Merge pull request #112095 from NixOS/staging-next

Staging next

doc/languages-frameworks/qt.section.md

@@ -1,77 +1,88 @@
 # Qt {#sec-language-qt}
 
-This section describes the differences between Nix expressions for Qt libraries and applications and Nix expressions for other C++ software. Some knowledge of the latter is assumed.
+Writing Nix expressions for Qt libraries and applications is largely similar as for other C++ software.
+This section assumes some knowledge of the latter.
+There are two problems that the Nixpkgs Qt infrastructure addresses,
+which are not shared by other C++ software:
 
-There are primarily two problems which the Qt infrastructure is designed to address: ensuring consistent versioning of all dependencies and finding dependencies at runtime.
+1.  There are usually multiple supported versions of Qt in Nixpkgs.
+    All of a package's dependencies must be built with the same version of Qt.
+    This is similar to the version constraints imposed on interpreted languages like Python.
+2.  Qt makes extensive use of runtime dependency detection.
+    Runtime dependencies are made into build dependencies through wrappers.
 
 ## Nix expression for a Qt package (default.nix) {#qt-default-nix}
 
 ```{=docbook}
 <programlisting>
-{ mkDerivation, qtbase }: <co xml:id='qt-default-nix-co-1' />
+{ stdenv, lib, qtbase, wrapQtAppsHook }: <co xml:id='qt-default-nix-co-1' />
 
-mkDerivation { <co xml:id='qt-default-nix-co-2' />
+stdenv.mkDerivation {
   pname = "myapp";
   version = "1.0";
 
-  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
+  buildInputs = [ qtbase ];
+  nativeBuildInputs = [ wrapQtAppsHook ]; <co xml:id='qt-default-nix-co-2' />
 }
 </programlisting>
 
  <calloutlist>
   <callout arearefs='qt-default-nix-co-1'>
    <para>
-    Import <literal>mkDerivation</literal> and Qt (such as <literal>qtbase</literal> modules directly. <emphasis>Do not</emphasis> import Qt package sets; the Qt versions of dependencies may not be coherent, causing build and runtime failures.
+    Import Qt modules directly, that is: <literal>qtbase</literal>, <literal>qtdeclarative</literal>, etc.
+    <emphasis>Do not</emphasis> import Qt package sets such as <literal>qt5</literal>
+    because the Qt versions of dependencies may not be coherent, causing build and runtime failures.
    </para>
   </callout>
   <callout arearefs='qt-default-nix-co-2'>
-   <para>
-    Use <literal>mkDerivation</literal> instead of <literal>stdenv.mkDerivation</literal>. <literal>mkDerivation</literal> is a wrapper around <literal>stdenv.mkDerivation</literal> which applies some Qt-specific settings. This deriver accepts the same arguments as <literal>stdenv.mkDerivation</literal>; refer to <xref linkend='chap-stdenv' /> for details.
-   </para>
-   <para>
-    To use another deriver instead of <literal>stdenv.mkDerivation</literal>, use <literal>mkDerivationWith</literal>:
-<programlisting>
-mkDerivationWith myDeriver {
-  # ...
-}
-</programlisting>
-    If you cannot use <literal>mkDerivationWith</literal>, please refer to <xref linkend='qt-runtime-dependencies' />.
-   </para>
-  </callout>
-  <callout arearefs='qt-default-nix-co-3'>
-   <para>
-    <literal>mkDerivation</literal> accepts the same arguments as <literal>stdenv.mkDerivation</literal>, such as <literal>buildInputs</literal>.
-   </para>
+    <para>
+      All Qt packages must include <literal>wrapQtAppsHook</literal> in
+      <literal>nativeBuildInputs</literal>, or you must explicitly set
+      <literal>dontWrapQtApps</literal>.
+    </para>
   </callout>
  </calloutlist>
 ```
 
 ## Locating runtime dependencies {#qt-runtime-dependencies}
-Qt applications need to be wrapped to find runtime dependencies. If you cannot use `mkDerivation` or `mkDerivationWith` above, include `wrapQtAppsHook` in `nativeBuildInputs`:
+
+Qt applications must be wrapped to find runtime dependencies.
+Include `wrapQtAppsHook` in `nativeBuildInputs`:
 
 ```nix
+{ stdenv, wrapQtAppsHook }:
+
 stdenv.mkDerivation {
   # ...
-
   nativeBuildInputs = [ wrapQtAppsHook ];
 }
 ```
-Entries added to `qtWrapperArgs` are used to modify the wrappers created by `wrapQtAppsHook`. The entries are passed as arguments to [wrapProgram executable makeWrapperArgs](#fun-wrapProgram).
+
+Add entries to `qtWrapperArgs` are to modify the wrappers created by
+`wrapQtAppsHook`:
 
 ```nix
-mkDerivation {
-  # ...
+{ stdenv, wrapQtAppsHook }:
 
+stdenv.mkDerivation {
+  # ...
+  nativeBuildInputs = [ wrapQtAppsHook ];
   qtWrapperArgs = [ ''--prefix PATH : /path/to/bin'' ];
 }
 ```
 
-Set `dontWrapQtApps` to stop applications from being wrapped automatically. It is required to wrap applications manually with `wrapQtApp`, using the syntax of [wrapProgram executable makeWrapperArgs](#fun-wrapProgram):
+The entries are passed as arguments to [wrapProgram](#fun-wrapProgram).
+
+Set `dontWrapQtApps` to stop applications from being wrapped automatically.
+Wrap programs manually with `wrapQtApp`, using the syntax of
+[wrapProgram](#fun-wrapProgram):
 
 ```nix
-mkDerivation {
-  # ...
+{ stdenv, lib, wrapQtAppsHook }:
 
+stdenv.mkDerivation {
+  # ...
+  nativeBuildInputs = [ wrapQtAppsHook ];
   dontWrapQtApps = true;
   preFixup = ''
       wrapQtApp "$out/bin/myapp" --prefix PATH : /path/to/bin
@@ -79,21 +90,16 @@ mkDerivation {
 }
 ```
 
-> Note: `wrapQtAppsHook` ignores files that are non-ELF executables. This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned. An example of when you'd always need to do this is with Python applications that use PyQT.
+::: note
+`wrapQtAppsHook` ignores files that are non-ELF executables.
+This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned.
+An example of when you'd always need to do this is with Python applications that use PyQt.
+:::
 
-Libraries are built with every available version of Qt. Use the `meta.broken` attribute to disable the package for unsupported Qt versions:
-
-```nix
-mkDerivation {
-  # ...
-
-  # Disable this library with Qt &lt; 5.9.0
-  meta.broken = builtins.compareVersions qtbase.version "5.9.0" &lt; 0;
-}
-```
 ## Adding a library to Nixpkgs
-Qt libraries are added to `qt5-packages.nix` and are made available for every Qt
-version supported.
+Add Qt libraries to `qt5-packages.nix` to make them available for every
+supported Qt version.
+
 ### Example adding a Qt library {#qt-library-all-packages-nix}
 
 The following represents the contents of `qt5-packages.nix`.
@@ -106,9 +112,23 @@ The following represents the contents of `qt5-packages.nix`.
   # ...
 }
 ```
+
+Libraries are built with every available version of Qt.
+Use the `meta.broken` attribute to disable the package for unsupported Qt versions:
+
+```nix
+{ stdenv, lib, qtbase }:
+
+stdenv.mkDerivation {
+  # ...
+  # Disable this library with Qt &lt; 5.9.0
+  meta.broken = lib.versionOlder qtbase.version "5.9.0";
+}
+```
+
 ## Adding an application to Nixpkgs
-Applications that use Qt are also added to `qt5-packages.nix`. An alias is added
-in the top-level `all-packages.nix` pointing to the package with the desired Qt5 version.
