This WIP patch brings the widevine useflag back to
Gentoo's chromium ebuild.  See bug #547630:

    https://547630.bugs.gentoo.org/

Using this should allow you to host the Netflix Instant Watch
application in Gentoo's standard chromium so long as the "widevine"
use-flag is set.

Quick and dirty "how to try this" recipe
________________________________________

(Warning: much of the following is untested and unlikely to be bug-free, so
don't just copy-paste all this wholesale; please take everything with a grain
of salt.)

First, save this patch as

	/tmp/chromium-ebuild-widevine.patch

Set the widevine useflag as you want it in /etc/portage/make.conf (or wherever).
	
Now, as root, run something like the following sequence of commands in bash:

# Gentoo-x86 (typically "/usr/portage")
_GX86=$( portageq get_repo_path / gentoo )

# The destination where the new ebuilds go.  For a very quick
# and dirty hack, you can just use ${_GX86}, i.e.:...
#
_OVL=${_GX86}
#
# ... although it would be way better to use an overlay if you have one.
# (the following code is all designed to accomodate either scenario).

# Iff [[ ${_OVL} != ${_GX86} ]], copy everything over from gentoo-x86's
# www-plugins/chrome-binary-plugins and www-client/chromium directories to
# the overlay.
#
if [[ ${_GX86} != ${_OVL} ]]; then
	mkdir -p ${_OVL}/www-plugins
	cp -nrv ${_GX86}/www-plugins/chrome-binary-plugins ${_OVL}/www-plugins/
	mkdir -p ${_OVL}/www-client
	cp -nrv ${_GX86}/www-client/chromium ${_OVL}/www-client/
fi
#
# ---- <NB> ----
# The above won't overwrite existing files, as a safety precaution.  If you are using
# an overlay and have previously run this code or something like it, it may
# therefore fail to copy some stuff.  So, if (and only if!!) you are not maintaining
# those overlay files by hand, you could just deep-six the whole thing before running
# the above.
#
# That way, the subsequent steps below would effectively "rebase" against the
# latest and greatest ebuilds in ${_GX86}, as if you started from scratch:
#
#    [[ ${_GX86} != ${_OVL} ]] && \
#	echo rm -rvf "${_OVL}"/www-{plugins/chrome-binary-plugins,client/chromium}
#
# (Once you'd sanity-checked the results, of course, you'd run that again, without
# the "echo", and then you'd run the un-commented block of code, above, to clone a
# fresh copy of the ${_GX86} directories into your overlay.  But, please, be careful!
# Running "rm -rvf ${any_scriptey_bash_gobbldeygook}" as root is some serious
# "without a net" tightrope-shit, as you may know from bitter past experience).
# ---- </NB> ----
#

# Download the gyp patch from bugzilla and install it into ${FILESDIR}
wget 'https://547630.bugs.gentoo.org/attachment.cgi?id=405762' -O \
	"${_OVL}"/www-client/chromium/files/chromium-widevine-2403.patch

# identify best gx86 ebuilds to use as basis
_chrome_binary_plugins=$( portageq pquery www-plugins/chrome-binary-plugins:beta::gentoo | tail -n 1)
_chrome_binary_plugins="${_GX86}/www-plugins/chrome-binary-plugins/${_chrome_binary_plugins#www-plugins/}.ebuild"
_chromium=$( portageq pquery '=www-client/chromium-44*::gentoo' | tail -n 1 )
_chromium="${_GX86}/www-client/chromium/${_chromium#www-client/}.ebuild"

# revbump/upgrade chrome-binary-plugins
cd "${_OVL}/www-plugins/chrome-binary-plugins"
cp -v "${_chrome_binary_plugins}" ./chrome-binary-plugins-44.0.2403.61_beta1.ebuild
ebuild chrome-binary-plugins-44.0.2403.61_beta1.ebuild digest clean merge

# revbump/patch chromium ebuild
cd "${_OVL}/www-client/chromium"
cp -v "${_chromium}" ./chromium-44.0.2403.61.ebuild
patch -p1 < /tmp/chromium-ebuild-widevine.patch
ebuild chromium-44.0.2403.61.ebuild digest 

# build it
ebuild chromium-44.0.2403.61.ebuild clean install

# wait ... for ... it ... 

# merge (optional)
ebuild chromium-44.0.2403.61.ebuild merge

enjoy

-gmt

--- a/chromium-44.0.2403.61.ebuild	2015-06-22 19:01:19.000000000 -0700
+++ b/chromium-44.0.2403.61.ebuild	2015-06-26 15:07:14.651612065 -0700
@@ -19,7 +19,7 @@
 LICENSE="BSD hotwording? ( no-source-code )"
 SLOT="0"
 KEYWORDS="~amd64 ~arm ~x86"
-IUSE="cups gnome gnome-keyring hidpi hotwording kerberos neon pic +proprietary-codecs pulseaudio selinux +tcmalloc"
+IUSE="cups gnome gnome-keyring hidpi hotwording kerberos neon pic +proprietary-codecs pulseaudio selinux +tcmalloc +widevine"
 RESTRICT="proprietary-codecs? ( bindist )"
 
