dev-qt/qtwebengine: refactor qt6 ebuild, various fixes incl. musl

Essentially a rewrite, so only have a not exhaustive summary
of changes rather than split commits.

Bugs addressed:
* respect *FLAGS wrt bug #652172 (fwics should be no issues left)
* hopefully fixed musl/libcxx (tested with llvm-musl) wrt bug #876520
(not planning to review Qt5's myself, so no changes on that end)

IUSE changes:
* enable alsa by default, finding that you have no audio options
  only after building is not great and alsa is cheap
* enable widgets by default, needed by both falkon and qutebrowser
* add custom-cflags, if going to use *FLAGS then should strip-flags
  like chromium's ebuild
* add opengl, unfortunately littered in QT_CONFIG(opengl) and need
  qtbase[opengl=] to avoid ABI/automagic issues
* add vulkan, has its own feature so should only need qtbase[vulkan?]
* add qml similarly to other packages

Misc:
* support EXTRA_GN like qtwebengine:5 and chromium (Gentoo-specific)
* build dir went from >9GB to ~6.3GB by dropping -g1
* drop estack+extglob, setting extglob is technically not needed for
  use in bash [[ ]] tests which is-flagq does
* drop INCLUDEPATH, tried to sed qmake files but this is using cmake
* respect NINJA env var to allow samu (NINJA_PATH was a no-op)
* use get_NINJAOPTS for NINJAFLAGS and ignore environment (NINJAOPTS
  is the var to set for this, while NINJAFLAGS is a private
  qtwebengine var, ninja does not actually use this directly)
* drop icu's bundling check for simplicity (and consistency with other
  system libraries), bug #630834 prompted adding this but does not
  seem so fragile anymore (plus iwdevtools would report lib misuse,
  albeit not headers)
* switch to bundled re2 to be spared headaches (see github PR#32281)
* optfeature on chrome-binary-plugins for widevine support
* cleanup/reduce QT_FEATURE and old comments
* fix designer automagic
* various dependencies adjustments, wrt re2c that is only needed if
  we build ninja
* do not redefine _FORTIFY_SOURCE (use gentoo's defaults), upstream
  actually switched to =3 in chromium-118 (albeit only for ChromeOS)
  and "hopefully" is fine for this older version (tests pass at least)

Also moved patches to a tarball (like qt5). It is simple small patches
mostly adjusting macros rather than add actual code, but was beginning
to add up.

Considered reducing RAM requirements a little bit (generally *seems*
not so bad), but there is rather bad spikes and I do not think it can
be considered safe unless we assume everyone is not using RAM for
anything else. Plus usage will likely keep growing with versions.

Bug: https://bugs.gentoo.org/652172
Bug: https://bugs.gentoo.org/876520
Signed-off-by: Ionen Wolkens <ionen@gentoo.org>

