summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--doc/languages-frameworks/qt.xml232
-rw-r--r--nixos/modules/services/x11/desktop-managers/plasma5.nix4
-rw-r--r--pkgs/applications/altcoins/bitcoin.nix15
-rw-r--r--pkgs/applications/altcoins/monero-gui/default.nix11
-rw-r--r--pkgs/applications/audio/carla/default.nix13
-rw-r--r--pkgs/applications/audio/kid3/default.nix9
-rw-r--r--pkgs/applications/editors/emacs/25.nix8
-rw-r--r--pkgs/applications/editors/emacs/default.nix8
-rw-r--r--pkgs/applications/editors/emacs/macport.nix4
-rw-r--r--pkgs/applications/editors/kdevelop5/kdevelop.nix5
-rw-r--r--pkgs/applications/editors/vim/configurable.nix4
-rw-r--r--pkgs/applications/editors/vim/default.nix8
-rw-r--r--pkgs/applications/gis/openorienteering-mapper/default.nix8
-rw-r--r--pkgs/applications/graphics/gimp/default.nix6
-rw-r--r--pkgs/applications/graphics/ktikz/default.nix10
-rw-r--r--pkgs/applications/kde/ark/default.nix38
-rw-r--r--pkgs/applications/kde/okular.nix12
-rw-r--r--pkgs/applications/misc/alacritty/default.nix8
-rw-r--r--pkgs/applications/misc/albert/default.nix5
-rw-r--r--pkgs/applications/misc/aminal/default.nix8
-rw-r--r--pkgs/applications/misc/electron-cash/default.nix8
-rw-r--r--pkgs/applications/misc/keepassx/community.nix9
-rw-r--r--pkgs/applications/misc/kitty/default.nix2
-rw-r--r--pkgs/applications/misc/masterpdfeditor/default.nix9
-rw-r--r--pkgs/applications/misc/subsurface/default.nix9
-rw-r--r--pkgs/applications/misc/synergy/default.nix4
-rw-r--r--pkgs/applications/misc/xpdf/default.nix11
-rw-r--r--pkgs/applications/misc/zola/default.nix5
-rw-r--r--pkgs/applications/networking/browsers/qtchan/default.nix7
-rw-r--r--pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix7
-rw-r--r--pkgs/applications/networking/linssid/default.nix11
-rw-r--r--pkgs/applications/networking/mumble/default.nix9
-rw-r--r--pkgs/applications/networking/newsreaders/quiterss/default.nix9
-rw-r--r--pkgs/applications/networking/nextcloud-client/default.nix12
-rw-r--r--pkgs/applications/networking/protonmail-bridge/default.nix13
-rw-r--r--pkgs/applications/networking/sniffers/wireshark/default.nix7
-rw-r--r--pkgs/applications/office/kmymoney/default.nix12
-rw-r--r--pkgs/applications/office/scribus/unstable.nix12
-rw-r--r--pkgs/applications/science/astronomy/stellarium/default.nix11
-rw-r--r--pkgs/applications/science/electronics/dsview/default.nix9
-rw-r--r--pkgs/applications/science/misc/root/5.nix4
-rw-r--r--pkgs/applications/science/misc/root/default.nix4
-rw-r--r--pkgs/applications/version-management/p4v/default.nix10
-rw-r--r--pkgs/applications/video/avidemux/default.nix15
-rw-r--r--pkgs/applications/video/minitube/default.nix9
-rw-r--r--pkgs/build-support/cc-wrapper/setup-hook.sh8
-rw-r--r--pkgs/desktops/plasma-5/plasma-workspace/default.nix11
-rw-r--r--pkgs/development/compilers/llvm/4/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/5/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/6/lldb.nix2
-rw-r--r--pkgs/development/compilers/llvm/7/lldb.nix21
-rw-r--r--pkgs/development/compilers/llvm/8/lldb.nix2
-rw-r--r--pkgs/development/compilers/nextpnr/default.nix15
-rw-r--r--pkgs/development/interpreters/python/default.nix8
-rw-r--r--pkgs/development/libraries/SDL/default.nix7
-rw-r--r--pkgs/development/libraries/SDL2/default.nix8
-rw-r--r--pkgs/development/libraries/cutelyst/default.nix10
-rw-r--r--pkgs/development/libraries/ffmpeg-full/default.nix12
-rw-r--r--pkgs/development/libraries/fltk/1.4.nix32
-rw-r--r--pkgs/development/libraries/fltk/default.nix31
-rw-r--r--pkgs/development/libraries/glfw/3.x.nix11
-rw-r--r--pkgs/development/libraries/glib/default.nix3
-rw-r--r--pkgs/development/libraries/gsettings-qt/default.nix6
-rw-r--r--pkgs/development/libraries/kde-frameworks/default.nix15
-rw-r--r--pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh64
-rw-r--r--pkgs/development/libraries/kde-frameworks/kinit/default.nix4
-rw-r--r--pkgs/development/libraries/libgdata/default.nix65
-rw-r--r--pkgs/development/libraries/libgdata/installed-tests-path.patch94
