{
  stdenv,
  lib,
  srcOverride ? null,
  version ? "stable202511",
  python3,
  git,
  libuuid,
}:
let
  pythonEnv = python3.withPackages (ps: [ ps.tkinter ]);
  pname = "edk2-basetools";
  src = srcOverride;
in
stdenv.mkDerivation rec {
  inherit src pname version;

  env = {
    NIX_CFLAGS_COMPILE =
      "-Wno-return-type"
      + lib.optionalString (stdenv.cc.isGNU) " -Wno-error=stringop-truncation"
      + lib.optionalString (stdenv.hostPlatform.isDarwin) " -Wno-error=macro-redefined";
    PYTHON_COMMAND = lib.getExe pythonEnv;
    # trick taken from https://src.fedoraproject.org/rpms/edk2/blob/08f2354cd280b4ce5a7888aa85cf520e042955c3/f/edk2.spec#_319
    ${"GCC5_AARCH64_PREFIX"} = stdenv.cc.targetPrefix;

  };

  # Add required host tools if needed:
  nativeBuildInputs = [
    python3
    git
    libuuid
  ];

  # Don’t force a single root; we keep both dirs side by side
  sourceRoot = ".";

  unpackPhase = ''
    runHook preUnpack

    unpackFile "$src"

    chmod -R u+w .

    patchShebangs ./edk2

    runHook postUnpack
  '';

  # FIXME: unvendor OpenSSL again once upstream updates
  # to a compatible version.
  # Upstream PR: https://github.com/tianocore/edk2/pull/10946
  postPatch = ''
    # enable compilation using Clang
    # https://bugzilla.tianocore.org/show_bug.cgi?id=4620
    substituteInPlace edk2/BaseTools/Conf/tools_def.template --replace-fail \
      'DEFINE CLANGPDB_WARNING_OVERRIDES    = ' \
      'DEFINE CLANGPDB_WARNING_OVERRIDES    = -Wno-unneeded-internal-declaration '
      
    substituteInPlace edk2/BaseTools/Conf/tools_def.template \
      --replace "-Werror" "-Werror -Wno-error=format-security"
  '';

  buildPhase = ''
    export PYTHON_COMMAND=${python3}/bin/python
    export WORKSPACE=$PWD

    make -C ./edk2/BaseTools
  '';

  installPhase = ''
    runHook preInstall

    mkdir -vp $out
    mv -v ./edk2/BaseTools $out
    mv -v ./edk2/edksetup.sh $out
    # patchShebangs fails to see these when cross compiling
    for i in $out/BaseTools/BinWrappers/PosixLike/*; do
      chmod +x "$i"
      patchShebangs --build "$i"
    done

    runHook postInstall
  '';

  enableParallelBuilding = true;

  meta = with lib; {
    description = "ARM Trusted Firmware-A for Raspberry Pi";
    license = licenses.bsd3;
    platforms = [ "aarch64-linux" ];
    maintainers = with maintainers; [ kazenyuk ];
  };
}