5 files changed, 517 insertions, 256 deletions

diff --git a/dev-qt/qtwebengine/Manifest b/dev-qt/qtwebengine/Manifest
index a8d8ae85776c..2310ef4cde61 100644
--- a/dev-qt/qtwebengine/Manifest
+++ b/dev-qt/qtwebengine/Manifest
@@ -3,4 +3,5 @@ DIST qtwebengine-5.15.10_p20230815-patchset.tar.xz 44880 BLAKE2B 6179ca4ad69f922
 DIST qtwebengine-5.15.10_p20230815.tar.xz 299275336 BLAKE2B 9c64f09d982086d51af7d4134f174db9c23162bc3317ea4f19e44d91a52ad63aff56bacc7ae64a2bf693d900ef3ef5231c7333eb56237123799066055fc49450 SHA512 4e6abd825d124fddc63bc8ff92e94940b829289277aa17423403c6ce168c12fff1d52b604ae127c1a0fdbca852e3795482acefbe6e506a3059c0d32bec45a709
 DIST qtwebengine-5.15.2-r1-chromium87-ppc64le.tar.xz 28784 BLAKE2B aa101d14446f3282fda8932cc75a249d88b79319f0886d95777292776d94ac5f4fc114c3893b2801fbba6abb14f381172bb14b15b5ffef12413db3a16e4d1ca6 SHA512 3324e0076eb18e2ae2248428d2730cfb3413761514b2bb57e25b8db79248aaaa8098d9f7cebfa08f1a3b39b1d0a382aafed75c5ae8273918909335957921305e
 DIST qtwebengine-5.15.8_p20230313-patchset.tar.xz 45904 BLAKE2B 9f58b9808fd445a06e6a2cd6d5f7bc9782bd6de13138fdebc9e81bd9f69e7ae673a71bd3ed6b011a47e84cc64b5b703a7cfc8d5f740eaaa663da1db8ef9ef05b SHA512 21b0b853358260fa1bdc96c97c5b2af7007c744d10abeebf9f0e708a0cd7dece583d86c0554a4e327a0d615bb403b0d328acaa6622b50d7a8059bc0802edbcec
+DIST qtwebengine-6.5-patchset-1.tar.xz 12936 BLAKE2B f44af36689596da0177f0607cf242d9cce3c376f4a5c28d7902a6b44651ce9272d745a824580268e999c2d58b72424d72eb6027d7461184bf7f04e0223e5195f SHA512 f639eb09d18c19c7b0d422d6acdce62404be0fcce905374c5d47266340191f7ca66875680bb09d80e72db718e34b7dc6e7db5f2f16407a0edb892930513ea407
 DIST qtwebengine-everywhere-src-6.5.2.tar.xz 412356700 BLAKE2B a48a513cffbf140aab08d748bc7826e841b7e1a87d113abbd0d8e7df5b9eb1ff2a44b89ae341c161eae26fd004699a1392f811252eb25aa13e0ce8e08f6be0a1 SHA512 f5791002495ebfa9912477f39a96d28bd4f4329f636f6b2055f1b811503b3c394c3ddd7baed5643f78f1905b1e8f860b4202b5d8e4afe5791e5450b9f46eac12
diff --git a/dev-qt/qtwebengine/metadata.xml b/dev-qt/qtwebengine/metadata.xml
index 4e29fc2c2a66..ca6040fdb1aa 100644
--- a/dev-qt/qtwebengine/metadata.xml
+++ b/dev-qt/qtwebengine/metadata.xml
@@ -13,6 +13,7 @@
 	<use>
 		<flag name="designer">Install the QWebEngineView plugin used to add widgets in <pkg>dev-qt/designer</pkg> forms that display web pages.</flag>
 		<flag name="jumbo-build">Combine source files to speed up build process.</flag>
+		<flag name="qml">Build QML/QtQuick bindings and imports</flag>
 		<flag name="system-icu">Use the system-wide <pkg>dev-libs/icu</pkg> instead of bundled.</flag>
 		<flag name="widgets">Enable QtWidgets support</flag>
 	</use>
diff --git a/dev-qt/qtwebengine/qtwebengine-6.5.2-r1.ebuild b/dev-qt/qtwebengine/qtwebengine-6.5.2-r1.ebuild
new file mode 100644
index 000000000000..0b096d27620e
--- /dev/null
+++ b/dev-qt/qtwebengine/qtwebengine-6.5.2-r1.ebuild
@@ -0,0 +1,267 @@
+# Copyright 2021-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# py3.12: uses imp and distutils among potentially more issues, refer to
+# www-client/chromium for when adding/backporting support may be viable
+PYTHON_COMPAT=( python3_{10..11} )
+PYTHON_REQ_USE="xml(+)"
+inherit check-reqs flag-o-matic multiprocessing optfeature
+inherit prefix python-any-r1 qt6-build toolchain-funcs
+
+DESCRIPTION="Library for rendering dynamic web content in Qt6 C++ and QML applications"
+SRC_URI+="
+	https://dev.gentoo.org/~ionen/distfiles/${PN}-6.5-patchset-1.tar.xz
+"
+
+if [[ ${QT6_BUILD_TYPE} == release ]]; then
+	KEYWORDS="~amd64"
+fi
+
+IUSE="
+	+alsa bindist custom-cflags designer geolocation +jumbo-build kerberos
+	opengl pulseaudio qml screencast +system-icu vulkan +widgets
+"
+REQUIRED_USE="
+	designer? ( qml widgets )
+"
+
+# dlopen: krb5, pciutils, udev
+RDEPEND="
+	app-arch/snappy:=
+	dev-libs/expat
+	dev-libs/libevent:=
+	dev-libs/libxml2[icu]
+	dev-libs/libxslt
+	dev-libs/nspr
+	dev-libs/nss
+	=dev-qt/qtbase-${PV}*:6[X,gui,opengl=,vulkan?,widgets?]
+	=dev-qt/qtwebchannel-${PV}*:6[qml?]
+	media-libs/fontconfig
+	media-libs/freetype
+	media-libs/harfbuzz:=
+	media-libs/lcms:2
+	media-libs/libjpeg-turbo:=
+	media-libs/libpng:=
+	media-libs/libvpx:=
+	media-libs/libwebp:=
+	media-libs/openjpeg:2=
+	media-libs/opus
+	sys-apps/dbus
+	sys-apps/pciutils
+	sys-libs/zlib:=[minizip]
+	virtual/libudev
+	x11-libs/libX11
+	x11-libs/libXcomposite
+	x11-libs/libXdamage
+	x11-libs/libXext
+	x11-libs/libXfixes
+	x11-libs/libXrandr
+	x11-libs/libXtst
+	x11-libs/libxcb:=
+	x11-libs/libxkbcommon
+	x11-libs/libxkbfile
+	alsa? ( media-libs/alsa-lib )
+	designer? ( =dev-qt/qttools-${PV}*:6[designer] )
+	geolocation? ( =dev-qt/qtpositioning-${PV}*:6 )
+	kerberos? ( virtual/krb5 )
+	pulseaudio? ( media-libs/libpulse[glib] )
+	qml? ( =dev-qt/qtdeclarative-${PV}*:6 )
+	screencast? (
+		dev-libs/glib:2
+		media-libs/mesa[gbm(+)]
+		media-video/pipewire:=
+		x11-libs/libdrm
+	)
+	system-icu? ( dev-libs/icu:= )
+	widgets? ( =dev-qt/qtdeclarative-${PV}*:6[widgets] )
+"
+DEPEND="
+	${RDEPEND}
+	media-libs/libglvnd
+	x11-base/xorg-proto
+	x11-libs/libxshmfence
+	screencast? ( media-libs/libepoxy[egl(+)] )
+	test? (
+		widgets? ( app-text/poppler[cxx(+)] )
+	)
+"
+BDEPEND="
+	$(python_gen_any_dep 'dev-python/html5lib[${PYTHON_USEDEP}]')
+	dev-util/gperf
+	net-libs/nodejs[ssl]
+	sys-devel/bison
+	sys-devel/flex
+"
+
+PATCHES=( "${WORKDIR}"/patches/${PN} )
+[[ ${PV} == 6.9999 ]] || # keep for 6.x.9999
+	PATCHES+=( "${WORKDIR}"/patches/chromium )
+
+PATCHES+=(
+	# add extras as needed here, may merge in set if carries across versions
+)
+
+python_check_deps() {
+	python_has_version "dev-python/html5lib[${PYTHON_USEDEP}]"
+}
+
+qtwebengine_check-reqs() {
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	if is-flagq '-g?(gdb)?([1-9])'; then #307861