-rw-r--r--pkgs/development/libraries/librime/default.nix6
-rw-r--r--pkgs/development/libraries/libui/default.nix4
-rw-r--r--pkgs/development/libraries/libxkbcommon/default.nix15
-rw-r--r--pkgs/development/libraries/libyaml/default.nix25
-rw-r--r--pkgs/development/libraries/opencv/3.x.nix4
-rw-r--r--pkgs/development/libraries/opencv/4.x.nix4
-rw-r--r--pkgs/development/libraries/opencv/default.nix4
-rw-r--r--pkgs/development/libraries/pcl/default.nix4
-rw-r--r--pkgs/development/libraries/qt-4.x/4.8/default.nix4
-rw-r--r--pkgs/development/libraries/qt-5/5.11/default.nix44
-rw-r--r--pkgs/development/libraries/qt-5/5.12/default.nix44
-rw-r--r--pkgs/development/libraries/qt-5/5.6/default.nix35
-rw-r--r--pkgs/development/libraries/qt-5/5.9/default.nix39
-rw-r--r--pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh22
-rw-r--r--pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh106
-rw-r--r--pkgs/development/libraries/qt-5/mkDerivation.nix8
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtbase.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtconnectivity.nix4
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtmacextras.nix6
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtspeech.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebengine.nix8
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebkit.nix2
-rw-r--r--pkgs/development/libraries/qt-5/modules/qtwebview.nix10
-rw-r--r--pkgs/development/libraries/sfml/default.nix7
-rw-r--r--pkgs/development/libraries/tk/generic.nix6
-rw-r--r--pkgs/development/libraries/vtk/default.nix16
-rw-r--r--pkgs/development/libraries/wxwidgets/3.0/mac.nix11
-rw-r--r--pkgs/development/python-modules/numpy/default.nix4
-rw-r--r--pkgs/development/python-modules/pytest/default.nix3
-rw-r--r--pkgs/development/python-modules/watchdog/default.nix2
-rw-r--r--pkgs/development/r-modules/wrapper-rstudio.nix9
-rw-r--r--pkgs/development/tools/analysis/flow/default.nix4
-rw-r--r--pkgs/development/tools/analysis/hopper/default.nix26
-rw-r--r--pkgs/development/tools/cargo-web/default.nix8
-rw-r--r--pkgs/development/tools/qtcreator/default.nix16
-rw-r--r--pkgs/development/tools/tora/default.nix7
-rw-r--r--pkgs/development/tools/watchman/default.nix25
-rw-r--r--pkgs/games/chessx/default.nix3
-rw-r--r--pkgs/games/flightgear/default.nix9
-rw-r--r--pkgs/games/gargoyle/default.nix4
-rw-r--r--pkgs/games/nethack/default.nix13
-rw-r--r--pkgs/misc/emulators/dolphin-emu/master.nix4
-rw-r--r--pkgs/misc/emulators/mgba/default.nix6
-rw-r--r--pkgs/misc/jackaudio/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh (renamed from pkgs/os-specific/darwin/cf-private/setup-hook.sh)9
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix8
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/frameworks.nix79
-rw-r--r--pkgs/os-specific/darwin/cf-private/default.nix58
-rw-r--r--pkgs/os-specific/darwin/trash/default.nix9
-rw-r--r--pkgs/os-specific/linux/apparmor/cross.patch19
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix6
-rw-r--r--pkgs/servers/x11/quartz-wm/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/overrides.nix8
-rw-r--r--pkgs/servers/x11/xquartz/default.nix7
-rw-r--r--pkgs/tools/graphics/nifskope/default.nix12
-rw-r--r--pkgs/tools/misc/contacts/default.nix9
-rw-r--r--pkgs/tools/misc/noti/default.nix4
-rw-r--r--pkgs/tools/misc/partition-manager/default.nix10
-rw-r--r--pkgs/tools/misc/watchexec/default.nix6
-rw-r--r--pkgs/tools/misc/yubikey-manager-qt/default.nix35
-rw-r--r--pkgs/tools/security/keybase/default.nix8
-rw-r--r--pkgs/tools/security/nitrokey-app/default.nix11
-rw-r--r--pkgs/tools/security/pinentry/mac.nix9
-rw-r--r--pkgs/tools/text/mdbook/default.nix6
-rw-r--r--pkgs/tools/video/atomicparsley/default.nix8
-rw-r--r--pkgs/top-level/all-packages.nix69
-rw-r--r--pkgs/top-level/darwin-packages.nix9
135 files changed, 1078 insertions, 981 deletions
diff --git a/doc/languages-frameworks/qt.xml b/doc/languages-frameworks/qt.xml
index b9b605b81da..032cdd9945b 100644
--- a/doc/languages-frameworks/qt.xml
+++ b/doc/languages-frameworks/qt.xml
@@ -4,71 +4,173 @@
  <title>Qt</title>
 