+Add Qt applications to `qt5-packages.nix`. Add an alias to `all-packages.nix`
+to select the Qt 5 version used for the application.
 
 ### Example adding a Qt application {#qt-application-all-packages-nix}
 

nixos/tests/all-tests.nix

@@ -81,6 +81,7 @@ in
   corerad = handleTest ./corerad.nix {};
   couchdb = handleTest ./couchdb.nix {};
   cri-o = handleTestOn ["x86_64-linux"] ./cri-o.nix {};
+  custom-ca = handleTest ./custom-ca.nix {};
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};

nixos/tests/custom-ca.nix

@@ -0,0 +1,161 @@
+# Checks that `security.pki` options are working in curl and the main browser
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (Falkon) and WebKitGTK
+# (via Midori). The test checks that certificates issued by a custom trusted
+# CA are accepted but those from an unknown CA are rejected.
+
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+  makeCert = { caName, domain }: pkgs.runCommand "example-cert"
+  { buildInputs = [ pkgs.gnutls ]; }
+  ''
+    mkdir $out
+
+    # CA cert template
+    cat >ca.template <<EOF
+    organization = "${caName}"
+    cn = "${caName}"
+    expiration_days = 365
+    ca
+    cert_signing_key
+    crl_signing_key
+    EOF
+
+    # server cert template
+    cat >server.template <<EOF
+    organization = "An example company"
+    cn = "${domain}"
+    expiration_days = 30
+    dns_name = "${domain}"
+    encryption_key
+    signing_key
+    EOF
+
+    # generate CA keypair
+    certtool                \
+      --generate-privkey    \
+      --key-type rsa        \
+      --sec-param High      \
+      --outfile $out/ca.key
+    certtool                     \
+      --generate-self-signed     \
+      --load-privkey $out/ca.key \
+      --template ca.template     \
+      --outfile $out/ca.crt
+
+    # generate server keypair
+    certtool                    \
+      --generate-privkey        \
+      --key-type rsa            \
+      --sec-param High          \
+      --outfile $out/server.key
+    certtool                            \
+      --generate-certificate            \
+      --load-privkey $out/server.key    \
+      --load-ca-privkey $out/ca.key     \
+      --load-ca-certificate $out/ca.crt \
+      --template server.template        \
+      --outfile $out/server.crt
+  '';
+
+  example-good-cert = makeCert
+    { caName = "Example good CA";
+      domain = "good.example.com";
+    };
+
+  example-bad-cert = makeCert
+    { caName = "Unknown CA";
+      domain = "bad.example.com";
+    };
+
+in
+
+{
+  name = "custom-ca";
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+  enableOCR = true;
+
+  machine = { pkgs, ... }:
+    { imports = [ ./common/user-account.nix ./common/x11.nix ];
+
+      # chromium-based browsers refuse to run as root
+      test-support.displayManager.auto.user = "alice";
+      # browsers may hang with the default memory
+      virtualisation.memorySize = "500";
+
+      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
+      security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
+
+      services.nginx.enable = true;
+      services.nginx.virtualHosts."good.example.com" =
+        { onlySSL = true;
+          sslCertificate = "${example-good-cert}/server.crt";
+          sslCertificateKey = "${example-good-cert}/server.key";
+          locations."/".extraConfig = "return 200 'It works!';";
+        };
+      services.nginx.virtualHosts."bad.example.com" =
+        { onlySSL = true;
+          sslCertificate = "${example-bad-cert}/server.crt";
+          sslCertificateKey = "${example-bad-cert}/server.key";
+          locations."/".extraConfig = "return 200 'It does not work!';";
+        };
+
+      environment.systemPackages = with pkgs;
+        [ xdotool firefox chromium falkon midori ];
+    };
+
+  testScript = ''
+    def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+        """
+        Run a shell command as a specific user.
+        """
+        return machine.execute(f"sudo -u {user} {cmd}")
+
+
+    def wait_for_window_as(user: str, cls: str) -> None:
+        """
+        Wait until a X11 window of a given user appears.
+        """
+
+        def window_is_visible(last_try: bool) -> bool:
+            ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
+            if last_try:
+                machine.log(f"Last chance to match {cls} on the window list")
+            return ret == 0
+
+        with machine.nested("Waiting for a window to appear"):
+            retry(window_is_visible)
+
+
+    machine.start()
+
+    with subtest("Good certificate is trusted in curl"):
+        machine.wait_for_unit("nginx")
+        machine.wait_for_open_port(443)
+        machine.succeed("curl -fv https://good.example.com")
+
+    with subtest("Unknown CA is untrusted in curl"):
+        machine.fail("curl -fv https://bad.example.com")
+
+    browsers = ["firefox", "chromium", "falkon", "midori"]
+    errors = ["Security Risk", "not private", "Certificate Error", "Security"]
+
+    machine.wait_for_x()
+    for browser, error in zip(browsers, errors):
+        with subtest("Good certificate is trusted in " + browser):
+            execute_as(
+                "alice", f"env P11_KIT_DEBUG=trust {browser} https://good.example.com & >&2"
+            )
+            wait_for_window_as("alice", browser)
+            machine.wait_for_text("It works!")
+            machine.screenshot("good" + browser)
+            execute_as("alice", "xdotool key ctrl+w")  # close tab
+
+        with subtest("Unknown CA is untrusted in " + browser):
+            execute_as("alice", f"{browser} https://bad.example.com & >&2")
+            machine.wait_for_text(error)
+            machine.screenshot("bad" + browser)
+            machine.succeed("pkill " + browser)
+  '';
+})

pkgs/applications/audio/csound/csound-qt/default.nix

@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
                  "SHARE_DIR=${placeholder "out"}/share"
                  ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "CsoundQt is a frontend for Csound with editor, integrated help, widgets and other features";
     homepage = "https://csoundqt.github.io/";

pkgs/applications/audio/keyfinder/default.nix

@@ -20,6 +20,8 @@ mkDerivation rec {
        --replace "\$\$[QT_INSTALL_PREFIX]" "$out"
   '';
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Musical key detection for digital audio (graphical UI)";
     longDescription = ''

pkgs/applications/audio/kmetronome/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ alsaLib drumstick qtbase qtsvg ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://kmetronome.sourceforge.io/";
     description = "ALSA MIDI metronome with Qt interface";

pkgs/applications/audio/mopidy/somafm.nix

@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
-    homepage = https://www.mopidy.com/;
+    homepage = "https://www.mopidy.com/";
     description = "Mopidy extension for playing music from SomaFM";
     license = licenses.mit;
     maintainers = [ maintainers.nickhu ];

pkgs/applications/audio/nootka/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     "-DENABLE_PULSEAUDIO=ON"
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Application for practicing playing musical scores and ear training";
     homepage = "https://nootka.sourceforge.io/";

pkgs/applications/audio/nootka/unstable.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     qtbase qtdeclarative qtquickcontrols2
   ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     "-DCMAKE_INCLUDE_PATH=${libjack2}/include/jack;${libpulseaudio.dev}/include/pulse"
     "-DENABLE_JACK=ON"

pkgs/applications/audio/ocenaudio/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   dontUnpack = true;
   dontBuild = true;
   dontStrip = true;
+  dontWrapQtApps = true;
 
   installPhase = ''
     mkdir -p $out

pkgs/applications/audio/playbar2/default.nix

@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     kwindowsystem
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Mpris2 Client for Plasma5";
     homepage = "https://github.com/audoban/PlayBar2";

pkgs/applications/audio/seq66/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://github.com/ahlstromcj/seq66";
     description = "Loop based midi sequencer with Qt GUI derived from seq24 and sequencer64";

pkgs/applications/audio/spectmorph/default.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Allows to analyze samples of musical instruments, and to combine them (morphing) to construct hybrid sounds";
     homepage = "http://spectmorph.org";

pkgs/applications/blockchains/bitcoin-classic.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   meta = {
     description = "Peer-to-peer electronic cash system (Classic client)";
     longDescription= ''

pkgs/applications/display-managers/lightdm/default.nix