+		ewarn "Used CFLAGS/CXXFLAGS seem to enable debug info (-g or -ggdb),"
+		ewarn "which is non-trivial with ${PN}. May experience extended"
+		ewarn "compilation times and increased disk/memory usage. If run into"
+		ewarn "issues, please disable before reporting a bug."
+	fi
+
+	local CHECKREQS_DISK_BUILD=7G
+	local CHECKREQS_DISK_USR=220M
+
+	if ! has distcc ${FEATURES}; then #830661
+		# assume ~2GB per job or 1.5GB if clang, possible with less
+		# depending on free memory and *FLAGS, but prefer being safe as
+		# users having OOM issues with qtwebengine been rather common
+		tc-is-clang && : 15 || : 20
+		local CHECKREQS_MEMORY=$(($(makeopts_jobs)*_/10))G
+	fi
+
+	check-reqs_${EBUILD_PHASE_FUNC} #570534
+}
+
+pkg_pretend() {
+	qtwebengine_check-reqs
+}
+
+pkg_setup() {
+	qtwebengine_check-reqs
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	qt6-build_src_prepare
+
+	# for www-plugins/chrome-binary-plugins (widevine) search paths on prefix
+	hprefixify -w /Gentoo/ src/core/content_client_qt.cpp
+
+	# store chromium versions, only used in postinst for a warning
+	local chromium
+	mapfile -t chromium < CHROMIUM_VERSION || die
+	[[ ${chromium[1]} =~ ^Based.*:[^0-9]+([0-9.]+$) ]] &&
+		QT6_CHROMIUM_VER=${BASH_REMATCH[1]} || die
+	[[ ${chromium[2]} =~ ^Patched.+:[^0-9]+([0-9.]+$) ]] &&
+		QT6_CHROMIUM_PATCHES_VER=${BASH_REMATCH[1]} || die
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DQT_FEATURE_qtpdf_build=OFF # TODO?
+		-DQT_FEATURE_qtpdf_quick_build=OFF
+		-DQT_FEATURE_qtpdf_widgets_build=OFF
+
+		-DQT_FEATURE_qtwebengine_build=ON
+		$(qt_feature qml qtwebengine_quick_build)
+		$(qt_feature widgets qtwebengine_widgets_build)
+
+		$(cmake_use_find_package designer Qt6Designer)
+
+		$(qt_feature alsa webengine_system_alsa)
+		$(qt_feature !bindist webengine_proprietary_codecs)
+		$(qt_feature geolocation webengine_geolocation)
+		$(qt_feature jumbo-build webengine_jumbo_build)
+		$(qt_feature kerberos webengine_kerberos)
+		$(qt_feature pulseaudio webengine_system_pulseaudio)
+		$(qt_feature screencast webengine_webrtc_pipewire)
+		$(qt_feature system-icu webengine_system_icu)
+		$(qt_feature vulkan webengine_vulkan)
+		-DQT_FEATURE_webengine_embedded_build=OFF
+		-DQT_FEATURE_webengine_extensions=ON
+		-DQT_FEATURE_webengine_ozone_x11=ON # needed, cannot do optional X yet
+		-DQT_FEATURE_webengine_pepper_plugins=ON
+		-DQT_FEATURE_webengine_printing_and_pdf=ON
+		-DQT_FEATURE_webengine_spellchecker=ON
+		-DQT_FEATURE_webengine_webchannel=ON
+		-DQT_FEATURE_webengine_webrtc=ON
+
+		# needs a modified ffmpeg to be usable, and even then it may not
+		# cooperate with new major ffmpeg versions (bug #831487)
+		-DQT_FEATURE_webengine_system_ffmpeg=OFF
+
+		# preemptively using bundled to avoid complications, may revisit
+		# (see discussions in https://github.com/gentoo/gentoo/pull/32281)
+		-DQT_FEATURE_webengine_system_re2=OFF
+
+		# not necessary to pass these (default), but in case detection fails
+		$(printf -- '-DQT_FEATURE_webengine_system_%s=ON ' \
+			freetype glib harfbuzz lcms2 libevent libjpeg \
+			libopenjpeg2 libpci libpng libvpx libwebp libxml \
+			minizip opus poppler snappy zlib)
+
+		# TODO: fixup gn cross, or package dev-qt/qtwebengine-gn with =ON
+		-DINSTALL_GN=OFF
+	)
+
+	local mygnargs=(
+		# prefer no dlopen where possible
+		link_pulseaudio=true
+		rtc_link_pipewire=true
+	)
+
+	use custom-cflags || strip-flags # fragile
+
+	export NINJA NINJAFLAGS=$(get_NINJAOPTS)
+	[[ ${NINJA_VERBOSE^^} == OFF ]] || NINJAFLAGS+=" -v"
+
+	local -x EXTRA_GN="${mygnargs[*]} ${EXTRA_GN}"
+	einfo "Extra Gn args: ${EXTRA_GN}"
+
+	qt6-build_src_configure
+}
+
+src_test() {
+	if [[ ${EUID} == 0 ]]; then
+		# almost every tests fail, so skip entirely
+		ewarn "Skipping tests due to running as root (chromium refuses this configuration)."
+		return
+	fi
+
+	local CMAKE_SKIP_TESTS=(
+		# fails with network sandbox
+		tst_loadsignals
+		tst_qquickwebengineview
+		tst_qwebengineview
+		# certs verfication seems flaky and gives expiration warnings
+		tst_qwebengineclientcertificatestore
+	)
+
+	# prevent using the system's qtwebengine
+	# (use glob to avoid unnecessary complications with arch dir)
+	local resources=( "${BUILD_DIR}/src/core/${CMAKE_BUILD_TYPE}/"* )
+	[[ -d ${resources[0]} ]] || die "invalid resources path: ${resources[0]}"
+	local -x QTWEBENGINEPROCESS_PATH=${BUILD_DIR}${QT6_LIBEXECDIR#"${QT6_PREFIX}"}/QtWebEngineProcess
+	local -x QTWEBENGINE_LOCALES_PATH=${resources[0]}/qtwebengine_locales
+	local -x QTWEBENGINE_RESOURCES_PATH=${resources[0]}
+
+	# random failures in several tests without -j1
+	qt6-build_src_test -j1
+}
+
+pkg_postinst() {
+	# plugin may also be found in $HOME if provided by chrome or firefox
+	use amd64 &&
+		optfeature "Widevine DRM support (protected media playback)" \
+			www-plugins/chrome-binary-plugins
+
+	elog
+	elog "This version of Qt WebEngine is based on Chromium version ${QT6_CHROMIUM_VER}, with"
+	elog "additional security fixes up to ${QT6_CHROMIUM_PATCHES_VER}. Extensive as it is, the"
+	elog "list of backports is impossible to evaluate, but always bound to be behind"
+	elog "Chromium's release schedule."
+	elog
+	elog "In addition, various online services may deny service based on an outdated"
+	elog "user agent version (and/or other checks). Google is already known to do so."
+	elog
+	elog "tl;dr your web browsing experience will be compromised."
+}
diff --git a/dev-qt/qtwebengine/qtwebengine-6.5.9999.ebuild b/dev-qt/qtwebengine/qtwebengine-6.5.9999.ebuild
index 0914c4a43390..0b096d27620e 100644
--- a/dev-qt/qtwebengine/qtwebengine-6.5.9999.ebuild
+++ b/dev-qt/qtwebengine/qtwebengine-6.5.9999.ebuild
@@ -3,89 +3,106 @@
 