  <para>
-  Qt is a comprehensive desktop and mobile application development toolkit for
-  C++. Legacy support is available for Qt 3 and Qt 4, but all current
-  development uses Qt 5. The Qt 5 packages in Nixpkgs are updated frequently to
-  take advantage of new features, but older versions are typically retained
-  until their support window ends. The most important consideration in
-  packaging Qt-based software is ensuring that each package and all its
-  dependencies use the same version of Qt 5; this consideration motivates most
-  of the tools described below.
+   This section describes the differences between Nix expressions for Qt
+   libraries and applications and Nix expressions for other C++ software. Some
+   knowledge of the latter is assumed. There are primarily two problems which
+   the Qt infrastructure is designed to address: ensuring consistent versioning
+   of all dependencies and finding dependencies at runtime.
  </para>
 
- <section xml:id="ssec-qt-libraries">
-  <title>Packaging Libraries for Nixpkgs</title>
-
-  <para>
-   Whenever possible, libraries that use Qt 5 should be built with each
-   available version. Packages providing libraries should be added to the
-   top-level function <varname>mkLibsForQt5</varname>, which is used to build a
-   set of libraries for every Qt 5 version. A special
-   <varname>callPackage</varname> function is used in this scope to ensure that
-   the entire dependency tree uses the same Qt 5 version. Import dependencies
-   unqualified, i.e., <literal>qtbase</literal> not
-   <literal>qt5.qtbase</literal>. <emphasis>Do not</emphasis> import a package
-   set such as <literal>qt5</literal> or <literal>libsForQt5</literal>.
-  </para>
-
-  <para>
-   If a library does not support a particular version of Qt 5, it is best to
-   mark it as broken by setting its <literal>meta.broken</literal> attribute. A
-   package may be marked broken for certain versions by testing the
-   <literal>qtbase.version</literal> attribute, which will always give the
-   current Qt 5 version.
-  </para>
- </section>
-
- <section xml:id="ssec-qt-applications">
-  <title>Packaging Applications for Nixpkgs</title>
-
-  <para>
-   Call your application expression using
-   <literal>libsForQt5.callPackage</literal> instead of
-   <literal>callPackage</literal>. Import dependencies unqualified, i.e.,
-   <literal>qtbase</literal> not <literal>qt5.qtbase</literal>. <emphasis>Do
-   not</emphasis> import a package set such as <literal>qt5</literal> or
-   <literal>libsForQt5</literal>.
-  </para>
-
-  <para>
-   Qt 5 maintains strict backward compatibility, so it is generally best to
-   build an application package against the latest version using the
-   <varname>libsForQt5</varname> library set. In case a package does not build
-   with the latest Qt version, it is possible to pick a set pinned to a
-   particular version, e.g. <varname>libsForQt55</varname> for Qt 5.5, if that
-   is the latest version the package supports. If a package must be pinned to
-   an older Qt version, be sure to file a bug upstream; because Qt is strictly
-   backwards-compatible, any incompatibility is by definition a bug in the
-   application.
-  </para>
-
-  <para>
-   When testing applications in Nixpkgs, it is a common practice to build the
-   package with <literal>nix-build</literal> and run it using the created
-   symbolic link. This will not work with Qt applications, however, because
-   they have many hard runtime requirements that can only be guaranteed if the
-   package is actually installed. To test a Qt application, install it with
-   <literal>nix-env</literal> or run it inside <literal>nix-shell</literal>.
-  </para>
- </section>
+ <example xml:id='qt-default-nix'>
+   <title>Nix expression for a Qt package (<filename>default.nix</filename>)</title>
+   <programlisting>
+{ mkDerivation, lib, qtbase }: <co xml:id='qt-default-nix-co-1' />
+
+mkDerivation { <co xml:id='qt-default-nix-co-2' />
+  pname = "myapp";
+  version = "1.0";
+
+  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
+}
+   </programlisting>
+ </example>
+
+ <calloutlist>
+   <callout arearefs='qt-default-nix-co-1'>
+     <para>
+       Import <literal>mkDerivation</literal> and Qt (such as
+       <literal>qtbase</literal> modules directly. <emphasis>Do not</emphasis>
+       import Qt package sets; the Qt versions of dependencies may not be
+       coherent, causing build and runtime failures.
+     </para>
+   </callout>
+   <callout arearefs='qt-default-nix-co-2'>
+     <para>
+       Use <literal>mkDerivation</literal> instead of
+       <literal>stdenv.mkDerivation</literal>. <literal>mkDerivation</literal>
+       is a wrapper around <literal>stdenv.mkDerivation</literal> which
+       applies some Qt-specific settings.
+       This deriver accepts the same arguments as
+       <literal>stdenv.mkDerivation</literal>; refer to
+       <xref linkend='chap-stdenv' /> for details.
+     </para>
+     <para>
+       To use another deriver instead of
+       <literal>stdenv.mkDerivation</literal>, use
+       <literal>mkDerivationWith</literal>:
+<programlisting>
+mkDerivationWith myDeriver {
+  # ...
+}
+</programlisting>
+       If you cannot use <literal>mkDerivationWith</literal>, please refer to
+       <xref linkend='qt-runtime-dependencies' />.
+     </para>
+   </callout>
+   <callout arearefs='qt-default-nix-co-3'>
+     <para>
+       <literal>mkDerivation</literal> accepts the same arguments as
+       <literal>stdenv.mkDerivation</literal>, such as
+       <literal>buildInputs</literal>.
+     </para>
+   </callout>
+ </calloutlist>
+
+ <formalpara xml:id='qt-runtime-dependencies'>
+   <title>Locating runtime dependencies</title>
+   <para>
+     Qt applications need to be wrapped to find runtime dependencies.  If you
+     cannot use <literal>mkDerivation</literal> or
+     <literal>mkDerivationWith</literal> above, include
+     <literal>wrapQtAppsHook</literal> in <literal>nativeBuildInputs</literal>:
+<programlisting>
+stdenv.mkDerivation {
+  # ...
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+}
+</programlisting>
+   </para>
+ </formalpara>
+
+ <para>
+   Entries added to <literal>qtWrapperArgs</literal> are used to modify the
+   wrappers created by <literal>wrapQtAppsHook</literal>. The entries are
+   passed as arguments to <xref linkend='fun-wrapProgram' />.
+<programlisting>
+mkDerivation {
+  # ...
+
+  qtWrapperArgs = [ ''--prefix PATH : /path/to/bin'' ];
+}
+</programlisting>
+ </para>
+
+ <para>
+  Set <literal>dontWrapQtApps</literal> to stop applications from being
+  wrapped automatically. It is required to wrap applications manually with
+  <literal>wrapQtApp</literal>, using the syntax of
+  <xref linkend='fun-wrapProgram' />:
+<programlisting>
+mkDerivation {
+  # ...
+
+  dontWrapQtApps = true;
+  preFixup = ''
+      wrapQtApp "$out/bin/myapp" --prefix PATH : /path/to/bin
+  '';
+}
+</programlisting>
+ </para>
+
+ <para>
+  Libraries are built with every available version of Qt. Use the <literal>meta.broken</literal>
+  attribute to disable the package for unsupported Qt versions:
+<programlisting>
+mkDerivation {
+  # ...
+
+  # Disable this library with Qt &lt; 5.9.0
+  meta.broken = builtins.compareVersions qtbase.version "5.9.0" &lt; 0;
+}
+</programlisting>
+ </para>
+
+ <formalpara>
+   <title>Adding a library to Nixpkgs</title>
+   <para>
+     Add a Qt library to <filename>all-packages.nix</filename> by adding it to the
+     collection inside <literal>mkLibsForQt5</literal>. This ensures that the
+     library is built with every available version of Qt as needed.
+     <example xml:id='qt-library-all-packages-nix'>
+       <title>Adding a Qt library to <filename>all-packages.nix</filename></title>
+<programlisting>
+{
+  # ...
+
+  mkLibsForQt5 = self: with self; {
+    # ...
+
+    mylib = callPackage ../path/to/mylib {};
+  };
+
+  # ...
+}
+</programlisting>
+     </example>
+   </para>
+ </formalpara>
+
+ <formalpara>
+   <title>Adding an application to Nixpkgs</title>
+   <para>
+     Add a Qt application to <filename>all-packages.nix</filename> using
+     <literal>libsForQt5.callPackage</literal> instead of the usual
+     <literal>callPackage</literal>. The former ensures that all dependencies
+     are built with the same version of Qt.
+     <example xml:id='qt-application-all-packages-nix'>
+       <title>Adding a Qt application to <filename>all-packages.nix</filename></title>
+<programlisting>
+{
+  # ...
+
+  myapp = libsForQt5.callPackage ../path/to/myapp/ {};
+
+  # ...
+}
+</programlisting>
+     </example>
+   </para>
+ </formalpara>
+
 </section>
diff --git a/nixos/modules/services/x11/desktop-managers/plasma5.nix b/nixos/modules/services/x11/desktop-managers/plasma5.nix
index dc8bfc7dc17..4b7773c4c6d 100644
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@@ -64,8 +64,8 @@ in
       };
 