@@ -101,6 +101,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  dontWrapQtApps = true;
+
   preConfigure = "NOCONFIGURE=1 ./autogen.sh";
 
   configureFlags = [

pkgs/applications/editors/code-browser/default.nix

@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals withQt [ "UI=qt" ]
   ++ lib.optionals withGtk [ "UI=gtk" ];
+
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Folding text editor, designed to hierarchically structure any kind of text file and especially source code";
     homepage = "https://tibleiz.net/code-browser/";

pkgs/applications/editors/kdevelop5/kdev-php.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ kdevelop-pg-qt threadweaver ktexteditor kdevelop-unwrapped ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.aanderse ];
     platforms = platforms.linux;

pkgs/applications/editors/kdevelop5/kdev-python.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ threadweaver ktexteditor kdevelop-unwrapped ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.aanderse ];
     platforms = platforms.linux;

pkgs/applications/editors/kdevelop5/kdevelop-pg-qt.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qtbase ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.ambrop72 ];
     platforms = platforms.linux;

pkgs/applications/editors/qxmledit/default.nix

@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
     export QXMLEDIT_INST_DOC_DIR="$doc"
   '';
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Simple XML editor based on qt libraries" ;
     homepage = "https://sourceforge.net/projects/qxmledit";

pkgs/applications/misc/gpsbabel/default.nix

@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   doCheck = true;
   preCheck = ''
     patchShebangs testo

pkgs/applications/misc/gpsbabel/gui.nix

@@ -10,6 +10,8 @@ mkDerivation {
   nativeBuildInputs = [ qmake qttools ];
   buildInputs = [ qtwebkit ];
 
+  dontWrapQtApps = true;
+
   postPatch = ''
     substituteInPlace mainwindow.cc \
       --replace "QApplication::applicationDirPath() + \"/" "\"" \

pkgs/applications/misc/plasma-applet-volumewin7mixer/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ plasma-framework kwindowsystem plasma-pa ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "A fork of the default volume plasmoid with a Windows 7 theme (vertical sliders)";
     homepage = "https://github.com/Zren/plasma-applet-volumewin7mixer";

pkgs/applications/misc/redis-desktop-manager/default.nix

@@ -32,6 +32,7 @@ mkDerivation rec {
   ];
 
   dontUseQmakeConfigure = true;
+  dontWrapQtApps = true;
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated" ];
 

pkgs/applications/misc/redshift-plasma-applet/default.nix

@@ -35,6 +35,8 @@ stdenv.mkDerivation {
     kwindowsystem
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "KDE Plasma 5 widget for controlling Redshift";
     homepage = "https://github.com/kotelnik/plasma-applet-redshift-control";

pkgs/applications/misc/subsurface/default.nix

@@ -52,6 +52,8 @@ let
 
     buildInputs = [ qtbase qtlocation libXcomposite ];
 
+    dontWrapQtApps = true;
+
     pluginsSubdir = "lib/qt-${qtbase.qtCompatVersion}/plugins";
 
     installPhase = ''

pkgs/applications/networking/irc/communi/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   preConfigure = ''
     export QMAKEFEATURES=${libcommuni}/features
   '';

pkgs/applications/office/cb2bib/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
     runHook postConfigure
   '';
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Rapidly extract unformatted, or unstandardized bibliographic references from email alerts, journal Web pages and PDF files";
     homepage = "http://www.molspaces.com/d_cb2bib-overview.php";

pkgs/applications/radio/gnuradio/default.nix

@@ -218,6 +218,7 @@ let
     passthru
     doCheck
     dontWrapPythonPrograms
+    dontWrapQtApps
     meta
   ;
   cmakeFlags = shared.cmakeFlags
@@ -283,6 +284,7 @@ stdenv.mkDerivation rec {
     passthru
     doCheck
     dontWrapPythonPrograms
+    dontWrapQtApps
     meta
   ;
 }

pkgs/applications/radio/gnuradio/shared.nix

@@ -109,6 +109,7 @@ rec {
   };
   # Wrapping is done with an external wrapper
   dontWrapPythonPrograms = true;
+  dontWrapQtApps = true;
   # Tests should succeed, but it's hard to get LD_LIBRARY_PATH right in order
   # for it to happen.
   doCheck = false;

pkgs/applications/radio/unixcw/default.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   buildInputs = [libpulseaudio alsaLib pkg-config qt5.qtbase];
   CFLAGS   ="-lasound -lpulse-simple";
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "sound characters as Morse code on the soundcard or console speaker";
     longDescription = ''

pkgs/applications/science/biology/last/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1170";
+  version = "1178";
 
   src = fetchurl {
     url = "http://last.cbrc.jp/last-${version}.zip";
-    sha256 = "sha256-hBuG6QGXtBrvNrtaZU+i8gxu2ZQw+srFRkbuWoL5JHc=";
+    sha256 = "sha256-LihTYXiYCHAFZaWDb2MqN+RvHayGSyZd3vJf4TVCu3A=";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/science/logic/mcrl2/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libGLU libGL qt5.qtbase boost ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "A toolset for model-checking concurrent systems and protocols";
     longDescription = ''

pkgs/applications/version-management/bcompare/default.nix

@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
 
   dontBuild = true;
   dontConfigure = true;
+  dontWrapQtApps = true;
 
   meta = with lib; {
     description = "GUI application that allows to quickly and easily compare files and folders";

pkgs/applications/version-management/git-and-tools/svn-all-fast-export/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation {
 
   NIX_LDFLAGS = "-lsvn_fs-1";
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://github.com/svn-all-fast-export/svn2git";
     description = "A fast-import based converter for an svn repo to git repos";

pkgs/applications/video/obs-studio/obs-ndi.nix

@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
     "-DCMAKE_CXX_FLAGS=-I${obs-studio.src}/UI/obs-frontend-api"
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Network A/V plugin for OBS Studio";
     homepage = "https://github.com/Palakis/obs-ndi";

pkgs/applications/video/obs-studio/v4l2sink.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ qtbase obs-studio ];
 
+  dontWrapQtApps = true;
+
   patches = [
     # Fixes the segfault when stopping the plugin
     (fetchpatch {

pkgs/applications/video/openshot-qt/libopenshot.nix

@@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
     ++ optional stdenv.isDarwin llvmPackages.openmp
   ;
 
+  dontWrapQtApps = true;
+
   LIBOPENSHOT_AUDIO_DIR = libopenshot-audio;
   "UNITTEST++_INCLUDE_DIR" = "${unittest-cpp}/include/UnitTest++";
 

pkgs/build-support/setup-hooks/patch-shebangs.sh

@@ -24,10 +24,10 @@ fixupOutputHooks+=(patchShebangsAuto)
 patchShebangs() {
     local pathName
 
-    if [ "$1" = "--host" ]; then
+    if [[ "$1" == "--host" ]]; then
         pathName=HOST_PATH
         shift
-    elif [ "$1" = "--build" ]; then
+    elif [[ "$1" == "--build" ]]; then
         pathName=PATH
         shift
     fi
@@ -41,7 +41,7 @@ patchShebangs() {
     local oldInterpreterLine
     local newInterpreterLine
 
-    if [ $# -eq 0 ]; then
+    if [[ $# -eq 0 ]]; then
         echo "No arguments supplied to patchShebangs" >&2
         return 0
     fi
@@ -50,29 +50,29 @@ patchShebangs() {
     while IFS= read -r -d $'\0' f; do
         isScript "$f" || continue
 
-        oldInterpreterLine=$(head -1 "$f" | tail -c+3)
-        read -r oldPath arg0 args <<< "$oldInterpreterLine"
+        read -r oldInterpreterLine < "$f"
+        read -r oldPath arg0 args <<< "${oldInterpreterLine:2}"
 
-        if [ -z "$pathName" ]; then
-            if [ -n "$strictDeps" ] && [[ "$f" = "$NIX_STORE"* ]]; then
+        if [[ -z "$pathName" ]]; then
+            if [[ -n $strictDeps && $f == "$NIX_STORE"* ]]; then
                 pathName=HOST_PATH
             else
                 pathName=PATH
             fi
         fi
 
-        if $(echo "$oldPath" | grep -q "/bin/env$"); then
+        if [[ "$oldPath" == *"/bin/env" ]]; then
             # Check for unsupported 'env' functionality:
             # - options: something starting with a '-'
             # - environment variables: foo=bar
-            if $(echo "$arg0" | grep -q -- "^-.*\|.*=.*"); then
+            if [[ $arg0 == "-"* || $arg0 == *"="* ]]; then
                 echo "$f: unsupported interpreter directive \"$oldInterpreterLine\" (set dontPatchShebangs=1 and handle shebang patching yourself)" >&2
                 exit 1
             fi
 
             newPath="$(PATH="${!pathName}" command -v "$arg0" || true)"