 EAPI=8
 
+# py3.12: uses imp and distutils among potentially more issues, refer to
+# www-client/chromium for when adding/backporting support may be viable
 PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="xml(+)"
-inherit check-reqs estack flag-o-matic multiprocessing
+inherit check-reqs flag-o-matic multiprocessing optfeature
 inherit prefix python-any-r1 qt6-build toolchain-funcs
 
 DESCRIPTION="Library for rendering dynamic web content in Qt6 C++ and QML applications"
+SRC_URI+="
+	https://dev.gentoo.org/~ionen/distfiles/${PN}-6.5-patchset-1.tar.xz
+"
 
 if [[ ${QT6_BUILD_TYPE} == release ]]; then
 	KEYWORDS="~amd64"
 fi
 
 IUSE="
-	alsa bindist designer geolocation +jumbo-build kerberos
-	pulseaudio screencast +system-icu widgets
+	+alsa bindist custom-cflags designer geolocation +jumbo-build kerberos
+	opengl pulseaudio qml screencast +system-icu vulkan +widgets
+"
+REQUIRED_USE="
+	designer? ( qml widgets )
 "
-REQUIRED_USE="designer? ( widgets )"
 
+# dlopen: krb5, pciutils, udev
 RDEPEND="
 	app-arch/snappy:=
-	dev-libs/glib:2
-	dev-libs/nspr
-	dev-libs/nss
 	dev-libs/expat
 	dev-libs/libevent:=
 	dev-libs/libxml2[icu]
 	dev-libs/libxslt
-	dev-libs/re2:=
-	=dev-qt/qtdeclarative-${PV}*:6
-	=dev-qt/qtwebchannel-${PV}*:6
+	dev-libs/nspr
+	dev-libs/nss
+	=dev-qt/qtbase-${PV}*:6[X,gui,opengl=,vulkan?,widgets?]
+	=dev-qt/qtwebchannel-${PV}*:6[qml?]
 	media-libs/fontconfig
 	media-libs/freetype
 	media-libs/harfbuzz:=
 	media-libs/lcms:2
 	media-libs/libjpeg-turbo:=
 	media-libs/libpng:=
-	>=media-libs/libvpx-1.5:=[svc(+)]
+	media-libs/libvpx:=
 	media-libs/libwebp:=
 	media-libs/openjpeg:2=
 	media-libs/opus
 	sys-apps/dbus
 	sys-apps/pciutils
-	sys-libs/zlib[minizip]
+	sys-libs/zlib:=[minizip]
 	virtual/libudev
-	x11-libs/libdrm
 	x11-libs/libX11
 	x11-libs/libXcomposite
-	x11-libs/libXcursor
-	x11-libs/libxcb:=
 	x11-libs/libXdamage
 	x11-libs/libXext
 	x11-libs/libXfixes
-	x11-libs/libXi
-	x11-libs/libxkbcommon
-	x11-libs/libxkbfile
 	x11-libs/libXrandr
-	x11-libs/libXrender
-	x11-libs/libXScrnSaver
-	x11-libs/libxshmfence:=
 	x11-libs/libXtst
+	x11-libs/libxcb:=
+	x11-libs/libxkbcommon
+	x11-libs/libxkbfile
 	alsa? ( media-libs/alsa-lib )
+	designer? ( =dev-qt/qttools-${PV}*:6[designer] )
 	geolocation? ( =dev-qt/qtpositioning-${PV}*:6 )
 	kerberos? ( virtual/krb5 )
-	pulseaudio? ( media-libs/libpulse:= )
-	screencast? ( media-video/pipewire:= )
-	system-icu? ( >=dev-libs/icu-69.1:= )
-	widgets? (
-		=dev-qt/qtbase-${PV}*:6[widgets]
+	pulseaudio? ( media-libs/libpulse[glib] )
+	qml? ( =dev-qt/qtdeclarative-${PV}*:6 )
+	screencast? (
+		dev-libs/glib:2
+		media-libs/mesa[gbm(+)]
+		media-video/pipewire:=
+		x11-libs/libdrm
 	)
+	system-icu? ( dev-libs/icu:= )
+	widgets? ( =dev-qt/qtdeclarative-${PV}*:6[widgets] )
 "
 DEPEND="
 	${RDEPEND}
 	media-libs/libglvnd
+	x11-base/xorg-proto
+	x11-libs/libxshmfence
+	screencast? ( media-libs/libepoxy[egl(+)] )
+	test? (
+		widgets? ( app-text/poppler[cxx(+)] )
+	)
 "
 BDEPEND="
 	$(python_gen_any_dep 'dev-python/html5lib[${PYTHON_USEDEP}]')
 	dev-util/gperf
-	dev-util/ninja
-	dev-util/re2c
 	net-libs/nodejs[ssl]
 	sys-devel/bison
 	sys-devel/flex
 "
 
+PATCHES=( "${WORKDIR}"/patches/${PN} )
+[[ ${PV} == 6.9999 ]] || # keep for 6.x.9999
+	PATCHES+=( "${WORKDIR}"/patches/chromium )
+
+PATCHES+=(
+	# add extras as needed here, may merge in set if carries across versions
+)
+
 python_check_deps() {
 	python_has_version "dev-python/html5lib[${PYTHON_USEDEP}]"
 }
@@ -93,36 +110,25 @@ python_check_deps() {
 qtwebengine_check-reqs() {
 	[[ ${MERGE_TYPE} == binary ]] && return
 