       security.wrappers = {
-        kcheckpass.source = "${lib.getBin plasma5.kscreenlocker}/lib/libexec/kcheckpass";
-        "start_kdeinit".source = "${lib.getBin pkgs.kinit}/lib/libexec/kf5/start_kdeinit";
+        kcheckpass.source = "${lib.getBin plasma5.kscreenlocker}/libexec/kcheckpass";
+        "start_kdeinit".source = "${lib.getBin pkgs.kinit}/libexec/kf5/start_kdeinit";
         kwin_wayland = {
           source = "${lib.getBin plasma5.kwin}/bin/kwin_wayland";
           capabilities = "cap_sys_nice+ep";
diff --git a/pkgs/applications/altcoins/bitcoin.nix b/pkgs/applications/altcoins/bitcoin.nix
index d1802f774f2..ce0a31dfe68 100644
--- a/pkgs/applications/altcoins/bitcoin.nix
+++ b/pkgs/applications/altcoins/bitcoin.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost, zeromq, rapidcheck
-, zlib, miniupnpc, qtbase ? null, qttools ? null, utillinux, protobuf, python3, qrencode, libevent
+, zlib, miniupnpc, qtbase ? null, qttools ? null, wrapQtAppsHook ? null, utillinux, protobuf, python3, qrencode, libevent
 , withGui }:
 
 with stdenv.lib;
@@ -14,7 +14,9 @@ stdenv.mkDerivation rec{
     sha256 = "5e4e6890e07b620a93fdb24605dae2bb53e8435b2a93d37558e1db1913df405f";
   };
 
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs =
+    [ pkgconfig autoreconfHook ]
+    ++ optional withGui wrapQtAppsHook;
   buildInputs = [ openssl db48 boost zlib zeromq
                   miniupnpc protobuf libevent]
                   ++ optionals stdenv.isLinux [ utillinux ]
@@ -34,10 +36,11 @@ stdenv.mkDerivation rec{
 
   doCheck = true;
 
-  # QT_PLUGIN_PATH needs to be set when executing QT, which is needed when testing Bitcoin's GUI.
-  # See also https://github.com/NixOS/nixpkgs/issues/24256
-  checkFlags = optionals withGui [ "QT_PLUGIN_PATH=${qtbase}/lib/qt-5.${versions.minor qtbase.version}/plugins" ]
-    ++ [ "LC_ALL=C.UTF-8" ];
+  checkFlags =
+    [ "LC_ALL=C.UTF-8" ]
+    # QT_PLUGIN_PATH needs to be set when executing QT, which is needed when testing Bitcoin's GUI.
+    # See also https://github.com/NixOS/nixpkgs/issues/24256
+    ++ optional withGui "QT_PLUGIN_PATH=${qtbase}/${qtbase.qtPluginPrefix}";
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/applications/altcoins/monero-gui/default.nix b/pkgs/applications/altcoins/monero-gui/default.nix
index d67ac0a7055..c10cc34ad44 100644
--- a/pkgs/applications/altcoins/monero-gui/default.nix
+++ b/pkgs/applications/altcoins/monero-gui/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub
-, makeWrapper, makeDesktopItem
+, wrapQtAppsHook, makeDesktopItem
 , qtbase, qmake, qtmultimedia, qttools
 , qtgraphicaleffects, qtdeclarative
 , qtlocation, qtquickcontrols, qtquickcontrols2
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ilx47771faygf97wilm64xnqxgxa3b43q0g9v014npk0qj8pc31";
   };
 
-  nativeBuildInputs = [ qmake pkgconfig ];
+  nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
 
   buildInputs = [
     qtbase qtmultimedia qtgraphicaleffects
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
     qtwebchannel qtwebengine qtx11extras
     qtxmlpatterns monero unbound readline
     boost libunwind libsodium pcsclite zeromq
-    cppzmq makeWrapper hidapi
+    cppzmq hidapi
   ];
 
   patches = [
@@ -94,11 +94,6 @@ stdenv.mkDerivation rec {
       cp $src/images/appicons/$size.png \
          $out/share/icons/hicolor/$size/apps/monero.png
     done;
-
-    # wrap runtime dependencies
-    wrapProgram $out/bin/monero-wallet-gui \
-      --set QML2_IMPORT_PATH "${qml2ImportPath}" \
-      --set QT_PLUGIN_PATH "${qtbase.bin}/${qtbase.qtPluginPrefix}"
   '';
 
   meta = {
diff --git a/pkgs/applications/audio/carla/default.nix b/pkgs/applications/audio/carla/default.nix
index 6e623a69919..98a4ddd29d6 100644
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, alsaLib, file, fluidsynth, ffmpeg, jack2,
   liblo, libpulseaudio, libsndfile, pkgconfig, python3Packages,
   which, withFrontend ? true,
-  withQt ? true, qtbase ? null,
+  withQt ? true, qtbase ? null, wrapQtAppsHook ? null,
   withGtk2 ? true, gtk2 ? null,
   withGtk3 ? true, gtk3 ? null }:
 