         else
-            if [ "$oldPath" = "" ]; then
+            if [[ -z $oldPath ]]; then
                 # If no interpreter is specified linux will use /bin/sh. Set
                 # oldpath="/bin/sh" so that we get /nix/store/.../sh.
                 oldPath="/bin/sh"
@@ -84,19 +84,19 @@ patchShebangs() {
         fi
 
         # Strip trailing whitespace introduced when no arguments are present
-        newInterpreterLine="$(echo "$newPath $args" | sed 's/[[:space:]]*$//')"
+        newInterpreterLine="$newPath $args"
+        newInterpreterLine=${newInterpreterLine%${newInterpreterLine##*[![:space:]]}}
 
-        if [ -n "$oldPath" -a "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]; then
-            if [ -n "$newPath" -a "$newPath" != "$oldPath" ]; then
+        if [[ -n "$oldPath" && "${oldPath:0:${#NIX_STORE}}" != "$NIX_STORE" ]]; then
+            if [[ -n "$newPath" && "$newPath" != "$oldPath" ]]; then
                 echo "$f: interpreter directive changed from \"$oldInterpreterLine\" to \"$newInterpreterLine\""
                 # escape the escape chars so that sed doesn't interpret them
-                escapedInterpreterLine=$(echo "$newInterpreterLine" | sed 's|\\|\\\\|g')
+                escapedInterpreterLine=${newInterpreterLine//\\/\\\\}
+
                 # Preserve times, see: https://github.com/NixOS/nixpkgs/pull/33281
-                timestamp=$(mktemp)
-                touch -r "$f" "$timestamp"
+                timestamp=$(stat --printf "%y" "$f")
                 sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" "$f"
-                touch -r "$timestamp" "$f"
-                rm "$timestamp"
+                touch --date "$timestamp" "$f"
             fi
         fi
     done < <(find "$@" -type f -perm -0100 -print0)
@@ -105,12 +105,12 @@ patchShebangs() {
 }
 
 patchShebangsAuto () {
-    if [ -z "${dontPatchShebangs-}" -a -e "$prefix" ]; then
+    if [[ -z "${dontPatchShebangs-}" && -e "$prefix" ]]; then
 
         # Dev output will end up being run on the build platform. An
         # example case of this is sdl2-config. Otherwise, we can just
         # use the runtime path (--host).
-        if [ "$output" != out ] && [ "$output" = "$outputDev" ]; then
+        if [[ "$output" != out && "$output" = "$outputDev" ]]; then
             patchShebangs --build "$prefix"
         else
             patchShebangs --host "$prefix"

pkgs/data/icons/maia-icon-theme/default.nix

@@ -35,6 +35,8 @@ stdenv.mkDerivation {
 
   dontDropIconThemeCache = true;
 
+  dontWrapQtApps = true;
+
   postInstall = ''
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme

pkgs/development/interpreters/python/hooks/pytest-check-hook.sh

@@ -37,12 +37,12 @@ function pytestCheckPhase() {
         disabledTestsString=$(_pytestComputeDisabledTestsString "${disabledTests[@]}")
       args+=" -k \""$disabledTestsString"\""
     fi
-    for file in "${disabledTestFiles[@]}"; do
+    for file in ${disabledTestFiles[@]}; do
       if [ ! -f "$file" ]; then
         echo "Disabled test file \"$file\" does not exist. Aborting"
         exit 1
       fi
-      args+=" --ignore=$file"
+      args+=" --ignore=\"$file\""
     done
     args+=" ${pytestFlagsArray[@]}"
     eval "@pythonCheckInterpreter@ $args"

pkgs/development/interpreters/supercollider/default.nix

@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
       ++ optional (!stdenv.isDarwin) alsaLib
       ++ optional useSCEL emacs;
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Programming language for real time audio synthesis";
     homepage = "https://supercollider.github.io";

pkgs/development/libraries/aqbanking/gwenhywfar.nix

@@ -57,6 +57,8 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ gtk2 gtk3 qt5.qtbase gnutls openssl libgcrypt libgpgerror ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "OS abstraction functions used by aqbanking and related tools";
     homepage = "http://www2.aquamaniac.de/sites/download/packages.php?package=01&showall=1";

pkgs/development/libraries/audio/suil/default.nix

@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
     ++ (lib.optionals withQt4 [ qt4 ])
     ++ (lib.optionals withQt5 (with qt5; [ qtbase qttools ]));
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "http://drobilla.net/software/suil";
     description = "A lightweight C library for loading and wrapping LV2 plugin UIs";

pkgs/development/libraries/dxflib/default.nix

@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     qmake
   ];
+  dontWrapQtApps = true;
   preConfigure = ''
     sed -i 's/CONFIG += staticlib/CONFIG += shared/' dxflib.pro
   '';

pkgs/development/libraries/g2o/default.nix

@@ -23,6 +23,8 @@ mkDerivation rec {
   # Silence noisy warning
   CXXFLAGS = "-Wno-deprecated-copy";
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     # Detection script is broken
     "-DQGLVIEWER_INCLUDE_DIR=${libqglviewer}/include/QGLViewer"

pkgs/development/libraries/gcr/default.nix

@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gcr";
-  version = "3.38.0";
+  version = "3.38.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1q97pba4bzjndm1vlvicyv8mrl0n589qsw71dp8jrz2payvcfk56";
+    sha256 = "F/yvnEqTpl+xxyuCZDuxAsEzRAhGh9WIbqZjE4aNnsk=";
   };
 
   postPatch = ''

pkgs/development/libraries/gecode/default.nix

@@ -12,6 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
+  dontWrapQtApps = true;
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ perl gmp mpfr ]
     ++ lib.optional enableGist qtbase;

pkgs/development/libraries/geos/default.nix

@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, python }:
 
 stdenv.mkDerivation rec {
-  name = "geos-3.8.1";
+  name = "geos-3.9.0";
 
   src = fetchurl {
     url = "https://download.osgeo.org/geos/${name}.tar.bz2";
-    sha256 = "1xqpmr10xi0n9sj47fbwc89qb0yr9imh4ybk0jsxpffy111syn22";
+    sha256 = "sha256-vYCCzxL0XydjAZPHi9taPLqEe4HnKyAmg1bCpPwGUmk=";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/gnutls/default.nix

@@ -1,5 +1,5 @@
 { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip
-, perl, gmp, autoconf, autogen, automake, libidn, p11-kit, libiconv
+, perl, gmp, autoconf, automake, libidn, p11-kit, libiconv
 , unbound, dns-root-data, gettext, cacert, util-linux
 , guileBindings ? config.gnutls.guile or false, guile
 , tpmSupport ? false, trousers, which, nettools, libunistring
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ lzo lzip libtasn1 libidn p11-kit zlib gmp autogen libunistring unbound gettext libiconv ]
+  buildInputs = [ lzo lzip libtasn1 libidn p11-kit zlib gmp libunistring unbound gettext libiconv ]
     ++ lib.optional (isDarwin && withSecurity) Security
     ++ lib.optional (tpmSupport && stdenv.isLinux) trousers
     ++ lib.optional guileBindings guile;

pkgs/development/libraries/gpgme/default.nix

@@ -49,6 +49,8 @@ stdenv.mkDerivation rec {
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
+  dontWrapQtApps = true;
+
   configureFlags = [
     "--enable-fixed-path=${gnupg}/bin"
     "--with-libgpg-error-prefix=${libgpgerror.dev}"

pkgs/development/libraries/gsasl/default.nix