-	# bug #307861
-	eshopts_push -s extglob
-	if is-flagq '-g?(gdb)?([1-9])'; then
-		ewarn "You have enabled debug info (probably have -g or -ggdb in your CFLAGS/CXXFLAGS)."
-		ewarn "You may experience really long compilation times and/or increased memory usage."
-		ewarn "If compilation fails, please try removing -g/-ggdb before reporting a bug."
-	fi
-	eshopts_pop
-
-	# (check-reqs added for bug #570534)
-	#
-	# Estimate the amount of RAM required
-	# Multiplier is *10 because Bash doesn't do floating point maths.
-	# Let's crudely assume ~2GB per compiler job for GCC.
-	local multiplier=20
-
-	# And call it ~1.5GB for Clang.
-	if tc-is-clang ; then
-		multiplier=15
+	if is-flagq '-g?(gdb)?([1-9])'; then #307861
+		ewarn "Used CFLAGS/CXXFLAGS seem to enable debug info (-g or -ggdb),"
+		ewarn "which is non-trivial with ${PN}. May experience extended"
+		ewarn "compilation times and increased disk/memory usage. If run into"
+		ewarn "issues, please disable before reporting a bug."
 	fi
 
-	local CHECKREQS_DISK_BUILD="7G"
-	local CHECKREQS_DISK_USR="150M"
-	if ! has "distcc" ${FEATURES} ; then
-		# bug #830661
-		# Not super realistic to come up with good estimates for distcc right now
-		local CHECKREQS_MEMORY=$(($(makeopts_jobs)*multiplier/10))G
+	local CHECKREQS_DISK_BUILD=7G
+	local CHECKREQS_DISK_USR=220M
+
+	if ! has distcc ${FEATURES}; then #830661
+		# assume ~2GB per job or 1.5GB if clang, possible with less
+		# depending on free memory and *FLAGS, but prefer being safe as
+		# users having OOM issues with qtwebengine been rather common
+		tc-is-clang && : 15 || : 20
+		local CHECKREQS_MEMORY=$(($(makeopts_jobs)*_/10))G
 	fi
 
-	check-reqs_${EBUILD_PHASE_FUNC}
+	check-reqs_${EBUILD_PHASE_FUNC} #570534
 }
 
 pkg_pretend() {
@@ -137,26 +143,6 @@ pkg_setup() {
 src_prepare() {
 	qt6-build_src_prepare
 
-	# bug 620444 - ensure local headers are used
-	find . -type f -name "*.pr[fio]" -exec \
-		sed -i -e 's|INCLUDEPATH += |&$${QTWEBENGINE_ROOT}_build/include $${QTWEBENGINE_ROOT}/include |' {} + || die
-
-	if use system-icu; then
-		# Sanity check to ensure that bundled copy of ICU is not used.
-		# Whole src/3rdparty/chromium/third_party/icu directory cannot be deleted because
-		# src/3rdparty/chromium/third_party/icu/BUILD.gn is used by build system.
-		# If usage of headers of bundled copy of ICU occurs, then lists of shim headers in
-		# shim_headers("icui18n_shim") and shim_headers("icuuc_shim") in
-		# src/3rdparty/chromium/third_party/icu/BUILD.gn should be updated.
-		local file
-		while read file; do
-			echo "#error This file should not be used!" > "${file}" || die
-		done < <(
-			find src/3rdparty/chromium/third_party/icu -type f \
-				\( -name '*.c' -o -name '*.cpp' -o -name '*.h' \) 2>/dev/null
-		)
-	fi
-
 	# for www-plugins/chrome-binary-plugins (widevine) search paths on prefix
 	hprefixify -w /Gentoo/ src/core/content_client_qt.cpp
 