@@ -9,6 +9,7 @@ with stdenv.lib;
 
 assert withFrontend -> python3Packages ? pyqt5;
 assert withQt -> qtbase != null;
+assert withQt -> wrapQtAppsHook != null;
 assert withGtk2 -> gtk2 != null;
 assert withGtk3 -> gtk3 != null;
 
@@ -23,7 +24,9 @@ stdenv.mkDerivation rec {
     sha256 = "0fqgncqlr86n38yy7pa118mswfacmfczj7w9xx6c6k0jav3wk29k";
   };
 
-  nativeBuildInputs = [ python3Packages.wrapPython pkgconfig which ];
+  nativeBuildInputs = [
+    python3Packages.wrapPython pkgconfig which wrapQtAppsHook
+  ];
 
   pythonPath = with python3Packages; [
     rdflib pyliblo
@@ -38,6 +41,7 @@ stdenv.mkDerivation rec {
 
   installFlags = [ "PREFIX=$(out)" ];
 
+  dontWrapQtApps = true;
   postFixup = ''
     # Also sets program_PYTHONPATH and program_PATH variables
     wrapPythonPrograms
@@ -48,10 +52,9 @@ stdenv.mkDerivation rec {
     patchPythonScript "$out/share/carla/carla_settings.py"
 
     for program in $out/bin/*; do
-      wrapProgram "$program" \
+      wrapQtApp "$program" \
         --prefix PATH : "$program_PATH:${which}/bin" \
-        --set PYTHONNOUSERSITE true \
-        --prefix QT_PLUGIN_PATH : "${qtbase.bin}/${qtbase.qtPluginPrefix}"
+        --set PYTHONNOUSERSITE true
     done
   '';
 
diff --git a/pkgs/applications/audio/kid3/default.nix b/pkgs/applications/audio/kid3/default.nix
index b4406dab70e..04d0349c88f 100644
--- a/pkgs/applications/audio/kid3/default.nix
+++ b/pkgs/applications/audio/kid3/default.nix
@@ -3,7 +3,7 @@
 , chromaprint, docbook_xml_dtd_45, docbook_xsl, libxslt
 , id3lib, taglib, mp4v2, flac, libogg, libvorbis
 , zlib, readline , qtbase, qttools, qtmultimedia, qtquickcontrols
-, makeWrapper
+, wrapQtAppsHook
 }:
 
 stdenv.mkDerivation rec {
@@ -16,11 +16,12 @@ stdenv.mkDerivation rec {
     sha256 = "0xkrsjrbr3z8cn8hjf623l28r3b755gr11i0clv8d8i3s10vhbd8";
   };
 
+  nativeBuildInputs = [ wrapQtAppsHook ];
   buildInputs = with stdenv.lib;
   [ pkgconfig cmake python ffmpeg phonon automoc4
     chromaprint docbook_xml_dtd_45 docbook_xsl libxslt
     id3lib taglib mp4v2 flac libogg libvorbis zlib readline
-    qtbase qttools qtmultimedia qtquickcontrols makeWrapper ];
+    qtbase qttools qtmultimedia qtquickcontrols ];
 
   cmakeFlags = [ "-DWITH_APPS=Qt;CLI" ];
   NIX_LDFLAGS = "-lm -lpthread";
@@ -29,10 +30,6 @@ stdenv.mkDerivation rec {
     export DOCBOOKDIR="${docbook_xsl}/xml/xsl/docbook/"
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/kid3-qt --prefix QT_PLUGIN_PATH : $out/lib/qt5/plugins
-  '';
-
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/editors/emacs/25.nix b/pkgs/applications/editors/emacs/25.nix
index 852faeb7918..76009370473 100644
--- a/pkgs/applications/editors/emacs/25.nix
+++ b/pkgs/applications/editors/emacs/25.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, ncurses, xlibsWrapper, libXaw, libXpm, Xaw3d
 , pkgconfig, gettext, libXft, dbus, libpng, libjpeg, libungif
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
-, alsaLib, cairo, acl, gpm, cf-private, AppKit, GSS, ImageIO
+, alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO
 , withX ? !stdenv.isDarwin
 , withGTK2 ? false, gtk2 ? null
 , withGTK3 ? true, gtk3 ? null, gsettings-desktop-schemas ? null
@@ -62,11 +62,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (withX && withGTK3) [ gtk3 gsettings-desktop-schemas ]
     ++ lib.optional (stdenv.isDarwin && withX) cairo
     ++ lib.optionals (withX && withXwidgets) [ webkitgtk24x-gtk3 glib-networking ]
-    ++ lib.optionals stdenv.isDarwin [
-      AppKit GSS ImageIO
-      # Needed for CFNotificationCenterAddObserver symbols.
-      cf-private
-    ];
+    ++ lib.optionals stdenv.isDarwin [ AppKit GSS ImageIO ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index c2756eab961..2de76675c12 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, ncurses, xlibsWrapper, libXaw, libXpm
 , Xaw3d, libXcursor,  pkgconfig, gettext, libXft, dbus, libpng, libjpeg, libungif
 , libtiff, librsvg, gconf, libxml2, imagemagick, gnutls, libselinux
-, alsaLib, cairo, acl, gpm, cf-private, AppKit, GSS, ImageIO, m17n_lib, libotf
+, alsaLib, cairo, acl, gpm, AppKit, GSS, ImageIO, m17n_lib, libotf
 , systemd ? null
 , withX ? !stdenv.isDarwin
 , withNS ? stdenv.isDarwin
@@ -67,11 +67,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals (withX && withGTK3) [ gtk3-x11 gsettings-desktop-schemas ]
     ++ lib.optional (stdenv.isDarwin && withX) cairo
     ++ lib.optionals (withX && withXwidgets) [ webkitgtk ]
-    ++ lib.optionals withNS [
-      AppKit GSS ImageIO
-      # Needed for CFNotificationCenterAddObserver symbols.
-      cf-private
-    ];
+    ++ lib.optionals withNS [ AppKit GSS ImageIO ];
 
   hardeningDisable = [ "format" ];
 
diff --git a/pkgs/applications/editors/emacs/macport.nix b/pkgs/applications/editors/emacs/macport.nix
index 7c21c1cae5e..d51391595f4 100644
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, ncurses, pkgconfig, texinfo, libxml2, gnutls, gettext, autoconf, automake
-, cf-private, AppKit, Carbon, Cocoa, IOKit, OSAKit, Quartz, QuartzCore, WebKit
+, AppKit, Carbon, Cocoa, IOKit, OSAKit, Quartz, QuartzCore, WebKit
 , ImageCaptureCore, GSS, ImageIO # These may be optional
 }:
 