@@ -1,11 +1,11 @@
 { fetchurl, lib, stdenv, libidn, kerberos }:
 
 stdenv.mkDerivation rec {
-  name = "gsasl-1.8.0";
+  name = "gsasl-1.10.0";
 
   src = fetchurl {
     url = "mirror://gnu/gsasl/${name}.tar.gz";
-    sha256 = "1rci64cxvcfr8xcjpqc4inpfq7aw4snnsbf5xz7d30nhvv8n40ii";
+    sha256 = "sha256-hby9juYJWt54cCY6KOvLiDL1Qepzk5dUlJJgFcB1aNM=";
   };
 
   buildInputs = [ libidn kerberos ];

pkgs/development/libraries/imlib2/default.nix

@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "imlib2";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
-    sha256 = "0zdk4afdrrr1539f2q15zja19j4wwfmpswzws2ffgflcnhywlxhr";
+    sha256 = "sha256-AzpqY53LyOA/Zf8F5XBo5zRtUO4vL/8wS7kJWhsrxAc=";
   };
 
   buildInputs = [

pkgs/development/libraries/kde-frameworks/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/frameworks/5.76/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/frameworks/5.78/ -A '*.tar.xz' )

pkgs/development/libraries/kde-frameworks/kcompletion.nix

@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation, lib, fetchpatch,
   extra-cmake-modules,
   kconfig, kwidgetsaddons, qtbase, qttools
 }:
@@ -7,6 +7,13 @@
 mkDerivation {
   name = "kcompletion";
   meta = { maintainers = [ lib.maintainers.ttuegel ]; };
+  patches = [
+    # https://mail.kde.org/pipermail/distributions/2021-January/000928.html
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/kcompletion/commit/7acda936f06193e9fc85ae5cf9ccc8d65971f657.patch";
+      sha256 = "150ff506rhr5pin5363ks222vhv8qd77y5s5nyylcbdjry3ljd3n";
+    })
+  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ kconfig kwidgetsaddons qttools ];
   propagatedBuildInputs = [ qtbase ];

pkgs/development/libraries/kde-frameworks/kguiaddons.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules,
-  qtbase, qtx11extras,
+  qtbase, qtx11extras, wayland,
 }:
 
 mkDerivation {
@@ -11,7 +11,7 @@ mkDerivation {
     broken = builtins.compareVersions qtbase.version "5.7.0" < 0;
   };
   nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ qtx11extras ];
+  buildInputs = [ qtx11extras wayland ];
   propagatedBuildInputs = [ qtbase ];
   outputs = [ "out" "dev" ];
 }

pkgs/development/libraries/kde-frameworks/kio/default.nix

@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation, lib, fetchpatch,
   extra-cmake-modules, kdoctools, qttools,
   karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
   kdbusaddons, ki18n, kiconthemes, kitemviews, kjobwidgets, knotifications,
@@ -24,5 +24,10 @@ mkDerivation {
   patches = [
     ./samba-search-path.patch
     ./kio-debug-module-loader.patch
+    # https://mail.kde.org/pipermail/distributions/2021-February/000938.html
+    (fetchpatch {
+      url = "https://invent.kde.org/frameworks/kio/commit/a183dd0d1ee0659e5341c7cb4117df27edd6f125.patch";
+      sha256 = "1msnzi93zggxgarx962gnlz1slx13nc3l54wib3rdlj0xnnlfdnd";
+    })
   ];
 }

pkgs/development/libraries/kpmcore/default.nix

@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ extra-cmake-modules ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = with lib.maintainers; [ peterhoeg ];
     # The build requires at least Qt 5.14:

pkgs/development/libraries/libaom/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libaom";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchgit {
     url = "https://aomedia.googlesource.com/aom";
     rev	= "v${version}";
-    sha256 = "1616xjhj6770ykn82ml741h8hx44v507iky3s9h7a5lnk9d4cxzy";
+    sha256 = "1vakwmcwvmmrdw7460m8hzq96y71lxqix8b2g07c6s12br0rrdhl";
   };
 
   patches = [ ./outputs.patch ];

pkgs/development/libraries/libcommuni/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   dontUseQmakeConfigure = true;
   configureFlags = [ "-config" "release" ];
 
+  dontWrapQtApps = true;
+
   preConfigure = ''
     sed -i -e 's|/bin/pwd|pwd|g' configure
   '';

pkgs/development/libraries/libdbusmenu-qt/default.nix

@@ -20,6 +20,8 @@ stdenv.mkDerivation {
 
   cmakeFlags = [ "-DWITH_DOC=OFF" ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Provides a Qt implementation of the DBusMenu spec";
     inherit homepage;

pkgs/development/libraries/libdbusmenu-qt/qt-5.5.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DWITH_DOC=OFF" ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://launchpad.net/libdbusmenu-qt";
     description = "Provides a Qt implementation of the DBusMenu spec";

pkgs/development/libraries/libgcrypt/default.nix

@@ -6,11 +6,11 @@ assert enableCapabilities -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.8.7";
+  version = "1.9.1";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    sha256 = "0j27jxhjay78by940d64778nxwbysxynv5mq6iq1nmlrh810zdq3";
+    sha256 = "1nb50bgzp83q6r5cz4v40y1mcbhpqwqyxlay87xp1lrbkf5pm9n5";
   };
 
   outputs = [ "out" "dev" "info" ];

pkgs/development/libraries/libgpg-error/default.nix

@@ -17,11 +17,11 @@
   };
 in stdenv.mkDerivation (rec {
   pname = "libgpg-error";
-  version = "1.38";
+  version = "1.41";
 
   src = fetchurl {
     url = "mirror://gnupg/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "00px79xzyc5lj8aig7i4fhk29h1lkqp4840wjfgi9mv9m9sq566q";
+    sha256 = "0hi7jbcs1l9kxzhiqcs2iivsb048642mwaimgqyh1hy3bas7ic34";
   };
 
   postPatch = ''
@@ -66,7 +66,8 @@ in stdenv.mkDerivation (rec {
   doCheck = true; # not cross
 
   meta = with lib; {
-    homepage = "https://www.gnupg.org/related_software/libgpg-error/index.html";
+    homepage = "https://www.gnupg.org/software/libgpg-error/index.html";
+    changelog = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;hb=refs/tags/libgpg-error-${version}";
     description = "A small library that defines common error values for all GnuPG components";
 
     longDescription = ''

pkgs/development/libraries/libimagequant/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libimagequant";
-  version = "2.13.1";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "ImageOptim";
     repo = pname;
     rev = version;
-    sha256 = "1543h1i59k2hbj2g8shcl8fvhz2silipacynwjgw412r38hkr33j";
+    sha256 = "sha256-XP/GeZC8TCgBPqtScY9eneZHFter1kdWf/yko0p2VYQ=";
   };
 
   preConfigure = ''

pkgs/development/libraries/libktorrent/default.nix

@@ -27,6 +27,8 @@ in stdenv.mkDerivation rec {
     inherit mainVersion;
   };
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "A BitTorrent library used by KTorrent";
     homepage    = "https://www.kde.org/applications/internet/ktorrent/";

pkgs/development/libraries/liblastfm/default.nix

@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ fftwSinglePrec libsamplerate qtbase ]
     ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.SystemConfiguration;
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://github.com/lastfm/liblastfm";
     repositories.git = "git://github.com/lastfm/liblastfm.git";

pkgs/development/libraries/libnftnl/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, pkg-config, libmnl }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.8";
+  version = "1.1.9";
   pname = "libnftnl";
 
   src = fetchurl {