@@ -170,63 +156,67 @@ src_prepare() {
 }
 
 src_configure() {
-	export NINJA_PATH=${BROOT}/usr/bin/ninja
-	export NINJAFLAGS=${NINJAFLAGS:--j$(makeopts_jobs) -l$(makeopts_loadavg "${MAKEOPTS}" 0) -v}
-
 	local mycmakeargs=(
-		#-DQT_FEATURE_accessibility=off
-		#-DQT_FEATURE_force_asserts=off
-		#-DQT_FEATURE_opengl=off
-		#-DQT_FEATURE_printer=off
-		-DQT_FEATURE_qtpdf_build=off
-		-DQT_FEATURE_qtpdf_quick_build=off
-		-DQT_FEATURE_qtpdf_widgets_build=off
-		-DQT_FEATURE_qtwebengine_build=on
-		-DQT_FEATURE_qtwebengine_quick_build=on
-		-DQT_FEATURE_qtwebengine_widgets_build=on
-		#-DQT_FEATURE_ssl=off
-		#-DQT_FEATURE_static=off
-		#-DQT_FEATURE_system_zlib=off
-		#-DQT_FEATURE_system_png=off
-		#-DQT_FEATURE_system_jpeg=off
-		#-DQT_FEATURE_system_freetype=off
-		#-DQT_FEATURE_system_harfbuzz=off
-		#-DQT_FEATURE_use_gold_linker=off
-		#-DQT_FEATURE_use_lld_linker=off
-		-DQT_FEATURE_webengine_embedded_build=off
-		-DQT_FEATURE_webengine_extensions=on
-		#-DQT_FEATURE_webengine_full_debug_info=$(usex debug)
-		-DQT_FEATURE_webengine_geolocation=$(usex geolocation on off)
-		-DQT_FEATURE_webengine_jumbo_build=$(usex jumbo-build)
-		#-DQT_FEATURE_webengine_jumbo_file_merge_limit
-		-DQT_FEATURE_webengine_kerberos=$(usex kerberos on off)
-		-DQT_FEATURE_webengine_native_spellchecker=off
-		-DQT_FEATURE_webengine_ozone_x11=on
-		-DQT_FEATURE_webengine_pepper_plugins=on
-		-DQT_FEATURE_webengine_proprietary_codecs=$(usex bindist off on)
-		-DQT_FEATURE_webengine_printing_and_pdf=on
-		-DQT_FEATURE_webengine_sanitizer=on
-		-DQT_FEATURE_webengine_spellchecker=on
-		-DQT_FEATURE_webengine_system_opus=on
-		-DQT_FEATURE_webengine_system_libwebp=on
-		-DQT_FEATURE_webengine_system_alsa=$(usex alsa on off)
-		-DQT_FEATURE_webengine_system_ffmpeg=off # https://bugs.gentoo.org/831487
-		-DQT_FEATURE_webengine_system_icu=$(usex system-icu)
-		-DQT_FEATURE_webengine_system_libevent=on
-		-DQT_FEATURE_webengine_system_libopenjpeg2=on
-		-DQT_FEATURE_webengine_system_libpci=on
-		-DQT_FEATURE_webengine_system_libpng=on
-		-DQT_FEATURE_webengine_system_pulseaudio=$(usex pulseaudio on off)
-		-DQT_FEATURE_webengine_system_zlib=on
-		-DQT_FEATURE_webengine_webchannel=on
-		-DQT_FEATURE_webengine_webrtc=on
-		-DQT_FEATURE_webengine_webrtc_pipewire=$(usex screencast on off)
-		#-DQT_FEATURE_xcb=off
-
-		# TODO: fix gn cross build or split + depend on dev-qt/qtwebengine-gn
-		-DINSTALL_GN=off
+		-DQT_FEATURE_qtpdf_build=OFF # TODO?
+		-DQT_FEATURE_qtpdf_quick_build=OFF
+		-DQT_FEATURE_qtpdf_widgets_build=OFF
+
+		-DQT_FEATURE_qtwebengine_build=ON
+		$(qt_feature qml qtwebengine_quick_build)
+		$(qt_feature widgets qtwebengine_widgets_build)
+
+		$(cmake_use_find_package designer Qt6Designer)
+
+		$(qt_feature alsa webengine_system_alsa)
+		$(qt_feature !bindist webengine_proprietary_codecs)
+		$(qt_feature geolocation webengine_geolocation)
+		$(qt_feature jumbo-build webengine_jumbo_build)
+		$(qt_feature kerberos webengine_kerberos)
+		$(qt_feature pulseaudio webengine_system_pulseaudio)
+		$(qt_feature screencast webengine_webrtc_pipewire)
+		$(qt_feature system-icu webengine_system_icu)
+		$(qt_feature vulkan webengine_vulkan)
+		-DQT_FEATURE_webengine_embedded_build=OFF
+		-DQT_FEATURE_webengine_extensions=ON
+		-DQT_FEATURE_webengine_ozone_x11=ON # needed, cannot do optional X yet
+		-DQT_FEATURE_webengine_pepper_plugins=ON
+		-DQT_FEATURE_webengine_printing_and_pdf=ON
+		-DQT_FEATURE_webengine_spellchecker=ON
+		-DQT_FEATURE_webengine_webchannel=ON
+		-DQT_FEATURE_webengine_webrtc=ON
+
+		# needs a modified ffmpeg to be usable, and even then it may not
+		# cooperate with new major ffmpeg versions (bug #831487)
+		-DQT_FEATURE_webengine_system_ffmpeg=OFF
+
+		# preemptively using bundled to avoid complications, may revisit
+		# (see discussions in https://github.com/gentoo/gentoo/pull/32281)
+		-DQT_FEATURE_webengine_system_re2=OFF
+
+		# not necessary to pass these (default), but in case detection fails
+		$(printf -- '-DQT_FEATURE_webengine_system_%s=ON ' \
+			freetype glib harfbuzz lcms2 libevent libjpeg \
+			libopenjpeg2 libpci libpng libvpx libwebp libxml \
+			minizip opus poppler snappy zlib)
+
+		# TODO: fixup gn cross, or package dev-qt/qtwebengine-gn with =ON
+		-DINSTALL_GN=OFF
+	)
+
+	local mygnargs=(
+		# prefer no dlopen where possible
+		link_pulseaudio=true
+		rtc_link_pipewire=true
 	)
 
+	use custom-cflags || strip-flags # fragile
+
+	export NINJA NINJAFLAGS=$(get_NINJAOPTS)
+	[[ ${NINJA_VERBOSE^^} == OFF ]] || NINJAFLAGS+=" -v"
+
+	local -x EXTRA_GN="${mygnargs[*]} ${EXTRA_GN}"
+	einfo "Extra Gn args: ${EXTRA_GN}"
+
 	qt6-build_src_configure
 }
 
@@ -259,6 +249,12 @@ src_test() {
 }
 
 pkg_postinst() {
+	# plugin may also be found in $HOME if provided by chrome or firefox
+	use amd64 &&
+		optfeature "Widevine DRM support (protected media playback)" \
+			www-plugins/chrome-binary-plugins
+
+	elog
 	elog "This version of Qt WebEngine is based on Chromium version ${QT6_CHROMIUM_VER}, with"
 	elog "additional security fixes up to ${QT6_CHROMIUM_PATCHES_VER}. Extensive as it is, the"
 	elog "list of backports is impossible to evaluate, but always bound to be behind"
diff --git a/dev-qt/qtwebengine/qtwebengine-6.9999.ebuild b/dev-qt/qtwebengine/qtwebengine-6.9999.ebuild
index 0914c4a43390..0b096d27620e 100644
--- a/dev-qt/qtwebengine/qtwebengine-6.9999.ebuild
+++ b/dev-qt/qtwebengine/qtwebengine-6.9999.ebuild
@@ -3,89 +3,106 @@
 
 EAPI=8
 
+# py3.12: uses imp and distutils among potentially more issues, refer to
+# www-client/chromium for when adding/backporting support may be viable
 PYTHON_COMPAT=( python3_{10..11} )
 PYTHON_REQ_USE="xml(+)"
-inherit check-reqs estack flag-o-matic multiprocessing
+inherit check-reqs flag-o-matic multiprocessing optfeature
 inherit prefix python-any-r1 qt6-build toolchain-funcs
 
 DESCRIPTION="Library for rendering dynamic web content in Qt6 C++ and QML applications"
+SRC_URI+="
+	https://dev.gentoo.org/~ionen/distfiles/${PN}-6.5-patchset-1.tar.xz
+"
 
 if [[ ${QT6_BUILD_TYPE} == release ]]; then
 	KEYWORDS="~amd64"
 fi
 
 IUSE="
-	alsa bindist designer geolocation +jumbo-build kerberos
-	pulseaudio screencast +system-icu widgets
+	+alsa bindist custom-cflags designer geolocation +jumbo-build kerberos
+	opengl pulseaudio qml screencast +system-icu vulkan +widgets
+"
+REQUIRED_USE="
+	designer? ( qml widgets )
 "
-REQUIRED_USE="designer? ( widgets )"
 
