD} && ! -L ${OLD} ]]; then
+		{
+			rm -vf "${OLD}"/{OVMF_{CODE,CODE.secboot,VARS}.fd,EnrollDefaultKeys.efi,Shell.efi,UefiShell.img} &&
+			mkdir -p "${NEW}" &&
+			find "${OLD}" -mindepth 1 -maxdepth 1 -execdir mv --update=none-fail -vt "${NEW}"/ {} + &&
+			rmdir "${OLD}"
+		} || die "unable to replace old directory with compatibility symlink"
+	fi
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/sys-firmware/edk2/files/edk2-202605-werror.patch b/sys-firmware/edk2/files/edk2-202605-werror.patch
new file mode 100644
index 000000000000..23a432588880
--- /dev/null
+++ b/sys-firmware/edk2/files/edk2-202605-werror.patch
@@ -0,0 +1,46 @@
+--- a/BaseTools/Conf/tools_def.template
++++ b/BaseTools/Conf/tools_def.template
+@@ -932,9 +932,9 @@ NOOPT_*_*_OBJCOPY_ADDDEBUGFLAG     = --add-gnu-debuglink="$(DEBUG_DIR)/$(MODULE_
+ *_*_*_DTC_PATH                     = DEF(DTC_BIN)

+ 

+ # All supported GCC archs except LOONGARCH64 support -mstack-protector-guard=global, so set that on everything except LOONGARCH64

+-DEFINE GCC_ALL_CC_COMMON               = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -include AutoGen.h -fno-common -fstack-protector

++DEFINE GCC_ALL_CC_COMMON               = -g -Os -fshort-wchar -fno-builtin -fno-strict-aliasing -Wall -Wno-array-bounds -include AutoGen.h -fno-common -fstack-protector

+ DEFINE GCC_IA32_X64_CC_FLAGS           = -mstack-protector-guard=global

+-DEFINE GCC_LOONGARCH64_CC_FLAGS        = DEF(GCC_ALL_CC_COMMON) -mabi=lp64d -fno-asynchronous-unwind-tables -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections -march=loongarch64 -mno-memcpy -Werror -Wno-maybe-uninitialized -Wno-stringop-overflow -Wno-pointer-to-int-cast -no-pie -fno-stack-protector -mno-explicit-relocs -mno-relax

++DEFINE GCC_LOONGARCH64_CC_FLAGS        = DEF(GCC_ALL_CC_COMMON) -mabi=lp64d -fno-asynchronous-unwind-tables -Wno-address -fno-short-enums -fsigned-char -ffunction-sections -fdata-sections -march=loongarch64 -mno-memcpy -Wno-maybe-uninitialized -Wno-stringop-overflow -Wno-pointer-to-int-cast -no-pie -fno-stack-protector -mno-explicit-relocs -mno-relax

+ DEFINE GCC_AARCH64_CC_COMMON           = DEF(GCC_ALL_CC_COMMON) -mlittle-endian -fno-short-enums -fverbose-asm -funsigned-char  -ffunction-sections -fdata-sections -Wno-address -fno-asynchronous-unwind-tables -fno-unwind-tables -fno-pic -fno-pie -ffixed-x18 -mstack-protector-guard=global

+ DEFINE GCC_AARCH64_CC_XIPCOMMON        = -mstrict-align -mgeneral-regs-only

+ DEFINE GCC_RISCV64_CC_XIPFLAGS         = -mstrict-align -mgeneral-regs-only

+@@ -996,7 +996,7 @@ DEFINE GCC_AARCH64_DLINK2_FLAGS      = DEF(GCCNOLTO_AARCH64_DLINK2_FLAGS) -Wno-e
+ DEFINE GCC_AARCH64_ASLDLINK_FLAGS    = DEF(GCCNOLTO_AARCH64_ASLDLINK_FLAGS) DEF(GCC_DLINK_WARNING_FLAGS)

+ DEFINE GCC_ASLCC_FLAGS               = DEF(GCCNOLTO_ASLCC_FLAGS) -fno-lto

+ 

+-DEFINE GCC_RISCV_ALL_CC_FLAGS                    = -g -fshort-wchar -fno-omit-frame-pointer -fno-strict-aliasing -Wall -Werror -Wno-array-bounds -ffunction-sections -fdata-sections -include AutoGen.h -fno-common -DSTRING_ARRAY_NAME=$(BASE_NAME)Strings -msmall-data-limit=0

++DEFINE GCC_RISCV_ALL_CC_FLAGS                    = -g -fshort-wchar -fno-omit-frame-pointer -fno-strict-aliasing -Wall -Wno-array-bounds -ffunction-sections -fdata-sections -include AutoGen.h -fno-common -DSTRING_ARRAY_NAME=$(BASE_NAME)Strings -msmall-data-limit=0

+ DEFINE GCC_RISCV_ALL_DLINK_COMMON                = -nostdlib -Wl,-n,-q,--gc-sections -z common-page-size=0x40 DEF(GCC_DLINK_WARNING_FLAGS)

+ DEFINE GCC_RISCV_ALL_DLINK_FLAGS                 = DEF(GCC_RISCV_ALL_DLINK_COMMON) -Wl,--entry,$(IMAGE_ENTRY_POINT) -u $(IMAGE_ENTRY_POINT) -Wl,-Map,$(DEST_DIR_DEBUG)/$(BASE_NAME).map

+ DEFINE GCC_RISCV_ALL_DLINK2_FLAGS                = -Wl,--defsym=PECOFF_HEADER_SIZE=0x220,--script=$(EDK_TOOLS_PATH)/Scripts/GccBase.lds

+--- a/BaseTools/Source/C/Makefiles/header.makefile
++++ b/BaseTools/Source/C/Makefiles/header.makefile
+@@ -158,17 +158,17 @@ BUILD_OPTFLAGS = -O2 $(EXTRA_OPTFLAGS)
+ 

+ ifeq ($(DARWIN),Darwin)

+ # assume clang or clang compatible flags on OS X

+-CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -Wall -Werror \

++CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -Wall \

+ -Wno-deprecated-declarations -Wno-self-assign -Wno-unused-result -nostdlib -g

+ else

+ ifneq ($(CLANG),)

+ CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -fwrapv \

+--fno-delete-null-pointer-checks -Wall -Werror \

++-fno-delete-null-pointer-checks -Wall \

+ -Wno-deprecated-declarations -Wno-self-assign \

+ -Wno-unused-result -nostdlib -g

+ else

+ CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -fwrapv \

+--fno-delete-null-pointer-checks -Wall -Werror \

++-fno-delete-null-pointer-checks -Wall \

+ -Wno-deprecated-declarations -Wno-stringop-truncation -Wno-restrict \

+ -Wno-unused-result -nostdlib -g

+ endif