Merge #64892: 'staging-next' (another iteration)

It's not completely without regressions, but I believe we can deal with
the rest directly on master.  This is required for Firefox security fixes.

11 files changed, 35 insertions, 83 deletions

diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index c5651d0418e49..42da24e323994 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, qmake, qtbase, qttools, substituteAll, libGLU, makeWrapper }:
+{ stdenv, fetchFromGitHub, qmake, qtbase, qttools, substituteAll, libGLU, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "nifskope-${version}";
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ qtbase qttools libGLU.dev makeWrapper ];
-  nativeBuildInputs = [ qmake ];
+  buildInputs = [ qtbase qttools libGLU.dev ];
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
 
   preConfigure = ''
     shopt -s globstar
@@ -33,9 +33,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Inspired by install/linux-install/nifskope.spec.in.
-  installPhase = let
-    qtVersion = "5.${stdenv.lib.versions.minor qtbase.version}";
-  in ''
+  installPhase = ''
     runHook preInstall
 
     d=$out/share/nifskope
@@ -53,8 +51,6 @@ stdenv.mkDerivation rec {
 
     find $out/share -type f -exec chmod -x {} \;
 
-    wrapProgram $out/bin/NifSkope --prefix QT_PLUGIN_PATH : "${qtbase}/lib/qt-${qtVersion}/plugins"
-
     runHook postInstall
   '';
 
diff --git a/pkgs/tools/misc/contacts/default.nix b/pkgs/tools/misc/contacts/default.nix
index b262626b1363e..a7d230d8e8982 100644
--- a/pkgs/tools/misc/contacts/default.nix
+++ b/pkgs/tools/misc/contacts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xcbuildHook, cf-private, Foundation, AddressBook }:
+{ stdenv, fetchurl, xcbuildHook, Foundation, AddressBook }:
 
 stdenv.mkDerivation rec {
   version = "1.1a-3";
@@ -10,12 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ xcbuildHook ];
-
-  buildInputs = [
-    Foundation AddressBook
-    # Needed for OBJC_CLASS_$_NSArray symbols.
-    cf-private
-  ];
+  buildInputs = [ Foundation AddressBook ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/noti/default.nix b/pkgs/tools/misc/noti/default.nix
index 43165b4f54bb3..23646abe78756 100644
--- a/pkgs/tools/misc/noti/default.nix
+++ b/pkgs/tools/misc/noti/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, cf-private, Cocoa }:
+{ stdenv, buildGoPackage, fetchFromGitHub, Cocoa }:
 
 buildGoPackage rec {
   name = "noti-${version}";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     sha256 = "1chsqfqk0pnhx5k2nr4c16cpb8m6zv69l1jvv4v4903zgfzcm823";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Cocoa cf-private /* For OBJC_CLASS_$_NSDate */ ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Cocoa ];
   # TODO: Remove this when we update apple_sdk
   NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.isDarwin [ "-fno-objc-arc" ];
 
diff --git a/pkgs/tools/misc/partition-manager/default.nix b/pkgs/tools/misc/partition-manager/default.nix
index 4599309b2384a..1c094c291d899 100644
--- a/pkgs/tools/misc/partition-manager/default.nix
+++ b/pkgs/tools/misc/partition-manager/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, fetchurl, lib
-, extra-cmake-modules, kdoctools, wrapGAppsHook
+, extra-cmake-modules, kdoctools, wrapGAppsHook, wrapQtAppsHook
 , kconfig, kcrash, kinit, kpmcore
-, eject, libatasmart , utillinux, makeWrapper, qtbase
+, eject, libatasmart , utillinux, qtbase
 }:
 
 let
@@ -17,16 +17,12 @@ in mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook makeWrapper ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook wrapQtAppsHook ];
 
   # refer to kpmcore for the use of eject
   buildInputs = [ eject libatasmart utillinux ];
   propagatedBuildInputs = [ kconfig kcrash kinit kpmcore ];
 
-  postInstall = ''
-    wrapProgram "$out/bin/partitionmanager" --prefix QT_PLUGIN_PATH : "${kpmcore}/lib/qt-5.${lib.versions.minor qtbase.version}/plugins"
-  '';
-
   meta = with lib; {
     description = "KDE Partition Manager";
     license = licenses.gpl2;
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index b0471e56c0787..d15bfb3887a2c 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -13,11 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1sqwplvpg0n9j0h9j94m7a6ylgqi4y4wyx489y09z9gm7aqgrsjc";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
-    CoreServices
-    # This is needed to avoid an undefined symbol error "_CFURLResourceIsReachable"
-    darwin.cf-private
-  ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with stdenv.lib; {
     description = "Executes commands in response to file modifications";
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
index a1d0b185a0a94..44b2f3451c1dd 100644
--- a/pkgs/tools/misc/yubikey-manager-qt/default.nix
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , fetchurl
-, makeWrapper
+, wrapQtAppsHook
 , pcsclite
 , pyotherside
 , pythonPackages
@@ -16,16 +16,9 @@
 , yubikey-personalization
 }:
 
-let
-  qmlPath = qmlLib: "${qmlLib}/${qtbase.qtQmlPrefix}";
+let inherit (stdenv) lib; in
 
-  inherit (stdenv) lib;
-
-  qml2ImportPath = lib.concatMapStringsSep ":" qmlPath [
-    qtbase.bin qtdeclarative.bin pyotherside qtquickcontrols qtquickcontrols2.bin qtgraphicaleffects
-  ];
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "yubikey-manager-qt";
   version = "1.1.2";
 