+# dlopen: krb5, pciutils, udev
 RDEPEND="
 	app-arch/snappy:=
-	dev-libs/glib:2
-	dev-libs/nspr
-	dev-libs/nss
 	dev-libs/expat
 	dev-libs/libevent:=
 	dev-libs/libxml2[icu]
 	dev-libs/libxslt
-	dev-libs/re2:=
-	=dev-qt/qtdeclarative-${PV}*:6
-	=dev-qt/qtwebchannel-${PV}*:6
+	dev-libs/nspr
+	dev-libs/nss
+	=dev-qt/qtbase-${PV}*:6[X,gui,opengl=,vulkan?,widgets?]
+	=dev-qt/qtwebchannel-${PV}*:6[qml?]
 	media-libs/fontconfig
 	media-libs/freetype
 	media-libs/harfbuzz:=
 	media-libs/lcms:2
 	media-libs/libjpeg-turbo:=
 	media-libs/libpng:=
-	>=media-libs/libvpx-1.5:=[svc(+)]
+	media-libs/libvpx:=
 	media-libs/libwebp:=
 	media-libs/openjpeg:2=
 	media-libs/opus
 	sys-apps/dbus
 	sys-apps/pciutils
-	sys-libs/zlib[minizip]
+	sys-libs/zlib:=[minizip]
 	virtual/libudev
-	x11-libs/libdrm
 	x11-libs/libX11
 	x11-libs/libXcomposite
-	x11-libs/libXcursor
-	x11-libs/libxcb:=
 	x11-libs/libXdamage
 	x11-libs/libXext
 	x11-libs/libXfixes
-	x11-libs/libXi
-	x11-libs/libxkbcommon
-	x11-libs/libxkbfile
 	x11-libs/libXrandr
-	x11-libs/libXrender
-	x11-libs/libXScrnSaver
-	x11-libs/libxshmfence:=
 	x11-libs/libXtst
+	x11-libs/libxcb:=
+	x11-libs/libxkbcommon
+	x11-libs/libxkbfile
 	alsa? ( media-libs/alsa-lib )
+	designer? ( =dev-qt/qttools-${PV}*:6[designer] )
 	geolocation? ( =dev-qt/qtpositioning-${PV}*:6 )
 	kerberos? ( virtual/krb5 )
-	pulseaudio? ( media-libs/libpulse:= )
-	screencast? ( media-video/pipewire:= )
-	system-icu? ( >=dev-libs/icu-69.1:= )
-	widgets? (
-		=dev-qt/qtbase-${PV}*:6[widgets]
+	pulseaudio? ( media-libs/libpulse[glib] )
+	qml? ( =dev-qt/qtdeclarative-${PV}*:6 )
+	screencast? (
+		dev-libs/glib:2
+		media-libs/mesa[gbm(+)]
+		media-video/pipewire:=
+		x11-libs/libdrm
 	)
+	system-icu? ( dev-libs/icu:= )
+	widgets? ( =dev-qt/qtdeclarative-${PV}*:6[widgets] )
 "
 DEPEND="
 	${RDEPEND}
 	media-libs/libglvnd
+	x11-base/xorg-proto
+	x11-libs/libxshmfence
+	screencast? ( media-libs/libepoxy[egl(+)] )
+	test? (
+		widgets? ( app-text/poppler[cxx(+)] )
+	)
 "
 BDEPEND="
 	$(python_gen_any_dep 'dev-python/html5lib[${PYTHON_USEDEP}]')
 	dev-util/gperf
-	dev-util/ninja
-	dev-util/re2c
 	net-libs/nodejs[ssl]
 	sys-devel/bison
 	sys-devel/flex
 "
 
+PATCHES=( "${WORKDIR}"/patches/${PN} )
+[[ ${PV} == 6.9999 ]] || # keep for 6.x.9999
+	PATCHES+=( "${WORKDIR}"/patches/chromium )
+
+PATCHES+=(
+	# add extras as needed here, may merge in set if carries across versions
+)
+
 python_check_deps() {
 	python_has_version "dev-python/html5lib[${PYTHON_USEDEP}]"
 }
@@ -93,36 +110,25 @@ python_check_deps() {
 qtwebengine_check-reqs() {
 	[[ ${MERGE_TYPE} == binary ]] && return
 
-	# bug #307861
-	eshopts_push -s extglob
-	if is-flagq '-g?(gdb)?([1-9])'; then
-		ewarn "You have enabled debug info (probably have -g or -ggdb in your CFLAGS/CXXFLAGS)."
-		ewarn "You may experience really long compilation times and/or increased memory usage."
-		ewarn "If compilation fails, please try removing -g/-ggdb before reporting a bug."
-	fi
-	eshopts_pop
-
-	# (check-reqs added for bug #570534)
-	#
-	# Estimate the amount of RAM required
-	# Multiplier is *10 because Bash doesn't do floating point maths.
-	# Let's crudely assume ~2GB per compiler job for GCC.
-	local multiplier=20
-
-	# And call it ~1.5GB for Clang.
-	if tc-is-clang ; then
-		multiplier=15
+	if is-flagq '-g?(gdb)?([1-9])'; then #307861
+		ewarn "Used CFLAGS/CXXFLAGS seem to enable debug info (-g or -ggdb),"
+		ewarn "which is non-trivial with ${PN}. May experience extended"
+		ewarn "compilation times and increased disk/memory usage. If run into"
+		ewarn "issues, please disable before reporting a bug."
 	fi
 