@@ -33,8 +33,6 @@ stdenv.mkDerivation rec {
   buildInputs = [ ncurses libxml2 gnutls texinfo gettext
     AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
     ImageCaptureCore GSS ImageIO   # may be optional
-    # Needed for CFNotificationCenterAddObserver symbols.
-    cf-private
   ];
 
   postUnpack = ''
diff --git a/pkgs/applications/editors/kdevelop5/kdevelop.nix b/pkgs/applications/editors/kdevelop5/kdevelop.nix
index 23ec887ad62..c17239d4fd9 100644
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@@ -43,6 +43,8 @@ mkDerivation rec {
     "-DCLANG_BUILTIN_DIR=${llvmPackages.clang-unwrapped}/lib/clang/${(builtins.parseDrvName llvmPackages.clang.name).version}/include"
   ];
 
+  dontWrapQtApps = true;
+
   postPatch = ''
     # FIXME: temporary until https://invent.kde.org/kde/kdevelop/merge_requests/8 is merged
     substituteInPlace kdevplatform/language/backgroundparser/parsejob.cpp --replace \
@@ -55,8 +57,7 @@ mkDerivation rec {
     wrapProgram "$out/bin/kdevelop!" \
       --prefix PATH ":" "${lib.makeBinPath [ qttools kde-cli-tools ]}"
 
-    wrapProgram "$out/bin/kdevelop" \
-      --prefix QT_PLUGIN_PATH : $out/lib/qt-${qtVersion}/plugins
+    wrapQtApp "$out/bin/kdevelop"
 
     # Fix the (now wrapped) kdevelop! to find things in right places:
     # - Fixup the one use where KDEV_BASEDIR is assumed to contain kdevelop.
diff --git a/pkgs/applications/editors/vim/configurable.nix b/pkgs/applications/editors/vim/configurable.nix
index 5255b04fe5f..4d37b77f61b 100644
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@@ -10,7 +10,7 @@
 , runtimeShell
 
 # apple frameworks
-, CoreServices, CoreData, Cocoa, Foundation, libobjc, cf-private
+, CoreServices, CoreData, Cocoa, Foundation, libobjc
 
 , features          ? "huge" # One of tiny, small, normal, big or huge
 , wrapPythonDrv     ? false
@@ -132,7 +132,7 @@ in stdenv.mkDerivation rec {
     libXmu glib libICE ]
     ++ stdenv.lib.optional (guiSupport == "gtk2") gtk2-x11
     ++ stdenv.lib.optional (guiSupport == "gtk3") gtk3-x11
-    ++ stdenv.lib.optionals darwinSupport [ CoreServices CoreData Cocoa Foundation libobjc cf-private ]
+    ++ stdenv.lib.optionals darwinSupport [ CoreServices CoreData Cocoa Foundation libobjc ]
     ++ stdenv.lib.optional luaSupport lua
     ++ stdenv.lib.optional pythonSupport python
     ++ stdenv.lib.optional tclSupport tcl
diff --git a/pkgs/applications/editors/vim/default.nix b/pkgs/applications/editors/vim/default.nix
index 2f34a6ddeb6..26cd61d182b 100644
--- a/pkgs/applications/editors/vim/default.nix
+++ b/pkgs/applications/editors/vim/default.nix
@@ -6,7 +6,7 @@
     sha256 = "18ifhv5q9prd175q3vxbqf6qyvkk6bc7d2lhqdk0q78i68kv9y0c";
   }
 # apple frameworks
-, cf-private, Carbon, Cocoa
+, Carbon, Cocoa
 }:
 
 let
@@ -19,11 +19,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ gettext pkgconfig ];
   buildInputs = [ ncurses ]
-    ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon Cocoa
-      # Needed for OBJC_CLASS_$_NSArray symbols.
-      cf-private
-    ];
+    ++ stdenv.lib.optionals stdenv.hostPlatform.isDarwin [ Carbon Cocoa ];
 
   configureFlags = [
     "--enable-multibyte"
diff --git a/pkgs/applications/gis/openorienteering-mapper/default.nix b/pkgs/applications/gis/openorienteering-mapper/default.nix
index a5a0492ab87..063e997fec1 100644
--- a/pkgs/applications/gis/openorienteering-mapper/default.nix
+++ b/pkgs/applications/gis/openorienteering-mapper/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, gdal, cmake, ninja, proj, clipper, zlib, qtbase, qttools
-  , qtlocation, qtsensors, doxygen, cups, makeWrapper, qtimageformats
+, qtlocation, qtsensors, doxygen, cups, wrapQtAppsHook, qtimageformats
 }:
 
 stdenv.mkDerivation rec {
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gdal qtbase qttools qtlocation qtimageformats
                   qtsensors clipper zlib proj doxygen cups];
 