@@ -34,7 +27,7 @@ in stdenv.mkDerivation rec {
     sha256 = "01ax8zjrahs2sjbgsys2ahh57sdcap0ij3y1r1bbvsgzr7xxm2q8";
   };
 
-  nativeBuildInputs = [ makeWrapper python3.pkgs.wrapPython qmake ];
+  nativeBuildInputs = [ wrapQtAppsHook python3.pkgs.wrapPython qmake ];
 
   postPatch = ''
     substituteInPlace ykman-gui/deployment.pri --replace '/usr/bin' "$out/bin"
@@ -46,22 +39,20 @@ in stdenv.mkDerivation rec {
 
   pythonPath = [ yubikey-manager ];
 
+  dontWrapQtApps = true;
   postInstall = ''
     buildPythonPath "$pythonPath"
 
-    wrapProgram $out/bin/ykman-gui \
+    wrapQtApp $out/bin/ykman-gui \
       --prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib" \
-      --prefix PYTHONPATH : "$program_PYTHONPATH" \
-      --set QML2_IMPORT_PATH "${qml2ImportPath}" \
-      --set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-*/plugins/platforms \
-      --prefix QT_PLUGIN_PATH : "${qtsvg.bin}/${qtbase.qtPluginPrefix}"
+      --prefix PYTHONPATH : "$program_PYTHONPATH"
 
-      mkdir -p $out/share/applications
-      cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
-      mkdir -p $out/share/ykman-gui/icons
-      cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
-      substituteInPlace $out/share/applications/ykman-gui.desktop \
-        --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
+    mkdir -p $out/share/applications
+    cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
+    mkdir -p $out/share/ykman-gui/icons
+    cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
+    substituteInPlace $out/share/applications/ykman-gui.desktop \
+      --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 8b832bf00d652..18e3836c99d9c 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub, cf-private
+{ stdenv, lib, buildGoPackage, fetchFromGitHub
 , AVFoundation, AudioToolbox, ImageIO, CoreMedia
 , Foundation, CoreGraphics, MediaToolbox
 }:
@@ -19,11 +19,7 @@ buildGoPackage rec {
     sha256 = "00mxyy4jhdbcvbwabf4yvq4h5mpnlfp2z93gy2266kz6gkd5myzk";
   };
 
-  buildInputs = lib.optionals stdenv.isDarwin [
-    AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox
-    # Needed for OBJC_CLASS_$_NSData symbols.
-    cf-private
-  ];
+  buildInputs = lib.optionals stdenv.isDarwin [ AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox ];
   buildFlags = [ "-tags production" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index e7f7547e4ad9f..1b18f0e1e11a0 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, makeWrapper, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
-, qtbase, qttranslations, qtsvg }:
+{ stdenv, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
+, qtbase, qttranslations, qtsvg, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "nitrokey-app-${version}";
@@ -29,15 +29,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkgconfig
-    makeWrapper
+    wrapQtAppsHook
   ];
   cmakeFlags = "-DCMAKE_BUILD_TYPE=Release";
 
-  postFixup = ''
-    wrapProgram $out/bin/nitrokey-app \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}"
-  '';
-
   meta = with stdenv.lib; {
     description      = "Provides extra functionality for the Nitrokey Pro and Storage";
     longDescription  = ''
diff --git a/pkgs/tools/security/pinentry/mac.nix b/pkgs/tools/security/pinentry/mac.nix
index 8168aa94b3d28..1fbb52985fb19 100644
--- a/pkgs/tools/security/pinentry/mac.nix
+++ b/pkgs/tools/security/pinentry/mac.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, xcbuildHook, libiconv, Cocoa, ncurses, cf-private }:
+{ stdenv, fetchFromGitHub, xcbuildHook, libiconv, ncurses, Cocoa }:
 
 stdenv.mkDerivation rec {
   name = "pinentry-mac-0.9.4";
@@ -11,12 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ xcbuildHook ];
-
-  buildInputs = [
-    libiconv Cocoa ncurses
-    # Needed for OBJC_CLASS_$_NSArray symbols.
-    cf-private
-  ];
+  buildInputs = [ libiconv ncurses Cocoa ];
 
   installPhase = ''
     mkdir -p $out/Applications
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 6e1faa3331f03..52d197759eae1 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -13,11 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1xpsc4qff2lrq15mz1gvmw6n5vl88sfwpjbsnp5ja5k1im156lam";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
-    CoreServices
-    # This is needed to avoid an undefined symbol error for "_CFURLResourceIsReachable"
-    darwin.cf-private
-  ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with stdenv.lib; {
     description = "Create books from MarkDown";
diff --git a/pkgs/tools/video/atomicparsley/default.nix b/pkgs/tools/video/atomicparsley/default.nix
index f0ad4297c003a..711a3c00a1221 100644
--- a/pkgs/tools/video/atomicparsley/default.nix
+++ b/pkgs/tools/video/atomicparsley/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchhg, autoreconfHook, zlib, cf-private, Cocoa }:
+{ stdenv, fetchhg, autoreconfHook, zlib, Cocoa }:
 
 stdenv.mkDerivation rec {
   name = "atomicparsley-${version}";
@@ -12,11 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   buildInputs = [ zlib ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [
-      Cocoa
-      # Needed for OBJC_CLASS_$_NSDictionary symbols.
-      cf-private
-    ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa ];
 
   configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # AC_FUNC_MALLOC is broken on cross builds.