-	local CHECKREQS_DISK_BUILD="7G"
-	local CHECKREQS_DISK_USR="150M"
-	if ! has "distcc" ${FEATURES} ; then
-		# bug #830661
-		# Not super realistic to come up with good estimates for distcc right now
-		local CHECKREQS_MEMORY=$(($(makeopts_jobs)*multiplier/10))G
+	local CHECKREQS_DISK_BUILD=7G
+	local CHECKREQS_DISK_USR=220M
+
+	if ! has distcc ${FEATURES}; then #830661
+		# assume ~2GB per job or 1.5GB if clang, possible with less
+		# depending on free memory and *FLAGS, but prefer being safe as
+		# users having OOM issues with qtwebengine been rather common
+		tc-is-clang && : 15 || : 20
+		local CHECKREQS_MEMORY=$(($(makeopts_jobs)*_/10))G
 	fi
 
-	check-reqs_${EBUILD_PHASE_FUNC}
+	check-reqs_${EBUILD_PHASE_FUNC} #570534
 }
 
 pkg_pretend() {
@@ -137,26 +143,6 @@ pkg_setup() {
 src_prepare() {
 	qt6-build_src_prepare
 
-	# bug 620444 - ensure local headers are used
-	find . -type f -name "*.pr[fio]" -exec \
-		sed -i -e 's|INCLUDEPATH += |&$${QTWEBENGINE_ROOT}_build/include $${QTWEBENGINE_ROOT}/include |' {} + || die
-
-	if use system-icu; then
-		# Sanity check to ensure that bundled copy of ICU is not used.
-		# Whole src/3rdparty/chromium/third_party/icu directory cannot be deleted because
-		# src/3rdparty/chromium/third_party/icu/BUILD.gn is used by build system.
-		# If usage of headers of bundled copy of ICU occurs, then lists of shim headers in
-		# shim_headers("icui18n_shim") and shim_headers("icuuc_shim") in
-		# src/3rdparty/chromium/third_party/icu/BUILD.gn should be updated.
-		local file
-		while read file; do
-			echo "#error This file should not be used!" > "${file}" || die
-		done < <(
-			find src/3rdparty/chromium/third_party/icu -type f \
-				\( -name '*.c' -o -name '*.cpp' -o -name '*.h' \) 2>/dev/null
-		)
-	fi
-
 	# for www-plugins/chrome-binary-plugins (widevine) search paths on prefix
 	hprefixify -w /Gentoo/ src/core/content_client_qt.cpp
 
@@ -170,63 +156,67 @@ src_prepare() {
 }
 
 src_configure() {
-	export NINJA_PATH=${BROOT}/usr/bin/ninja
-	export NINJAFLAGS=${NINJAFLAGS:--j$(makeopts_jobs) -l$(makeopts_loadavg "${MAKEOPTS}" 0) -v}
-
 	local mycmakeargs=(
-		#-DQT_FEATURE_accessibility=off
-		#-DQT_FEATURE_force_asserts=off
-		#-DQT_FEATURE_opengl=off
-		#-DQT_FEATURE_printer=off
-		-DQT_FEATURE_qtpdf_build=off
-		-DQT_FEATURE_qtpdf_quick_build=off
-		-DQT_FEATURE_qtpdf_widgets_build=off
-		-DQT_FEATURE_qtwebengine_build=on
-		-DQT_FEATURE_qtwebengine_quick_build=on
-		-DQT_FEATURE_qtwebengine_widgets_build=on
-		#-DQT_FEATURE_ssl=off
-		#-DQT_FEATURE_static=off
-		#-DQT_FEATURE_system_zlib=off
-		#-DQT_FEATURE_system_png=off
-		#-DQT_FEATURE_system_jpeg=off
-		#-DQT_FEATURE_system_freetype=off
-		#-DQT_FEATURE_system_harfbuzz=off
-		#-DQT_FEATURE_use_gold_linker=off
-		#-DQT_FEATURE_use_lld_linker=off
-		-DQT_FEATURE_webengine_embedded_build=off
-		-DQT_FEATURE_webengine_extensions=on
-		#-DQT_FEATURE_webengine_full_debug_info=$(usex debug)
-		-DQT_FEATURE_webengine_geolocation=$(usex geolocation on off)
-		-DQT_FEATURE_webengine_jumbo_build=$(usex jumbo-build)
-		#-DQT_FEATURE_webengine_jumbo_file_merge_limit
-		-DQT_FEATURE_webengine_kerberos=$(usex kerberos on off)
-		-DQT_FEATURE_webengine_native_spellchecker=off
-		-DQT_FEATURE_webengine_ozone_x11=on
-		-DQT_FEATURE_webengine_pepper_plugins=on
-		-DQT_FEATURE_webengine_proprietary_codecs=$(usex bindist off on)
-		-DQT_FEATURE_webengine_printing_and_pdf=on
-		-DQT_FEATURE_webengine_sanitizer=on
-		-DQT_FEATURE_webengine_spellchecker=on
-		-DQT_FEATURE_webengine_system_opus=on
-		-DQT_FEATURE_webengine_system_libwebp=on
-		-DQT_FEATURE_webengine_system_alsa=$(usex alsa on off)
-		-DQT_FEATURE_webengine_system_ffmpeg=off # https://bugs.gentoo.org/831487
-		-DQT_FEATURE_webengine_system_icu=$(usex system-icu)
-		-DQT_FEATURE_webengine_system_libevent=on
-		-DQT_FEATURE_webengine_system_libopenjpeg2=on
-		-DQT_FEATURE_webengine_system_libpci=on
-		-DQT_FEATURE_webengine_system_libpng=on
-		-DQT_FEATURE_webengine_system_pulseaudio=$(usex pulseaudio on off)
-		-DQT_FEATURE_webengine_system_zlib=on
-		-DQT_FEATURE_webengine_webchannel=on
-		-DQT_FEATURE_webengine_webrtc=on
-		-DQT_FEATURE_webengine_webrtc_pipewire=$(usex screencast on off)
-		#-DQT_FEATURE_xcb=off
-
-		# TODO: fix gn cross build or split + depend on dev-qt/qtwebengine-gn
-		-DINSTALL_GN=off
+		-DQT_FEATURE_qtpdf_build=OFF # TODO?
+		-DQT_FEATURE_qtpdf_quick_build=OFF
+		-DQT_FEATURE_qtpdf_widgets_build=OFF
+
+		-DQT_FEATURE_qtwebengine_build=ON
+		$(qt_feature qml qtwebengine_quick_build)
+		$(qt_feature widgets qtwebengine_wi