From e5bed722f81daa84d3d60f3787585da80ebedb0e Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 2 Mar 2026 14:08:57 +0000
Subject: [PATCH] edk2: use openssl_3_5

This reverts commit ea5785e8c4793b2b289c2a1bbacb06f9c03437c1 and uses
openssl_3_5
---
 pkgs/by-name/ed/edk2/package.nix | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index a16194894ef9..f37043b1d54e 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -57,10 +57,31 @@ stdenv.mkDerivation (finalAttrs: {
       ./fix-cross-compilation-antlr-dlg.patch
     ];
 
-    # FIXME: unvendor OpenSSL again once upstream updates
-    # to a compatible version.
-    # Upstream PR: https://github.com/tianocore/edk2/pull/10946
     postPatch = ''
+      # de-vendor OpenSSL
+      rm -r CryptoPkg/Library/OpensslLib/openssl
+      mkdir -p CryptoPkg/Library/OpensslLib/openssl
+      (
+      cd CryptoPkg/Library/OpensslLib/openssl
+      tar --strip-components=1 -xf ${buildPackages.openssl_3_5.src}
+
+      # Apply OpenSSL patches.
+      ${lib.pipe buildPackages.openssl_3_5.patches [
+        (builtins.filter (
+          patch:
+          !builtins.elem (baseNameOf patch) [
+            # Exclude patches not required in this context.
+            "nix-ssl-cert-file.patch"
+            "openssl-disable-kernel-detection.patch"
+            "use-etc-ssl-certs-darwin.patch"
+            "use-etc-ssl-certs.patch"
+          ]
+        ))
+        (map (patch: "patch -p1 < ${patch}\n"))
+        lib.concatStrings
+      ]}
+      )
+
       # enable compilation using Clang
       # https://bugzilla.tianocore.org/show_bug.cgi?id=4620
       substituteInPlace BaseTools/Conf/tools_def.template --replace-fail \