-  nativeBuildInputs = [ cmake makeWrapper ninja ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook ninja ];
 
   src = fetchFromGitHub {
     owner = "OpenOrienteering";
@@ -48,9 +48,7 @@ stdenv.mkDerivation rec {
     stdenv.lib.optionalString stdenv.isDarwin ''
     # Fixes "This application failed to start because it could not find or load the Qt
     # platform plugin "cocoa"."
-    wrapProgram $out/Mapper.app/Contents/MacOS/Mapper \
-      --set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-*/plugins/platforms \
-      --set QT_PLUGIN_PATH ${qtbase.bin}/${qtbase.qtPluginPrefix}:${qtimageformats}/${qtbase.qtPluginPrefix}
+    wrapQtApp $out/Mapper.app/Contents/MacOS/Mapper
     mkdir -p $out/bin
     ln -s $out/Mapper.app/Contents/MacOS/Mapper $out/bin/mapper
     '';
diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index a2a6fe3c14f..16b520fa7ed 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -3,7 +3,7 @@
 , libmng, librsvg, libwmf, zlib, libzip, ghostscript, aalib, shared-mime-info
 , python2Packages, libexif, gettext, xorg, glib-networking, libmypaint, gexiv2
 , harfbuzz, mypaint-brushes, libwebp, libheif, libgudev, openexr
-, AppKit, Cocoa, gtk-mac-integration-gtk2, cf-private }:
+, AppKit, Cocoa, gtk-mac-integration-gtk2 }:
 
 let
   inherit (python2Packages) pygtk wrapPython python;
@@ -24,9 +24,7 @@ in stdenv.mkDerivation rec {
     libmng librsvg libwmf zlib libzip ghostscript aalib shared-mime-info libwebp libheif
     python pygtk libexif xorg.libXpm glib-networking libmypaint mypaint-brushes
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
-    # cf-private is needed to get some things not in swift-corefoundation.
-    # For instance _OBJC_CLASS_$_NSArray is missing.
-    AppKit Cocoa gtk-mac-integration-gtk2 cf-private
+    AppKit Cocoa gtk-mac-integration-gtk2
   ] ++ stdenv.lib.optionals stdenv.isLinux [ libgudev ];
 
   pythonPath = [ pygtk ];
diff --git a/pkgs/applications/graphics/ktikz/default.nix b/pkgs/applications/graphics/ktikz/default.nix
index c53c70888b2..4ddc2074f2f 100644
--- a/pkgs/applications/graphics/ktikz/default.nix
+++ b/pkgs/applications/graphics/ktikz/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, fetchpatch
-, pkgconfig, makeWrapper
+, pkgconfig, wrapQtAppsHook
 , poppler, qt5, gnuplot
 }:
 
@@ -36,9 +36,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  nativeBuildInputs = [ pkgconfig qt5.qttools qt5.qmake wrapQtAppsHook ];
   QT_PLUGIN_PATH = "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}";
 
-  nativeBuildInputs = [ pkgconfig qt5.qttools qt5.qmake makeWrapper ];
   buildInputs = [ qt5.qtbase poppler ];
   enableParallelBuilding = true;
 
@@ -50,9 +50,5 @@ stdenv.mkDerivation rec {
     "QCOLLECTIONGENERATORCOMMAND=qhelpgenerator"
   ];
 
-  postFixup = ''
-    wrapProgram "$out/bin/qtikz" \
-      --prefix QT_PLUGIN_PATH : "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}" \
-      --prefix PATH : "${gnuplot}/bin"
-  '';
+  qtWrapperArgs = [ ''--prefix PATH : "${gnuplot}/bin"'' ];
 }
diff --git a/pkgs/applications/kde/ark/default.nix b/pkgs/applications/kde/ark/default.nix
index 598857f2e70..6015cb69d77 100644
--- a/pkgs/applications/kde/ark/default.nix
+++ b/pkgs/applications/kde/ark/default.nix
@@ -1,37 +1,39 @@
 {
-  mkDerivation, lib, makeWrapper,
+  mkDerivation, lib, config,
 
   extra-cmake-modules, kdoctools,
 
-  karchive, kconfig, kcrash, kdbusaddons, ki18n, kiconthemes, kitemmodels,
-  khtml, kio, kparts, kpty, kservice, kwidgetsaddons, libarchive,
+  breeze-icons, karchive, kconfig, kcrash, kdbusaddons, ki18n,
+  kiconthemes, kitemmodels, khtml, kio, kparts, kpty, kservice, kwidgetsaddons,
+
+  libarchive, libzip,
 
   # Archive tools
-  p7zip, unzip, zip,
+  p7zip, lrzip,
 
   # Unfree tools
   unfreeEnableUnrar ? false, unrar,
 }:
 
+let
+  extraTools = [ p7zip lrzip ] ++ lib.optional unfreeEnableUnrar unrar;
+in
+
 mkDerivation {
   name = "ark";
-  nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];
-  propagatedBuildInputs = [
-    karchive kconfig kcrash kdbusaddons khtml ki18n kiconthemes kio kitemmodels
-    kparts kpty kservice kwidgetsaddons libarchive
-  ];
-  outputs = [ "out" "dev" ];
-  postFixup =
-    let
-      PATH =
-        lib.makeBinPath
-        ([ p7zip unzip zip ] ++ lib.optional unfreeEnableUnrar unrar);
-    in ''
-      wrapProgram "$out/bin/ark" --prefix PATH : "${PATH}"
-    '';
   meta = {
     license = with lib.licenses;
       [ gpl2 lgpl3 ] ++ lib.optional unfreeEnableUnrar unfree;
     maintainers = [ lib.maintainers.ttuegel ];
   };
+
+  outputs = [ "out" "dev" ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  buildInputs = [ libarchive libzip ] ++ extraTools;
+  propagatedBuildInputs = [
+    breeze-icons karchive kconfig kcrash kdbusaddons khtml ki18n kiconthemes kio
+    kitemmodels kparts kpty kservice kwidgetsaddons
+  ];
+
+  qtWrapperArgs = [ "--prefix" "PATH" ":" (lib.makeBinPath extraTools) ];
 }
diff --git a/pkgs/applications/kde/okular.nix b/pkgs/applications/kde/okular.nix
index 39fb232b342..377fbe3339a 100644
--- a/pkgs/applications/kde/okular.nix
+++ b/pkgs/applications/kde/okular.nix
@@ -1,18 +1,18 @@
 {
   stdenv, mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  chmlib ? null, discount, djvulibre, ebook_tools, kactivities, karchive, kbookmarks,
-  kcompletion, kconfig, kconfigwidgets, kcoreaddons, kdbusaddons,
-  kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts, kpty, kwallet,
-  kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler, qca-qt5,
-  qtdeclarative, qtsvg, threadweaver, kcrash
+  breeze-icons, chmlib ? null, discount, djvulibre, ebook_tools, kactivities,
+  karchive, kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons,
+  kdbusaddons, kdegraphics-mobipocket, kiconthemes, kjs, khtml, kio, kparts,
+  kpty, kwallet, kwindowsystem, libkexiv2, libspectre, libzip, phonon, poppler,
+  qca-qt5, qtdeclarative, qtsvg, threadweaver, kcrash
 }:
 