 # Native Client binaries are compiled with different set of flags, bug #452066.
@@ -91,7 +91,8 @@
 	sys-apps/hwids[usb(+)]
 	>=sys-devel/bison-2.4.3
 	sys-devel/flex
-	virtual/pkgconfig"
+	virtual/pkgconfig
+	widevine? ( www-plugins/chrome-binary-plugins[widevine] )"
 
 # For nvidia-drivers blocker, see bug #413637 .
 RDEPEND+="
@@ -122,6 +123,9 @@
 	EBUILD_DEATH_HOOKS+=" chromium_pkg_die";
 fi
 
+# TODO: flag-mask widevine in non-intel profiles
+REQUIRED_USE="|| ( x86 amd64 !widevine )"
+
 DISABLE_AUTOFORMATTING="yes"
 DOC_CONTENTS="
 Some web pages may require additional fonts to display properly.
@@ -189,6 +193,30 @@
 	epatch "${FILESDIR}/${PN}-system-jinja-r7.patch"
 	epatch "${FILESDIR}/${PN}-hotwording-2403.patch"
 
+	# When building non-Chrome-branded linux targets,
+	# build a full widevine cdm if requested (#547630)
+	epatch "${FILESDIR}/${PN}-widevine-2403.patch"
+
+	if use widevine; then
+		local WIDEVINE_VERSION="$(< "${ROOT}/usr/$(get_libdir)/chromium-browser/widevine.version")"
+		[[ -z $WIDEVINE_VERSION ]] && die "Could not determine Widevine version."
+
+		# to build the full widevine cdm, we must provide some versioning constants:
+		local header_lines=(
+			"#include \"third_party/widevine/cdm/widevine_cdm_common.h\""
+			"#define WIDEVINE_CDM_AVAILABLE"
+			"#define WIDEVINE_CDM_VERSION_STRING \"${WIDEVINE_VERSION}\""
+		)
+
+		# inject just above widevine_cdm_version.h's last line
+		local header_line sedscript='$i'
+		for header_line in "${header_lines[@]}"; do 
+			sedscript+=${header_line}
+			sedscript+='\n'
+		done
+		sed -e "${sedscript}" -i third_party/widevine/cdm/widevine_cdm_version.h || die
+	fi
+
 	epatch_user
 
 	# Remove most bundled libraries. Some are still needed.
@@ -287,10 +315,25 @@
 		'v8/src/third_party/fdlibm' \
 		'v8/src/third_party/kernel' \
 		'v8/src/third_party/valgrind' \
+		'third_party/devscripts' \
 		--do-remove || die
 }
 
 src_configure() {
+	if use widevine; then
+		local WIDEVINE_SUPPORTED_ARCHS="x64 ia32"
+		local arch
+		for arch in ${WIDEVINE_SUPPORTED_ARCHS}; do
+			[[ -d third_party/widevine/cdm/linux/${arch} ]] \
+				|| mkdir -p third_party/widevine/cdm/linux/${arch} \
+					|| die "Could not make widevine header directory for arch \"${arch}\"."
+			cp "${ROOT}/usr/$(get_libdir)/chromium-browser/libwidevinecdm.so" \
+				third_party/widevine/cdm/widevine_cdm_*.h \
+				third_party/widevine/cdm/linux/${arch}/ \
+					|| die "Could not copy headers for Widevine."
+		done
+	fi
+
 	local myconf=""
 
 	# Never tell the build system to "enable" SSE2, it has a few unexpected
@@ -363,7 +406,8 @@
 		$(gyp_use hotwording enable_hotwording)
 		$(gyp_use kerberos)
 		$(gyp_use pulseaudio)
-		$(gyp_use tcmalloc use_allocator tcmalloc none)"
+		$(gyp_use tcmalloc use_allocator tcmalloc none)
+		$(gyp_use widevine enable_widevine)"
 
 	# Use explicit library dependencies instead of dlopen.
 	# This makes breakages easier to detect by revdep-rebuild.
@@ -583,6 +627,10 @@
 	newman out/Release/chrome.1 chromium${CHROMIUM_SUFFIX}.1 || die
 	newman out/Release/chrome.1 chromium-browser${CHROMIUM_SUFFIX}.1 || die
 
+	if use widevine; then
+		doexe out/Release/libwidevinecdmadapter.so
+	fi
+
 	# Install icons and desktop entry.
 	local branding size
 	for size in 16 22 24 32 48 64 128 256 ; do