     url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "04dp797llg3cqzivwrql30wg9mfr0ngnp0v5gs7jcdmp11dzm8q4";
+    sha256 = "16jbp4fs5dz2yf4c3bl1sb48x9x9wi1chv39zwmfgya1k9pimcp9";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/development/libraries/libqglviewer/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ qtbase libGLU ]
     ++ lib.optional stdenv.isDarwin AGL;
 
+  dontWrapQtApps = true;
+
   postPatch = ''
     cd QGLViewer
   '';

pkgs/development/libraries/libshout/default.nix

@@ -4,11 +4,11 @@
 # need pkg-config so that libshout installs ${out}/lib/pkgconfig/shout.pc
 
 stdenv.mkDerivation rec {
-  name = "libshout-2.4.4";
+  name = "libshout-2.4.5";
 
   src = fetchurl {
     url = "http://downloads.xiph.org/releases/libshout/${name}.tar.gz";
-    sha256 = "1hz670a4pfpsb89b0mymy8nw4rx8x0vmh61gq6j1vbg70mfhrscc";
+    sha256 = "sha256-2eVoZopnOZTr4/HrXyvuBuMjal25K40MSH4cD4hqaJA=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/libwacom/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libwacom";
-  version = "1.7";
+  version = "1.8";
 
   outputs = [ "out" "dev" ];
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${version}";
-    sha256 = "sha256-kF4Q3ACiVlUbEjS2YqwHA42QknKMLqX9US31PmXtS/I=";
+    sha256 = "sha256-vkBkOE4aVX/6xKjslkqlZkh5jdYVEawvvBLpj8PpuiA=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja doxygen ];

pkgs/development/libraries/libxkbcommon/default.nix

@@ -2,6 +2,8 @@
 , xkeyboard_config, libxcb, libxml2
 , python3
 , libX11
+# To enable the "interactive-wayland" subcommand of xkbcli:
+, withWaylandSupport ? false, wayland, wayland-protocols
 }:
 
 stdenv.mkDerivation rec {
@@ -13,18 +15,23 @@ stdenv.mkDerivation rec {
     sha256 = "0lmwglj16anhpaq0h830xsl1ivknv75i4lir9bk88aq73s2jy852";
   };
 
+  patches = [
+    ./fix-cross-compilation.patch
+  ];
+
   outputs = [ "out" "dev" "doc" ];
 
-  nativeBuildInputs = [ meson ninja pkg-config yacc doxygen ];
-  buildInputs = [ xkeyboard_config libxcb libxml2 ];
+  nativeBuildInputs = [ meson ninja pkg-config yacc doxygen ]
+    ++ lib.optional withWaylandSupport wayland;
+  buildInputs = [ xkeyboard_config libxcb libxml2 ]
+    ++ lib.optionals withWaylandSupport [ wayland wayland-protocols ];
   checkInputs = [ python3 ];
 
   mesonFlags = [
     "-Dxkb-config-root=${xkeyboard_config}/etc/X11/xkb"
     "-Dxkb-config-extra-path=/etc/xkb" # default=$sysconfdir/xkb ($out/etc)
     "-Dx-locale-root=${libX11.out}/share/X11/locale"
-    "-Denable-wayland=false"
-    "-Denable-xkbregistry=false" # Optional, separate library (TODO: Install into extra output)
+    "-Denable-wayland=${lib.boolToString withWaylandSupport}"
   ];
 
   doCheck = true;

pkgs/development/libraries/libxkbcommon/fix-cross-compilation.patch

@@ -0,0 +1,20 @@
+diff --git a/meson.build b/meson.build
+index 47c436f..536c60b 100644
+--- a/meson.build
++++ b/meson.build
+@@ -440,13 +440,12 @@ if build_tools
+     if get_option('enable-wayland')
+         wayland_client_dep = dependency('wayland-client', version: '>=1.2.0', required: false)
+         wayland_protocols_dep = dependency('wayland-protocols', version: '>=1.12', required: false)
+-        wayland_scanner_dep = dependency('wayland-scanner', required: false, native: true)
+-        if not wayland_client_dep.found() or not wayland_protocols_dep.found() or not wayland_scanner_dep.found()
++        if not wayland_client_dep.found() or not wayland_protocols_dep.found()
+             error('''The Wayland xkbcli programs require wayland-client >= 1.2.0, wayland-protocols >= 1.7 which were not found.
+ You can disable the Wayland xkbcli programs with -Denable-wayland=false.''')
+         endif
+ 
+-        wayland_scanner = find_program(wayland_scanner_dep.get_pkgconfig_variable('wayland_scanner'))
++        wayland_scanner = find_program('wayland-scanner', native: true)
+         wayland_scanner_code_gen = generator(
+             wayland_scanner,
+             output: '@BASENAME@-protocol.c',

pkgs/development/libraries/libxslt/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, gettext, python, libgcrypt
+{ lib, stdenv, fetchurl, fetchpatch, libxml2, findXMLCatalogs, gettext, python3, libgcrypt
 , cryptoSupport ? false
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 }:
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libxml2.dev ]
     ++ lib.optional stdenv.isDarwin gettext
-    ++ lib.optionals pythonSupport [ libxml2.py python ]
+    ++ lib.optionals pythonSupport [ libxml2.py python3 ]
     ++ lib.optionals cryptoSupport [ libgcrypt ];
 
   propagatedBuildInputs = [ findXMLCatalogs ];
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "--without-debug"
     "--without-mem-debug"
     "--without-debugger"
-  ] ++ lib.optional pythonSupport "--with-python=${python}"
+  ] ++ lib.optional pythonSupport "--with-python=${python3}"
     ++ lib.optional (!cryptoSupport) "--without-crypto";
 
   postFixup = ''
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString pythonSupport ''
     mkdir -p $py/nix-support
     echo ${libxml2.py} >> $py/nix-support/propagated-build-inputs
-    moveToOutput ${python.libPrefix} "$py"
+    moveToOutput ${python3.libPrefix} "$py"
   '';
 
   passthru = {

pkgs/development/libraries/libzip/default.nix

@@ -1,20 +1,27 @@
-{ lib, stdenv, fetchurl, cmake, perl, zlib }:
+{ lib, stdenv
+, cmake
+, fetchpatch
+, fetchurl
+, perl
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "libzip";
-  version = "1.6.1";
+  version = "1.7.3";
 
   src = fetchurl {
     url = "https://www.nih.at/libzip/${pname}-${version}.tar.gz";
-    sha256 = "120xgf7cgjmz9d3yp10lks6lhkgxqb4skbmbiiwf46gx868qxsq6";
+    sha256 = "1k5rihiz7m1ahhjzcbq759hb9crzqkgw78pkxga118y5a32pc8hf";
   };
 
-  # Fix pkg-config file paths
-  postPatch = ''
-    sed -i CMakeLists.txt \
-      -e 's#\\''${exec_prefix}/''${CMAKE_INSTALL_LIBDIR}#''${CMAKE_INSTALL_FULL_LIBDIR}#' \
-      -e 's#\\''${prefix}/''${CMAKE_INSTALL_INCLUDEDIR}#''${CMAKE_INSTALL_FULL_INCLUDEDIR}#'
-  '';
+  # Remove in next release
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/nih-at/libzip/commit/351201419d79b958783c0cfc7c370243165523ac.patch";
+      sha256 = "0d93z98ki0yiaza93268cxkl35y1r7ll9f7l8sivx3nfxj2c1n8a";
+    })
+  ];
 
   outputs = [ "out" "dev" ];
 

pkgs/development/libraries/mesa/default.nix

@@ -31,7 +31,7 @@ with lib;
 let
   # Release calendar: https://www.mesa3d.org/release-calendar.html
   # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.3.3";
+  version = "20.3.4";
   branch  = versions.major version;
 in
 
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
     ];
-    sha256 = "0mnic7mfv5lgnn3swj7lbif8bl8pi2czlgr01jhq5s9q90nj2kpp";
+    sha256 = "1120kf280hg4h0a2505vxf6rdw8r2ydl3cg4iwkmpx0zxj3sj8fw";
   };
 
   prePatch = "patchShebangs .";

pkgs/development/libraries/nss/default.nix

@@ -1,4 +1,7 @@
-{ lib, stdenv, fetchurl, nspr, perl, zlib, sqlite, darwin, fixDarwinDylibNames, buildPackages, ninja
+{ lib, stdenv, fetchurl, nspr, perl, zlib
+, sqlite, ninja
+, darwin, fixDarwinDylibNames, buildPackages
+, useP11kit ? true, p11-kit
 , # allow FIPS mode. Note that this makes the output non-reproducible.
   # https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6
   enableFIPS ? false
@@ -139,6 +142,11 @@ in stdenv.mkDerivation rec {
     chmod 0755 $out/bin/nss-config
   '';
 
+  postInstall = lib.optionalString useP11kit ''
+    # Replace built-in trust with p11-kit connection
+    ln -sf ${p11-kit}/lib/pkcs11/p11-kit-trust.so $out/lib/libnssckbi.so
+  '';
+
   postFixup = let
     isCross = stdenv.hostPlatform != stdenv.buildPlatform;
     nss = if isCross then buildPackages.nss.tools else "$out";

pkgs/development/libraries/opencsg/default.nix

@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
     rmdir $out/bin || true
   '';
 
+  dontWrapQtApps = true;
+
   postFixup = lib.optionalString stdenv.isDarwin ''
     app=$out/Applications/opencsgexample.app/Contents/MacOS/opencsgexample
     install_name_tool -change \

pkgs/development/libraries/phonon/backends/gstreamer.nix

@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
   # on system paths being set.
   patches = [ ./gst-plugin-paths.patch ];
 
+  dontWrapQtApps = true;
+
   NIX_CFLAGS_COMPILE =
     let gstPluginPaths =
           lib.makeSearchPathOutput "lib" "/lib/gstreamer-1.0"

pkgs/development/libraries/phonon/backends/vlc.nix

@@ -35,6 +35,8 @@ stdenv.mkDerivation rec {
     extra-cmake-modules
   ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
   ];

pkgs/development/libraries/phonon/default.nix

@@ -58,6 +58,8 @@ stdenv.mkDerivation rec {
     "-DCMAKE_BUILD_TYPE=${if debug then "Debug" else "Release"}"
   ];
 
+  dontWrapQtApps = true;
+
   preConfigure = ''
     cmakeFlags+=" -DPHONON_QT_MKSPECS_INSTALL_DIR=''${!outputDev}/mkspecs"
     cmakeFlags+=" -DPHONON_QT_IMPORTS_INSTALL_DIR=''${!outputBin}/$qtQmlPrefix"

pkgs/development/libraries/polkit-qt-1/qt-5.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation {
 
   propagatedBuildInputs = [ polkit glib qtbase ];
 
+  dontWrapQtApps = true;
+
   postFixup = ''
     # Fix library location in CMake module
     sed -i "$dev/lib/cmake/PolkitQt5-1/PolkitQt5-1Config.cmake" \

pkgs/development/libraries/poppler/0.61.nix

@@ -53,6 +53,8 @@ stdenv.mkDerivation rec {
     (mkFlag qt5Support "QT5")
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://poppler.freedesktop.org/";
     description = "A PDF rendering library";

pkgs/development/libraries/poppler/default.nix

@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
-  version = "20.12.1"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
+  version = "21.01.0"; # beware: updates often break cups-filters build, check texlive and scribusUnstable too!
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";
-    sha256 = "0dbv1y9i5ahg6namz6gw2d0njnmrigr4a80dbxvnqad4q232banh";
+    sha256 = "sha256-AW3eNOX4aOqYoyypm2QzJaloIoFQCUK3ET9OyI0g4vM=";
   };
 
   outputs = [ "out" "dev" ];
@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
     sed -i -e '1i cmake_policy(SET CMP0025 NEW)' CMakeLists.txt
   '';
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     (mkFlag true "UNSTABLE_API_ABI_HEADERS") # previously "XPDF_HEADERS"
     (mkFlag (!minimal) "GLIB")

pkgs/development/libraries/pyotherside/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     python3 qtbase qtquickcontrols qtsvg ncurses
   ];
 
+  dontWrapQtApps = true;
+
   patches = [ ./qml-path.patch ];
   installTargets = [ "sub-src-install_subtargets" ];
 

pkgs/development/libraries/python-qt/default.nix

@@ -22,6 +22,8 @@ stdenv.mkDerivation rec {
                  "PYTHON_PATH=${python}/bin"
                  "PYTHON_LIB=${python}/lib"];
 
+  dontWrapQtApps = true;
+
   unpackCmd = "unzip $src";
 
   installPhase = ''

pkgs/development/libraries/qca-qt5/default.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl qtbase ];
   nativeBuildInputs = [ cmake pkg-config ];
 
+  dontWrapQtApps = true;
+
   # Without this patch cmake fails with a "No known features for CXX compiler"
   # error on darwin
   patches = lib.optional stdenv.isDarwin ./move-project.patch ;

pkgs/development/libraries/qmlbox2d/default.nix

@@ -9,6 +9,7 @@ stdenv.mkDerivation {
   };
 
   enableParallelBuilding = true;
+  dontWrapQtApps = true;
   nativeBuildInputs = [ qmake ];
 
   buildInputs = [ qtdeclarative ];

pkgs/development/libraries/qmltermwidget/default.nix

@@ -32,6 +32,8 @@ stdenv.mkDerivation {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   meta = {
     description = "A QML port of qtermwidget";
     homepage = "https://github.com/Swordfish90/qmltermwidget";

pkgs/development/libraries/qoauth/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation {
   NIX_CFLAGS_COMPILE = "-I${qca-qt5}/include/Qca-qt5/QtCrypto";
   NIX_LDFLAGS = "-lqca-qt5";
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Qt library for OAuth authentication";
     inherit (qtbase.meta) platforms;

pkgs/development/libraries/qscintilla/default.nix

@@ -35,6 +35,7 @@ in stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
+  dontWrapQtApps = true;
 
   postPatch = ''
     substituteInPlace qscintilla.pro \

pkgs/development/libraries/qt-5/5.12/default.nix

@@ -136,7 +136,7 @@ let
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
         withGtk3 = true; inherit dconf gtk3;
-        inherit developerBuild decryptSslTraffic;
+        inherit debug developerBuild decryptSslTraffic;
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
@@ -188,6 +188,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;

pkgs/development/libraries/qt-5/5.14/default.nix

@@ -149,7 +149,7 @@ let
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
         withGtk3 = true; inherit dconf gtk3;
-        inherit developerBuild decryptSslTraffic;
+        inherit debug developerBuild decryptSslTraffic;
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
@@ -199,6 +199,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;

pkgs/development/libraries/qt-5/5.15/default.nix

@@ -182,6 +182,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;

pkgs/development/libraries/qt-5/hooks/qmake-hook.sh

@@ -3,6 +3,9 @@
 qmakeFlags=( ${qmakeFlags-} )
 
 qmakePrePhase() {
+    qmakeFlags_orig=( "${qmakeFlags[@]}" )
+
+    # These flags must be added _before_ the flags specified in the derivation.
     qmakeFlags=( \
         "PREFIX=$out" \
         "NIX_OUTPUT_OUT=$out" \
@@ -11,8 +14,15 @@ qmakePrePhase() {
         "NIX_OUTPUT_DOC=${!outputDev}/${qtDocPrefix:?}" \
         "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}" \
         "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}" \
-        "${qmakeFlags[@]}" \
     )
+
+    if [ -n "@debug@" ]; then
+        qmakeFlags+=( "CONFIG+=debug" )
+    else
+        qmakeFlags+=( "CONFIG+=release" )
+    fi
+
+    qmakeFlags+=( "${qmakeFlags_orig[@]}" )
 }
 prePhases+=" qmakePrePhase"
 

pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh

@@ -1,3 +1,14 @@
+if [[ -n "${__nix_qtbase-}" ]]; then
+    # Throw an error if a different version of Qt was already set up.
+    if [[ "$__nix_qtbase" != "@dev@" ]]; then
+        echo >&2 "Error: detected mismatched Qt dependencies:"
+        echo >&2 "    @dev@"
+        echo >&2 "    $__nix_qtbase"
+        exit 1
+    fi
+else # Only set up Qt once.
+__nix_qtbase="@dev@"
+
 qtPluginPrefix=@qtPluginPrefix@
 qtQmlPrefix=@qtQmlPrefix@
 qtDocPrefix=@qtDocPrefix@
@@ -5,6 +16,20 @@ qtDocPrefix=@qtDocPrefix@
 . @fix_qt_builtin_paths@
 . @fix_qt_module_paths@
 
+# Disable debug symbols if qtbase was built without debugging.
+# This stops -dev paths from leaking into other outputs.
+if [ -z "@debug@" ]; then
+    NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE-}${NIX_CFLAGS_COMPILE:+ }-DQT_NO_DEBUG"
+fi
+
+# Integration with CMake:
+# Set the CMake build type corresponding to how qtbase was built.
+if [ -n "@debug@" ]; then
+    cmakeBuildType="Debug"
+else
+    cmakeBuildType="Release"
+fi
+
 providesQtRuntime() {
     [ -d "$1/$qtPluginPrefix" ] || [ -d "$1/$qtQmlPrefix" ]
 }
@@ -19,7 +44,12 @@ export QMAKEPATH
 QMAKEMODULES=
 export QMAKEMODULES
 
+declare -Ag qmakePathSeen=()
 qmakePathHook() {
+    # Skip this path if we have seen it before.
+    # MUST use 'if' because 'qmakePathSeen[$]' may be unset.
+    if [ -n "${qmakePathSeen[$1]-}" ]; then return; fi
+    qmakePathSeen[$1]=1
     if [ -d "$1/mkspecs" ]
     then
         QMAKEMODULES="${QMAKEMODULES}${QMAKEMODULES:+:}/mkspecs"
@@ -34,7 +64,12 @@ envBuildHostHooks+=(qmakePathHook)
 # package depending on the building package. (This is necessary in case
 # the building package does not provide runtime dependencies itself and so
 # would not be propagated to the user environment.)
+declare -Ag qtEnvHostTargetSeen=()
 qtEnvHostTargetHook() {
+    # Skip this path if we have seen it before.
+    # MUST use 'if' because 'qmakePathSeen[$]' may be unset.
+    if [ -n "${qtEnvHostTargetSeen[$1]-}" ]; then return; fi
+    qtEnvHostTargetSeen[$1]=1
     if providesQtRuntime "$1" && [ "z${!outputBin}" != "z${!outputDev}" ]
     then
         propagatedBuildInputs+=" $1"
@@ -64,3 +99,14 @@ postPatchMkspecs() {
 if [ -z "${dontPatchMkspecs-}" ]; then
     postPhases="${postPhases-}${postPhases:+ }postPatchMkspecs"
 fi
+
+qtPreHook() {
+    # Check that wrapQtAppsHook is used, or it is explicitly disabled.
+    if [[ -z "$__nix_wrapQtAppsHook" && -z "$dontWrapQtApps" ]]; then
+        echo >&2 "Error: wrapQtAppsHook is not used, and dontWrapQtApps is not set."
+        exit 1
+    fi
+}
+prePhases+=" qtPreHook"
+
+fi

pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh

@@ -1,3 +1,6 @@
+if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
+__nix_wrapQtAppsHook=1  # Don't run this hook more than once.
+
 # Inherit arguments given in mkDerivation
 qtWrapperArgs=( ${qtWrapperArgs-} )
 
@@ -100,3 +103,5 @@ wrapQtAppsHook() {
 }
 
 fixupOutputHooks+=(wrapQtAppsHook)
+
+fi

pkgs/development/libraries/qt-5/mkDerivation.nix

@@ -9,21 +9,6 @@ args:
 let
   args_ = {
 
-    qmakeFlags = [ ("CONFIG+=" + (if debug then "debug" else "release")) ]
-              ++ (args.qmakeFlags or []);
-
-    NIX_CFLAGS_COMPILE = toString (
-      optional (!debug) "-DQT_NO_DEBUG"
-      ++ lib.toList (args.NIX_CFLAGS_COMPILE or []));
-
-    cmakeFlags =
-      (args.cmakeFlags or [])
-      ++ [
-        ("-DCMAKE_BUILD_TYPE=" + (if debug then "Debug" else "Release"))
-      ];
-
-    enableParallelBuilding = args.enableParallelBuilding or true;
-
     nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ wrapQtAppsHook ];
 
   };

pkgs/development/libraries/qt-5/modules/qtbase.nix

@@ -22,6 +22,7 @@
   libGL,
   buildExamples ? false,
   buildTests ? false,
+  debug ? false,
   developerBuild ? false,
   decryptSslTraffic ? false
 }:
@@ -33,12 +34,14 @@ let
   compareVersion = v: builtins.compareVersions version v;
   qmakeCacheName =
     if compareVersion "5.12.4" < 0 then ".qmake.cache" else ".qmake.stash";
+  debugSymbols = debug || developerBuild;
 in
 
 stdenv.mkDerivation {
 
   name = "qtbase-${version}";
   inherit qtCompatVersion src version;
+  debug = debugSymbols;
 
   propagatedBuildInputs =
     [
@@ -241,6 +244,7 @@ stdenv.mkDerivation {
       "-I" "${icu.dev}/include"
       "-pch"
     ]
+    ++ lib.optional debugSymbols "-debug"
     ++ lib.optionals (compareVersion "5.11.0" < 0)
     [
       "-qml-debug"
@@ -397,6 +401,8 @@ stdenv.mkDerivation {
           -e "/^host_bins=/ c host_bins=$dev/bin"
     '';
 
+  dontStrip = debugSymbols;
+
   setupHook = ../hooks/qtbase-setup-hook.sh;
 
   meta = with lib; {