 mkDerivation {
   name = "okular";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    discount djvulibre ebook_tools kactivities karchive kbookmarks
+    breeze-icons discount djvulibre ebook_tools kactivities karchive kbookmarks
     kcompletion kconfig kconfigwidgets kcoreaddons kdbusaddons
     kdegraphics-mobipocket kiconthemes kjs khtml kio kparts kpty kwallet
     kwindowsystem libkexiv2 libspectre libzip phonon poppler qca-qt5
diff --git a/pkgs/applications/misc/alacritty/default.nix b/pkgs/applications/misc/alacritty/default.nix
index 490c83bed07..dddf8d93412 100644
--- a/pkgs/applications/misc/alacritty/default.nix
+++ b/pkgs/applications/misc/alacritty/default.nix
@@ -24,9 +24,7 @@
   wayland,
 
   # Darwin Frameworks
-  cf-private,
   AppKit,
-  CoreFoundation,
   CoreGraphics,
   CoreServices,
   CoreText,
@@ -74,11 +72,7 @@ in buildRustPackage rec {
   ];
 
   buildInputs = rpathLibs
-    ++ lib.optionals stdenv.isDarwin [
-      AppKit CoreFoundation CoreGraphics CoreServices CoreText Foundation OpenGL
-      # Needed for CFURLResourceIsReachable symbols.
-      cf-private
-    ];
+    ++ lib.optionals stdenv.isDarwin [ AppKit CoreGraphics CoreServices CoreText Foundation OpenGL ];
 
   outputs = [ "out" "terminfo" ];
 
diff --git a/pkgs/applications/misc/albert/default.nix b/pkgs/applications/misc/albert/default.nix
index 2dda615081c..6fc5f951465 100644
--- a/pkgs/applications/misc/albert/default.nix
+++ b/pkgs/applications/misc/albert/default.nix
@@ -37,11 +37,6 @@ mkDerivation rec {
     rm "$out/lib"
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/albert \
-      --prefix XDG_DATA_DIRS : $out/share
-  '';
-
   meta = with lib; {
     homepage    = https://albertlauncher.github.io/;
     description = "Desktop agnostic launcher";
diff --git a/pkgs/applications/misc/aminal/default.nix b/pkgs/applications/misc/aminal/default.nix
index 1c769e58705..8cb014bb021 100644
--- a/pkgs/applications/misc/aminal/default.nix
+++ b/pkgs/applications/misc/aminal/default.nix
@@ -2,7 +2,6 @@
 , Carbon
 , Cocoa
 , Kernel
-, cf-private
 , fetchFromGitHub
 , lib
 , mesa_glu
@@ -25,12 +24,7 @@ buildGoPackage rec {
       xorg.libXinerama
       xorg.libXrandr
       xorg.libXxf86vm
-    ] ++ lib.optionals stdenv.isDarwin [
-      Carbon
-      Cocoa
-      Kernel
-      cf-private  /* Needed for NSDefaultRunLoopMode */
-    ];
+    ] ++ lib.optionals stdenv.isDarwin [ Carbon Cocoa Kernel ];
 
   src = fetchFromGitHub {
     owner = "liamg";
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index cc7b9cf27c2..9607f428ab9 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, python3Packages, qtbase, makeWrapper }:
+{ lib, fetchurl, python3Packages, qtbase, wrapQtAppsHook }:
 
 python3Packages.buildPythonApplication rec {
   pname = "electron-cash";
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication rec {
     btchip
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ wrapQtAppsHook ];
 
   postPatch = ''
     substituteInPlace contrib/requirements/requirements.txt \
@@ -54,10 +54,6 @@ python3Packages.buildPythonApplication rec {
   postInstall = ''
     substituteInPlace $out/share/applications/electron-cash.desktop \
       --replace "Exec=electron-cash" "Exec=$out/bin/electron-cash"
-
-    # Please remove this when #44047 is fixed
-    wrapProgram $out/bin/electron-cash \
-      --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-5.${lib.versions.minor qtbase.version}/plugins
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/applications/misc/keepassx/community.nix b/pkgs/applications/misc/keepassx/community.nix
index b52cff784e5..7a154e85a6e 100644
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@@ -17,6 +17,7 @@
 , qtsvg
 , qtx11extras
 , quazip
+, wrapQtAppsHook
 , yubikey-personalization
 , zlib
 
@@ -73,12 +74,11 @@ stdenv.mkDerivation rec {
   doCheck = true;
   checkPhase = ''
     export LC_ALL="en_US.UTF-8"
-    export QT_PLUGIN_PATH="${qtbase.bin}/${qtbase.qtPluginPrefix}"
     export QT_QPA_PLATFORM=offscreen
     make test ARGS+="-E testgui --output-on-failure"
   '';
 
-  nativeBuildInputs = [ cmake makeWrapper qttools ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook qttools ];
 
   buildInputs = [
     curl
@@ -102,10 +102,9 @@ stdenv.mkDerivation rec {
   ++ stdenv.lib.optional withKeePassKeeShareSecure quazip
   ++ stdenv.lib.optional stdenv.isDarwin qtmacextras;
 
-  postInstall = optionalString stdenv.isDarwin ''
+  preFixup = optionalString stdenv.isDarwin ''
     # Make it work without Qt in PATH.
-    wrapProgram $out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC \
-      --set QT_PLUGIN_PATH ${qtbase.bin}/${qtbase.qtPluginPrefix}
+    wrapQtApp $out/Applications/KeePassXC.app/Contents/MacOS/KeePassXC
   '';
 
   meta = {
diff --git a/pkgs/applications/misc/kitty/default.nix b/pkgs/applications/misc/kitty/default.nix
index 9b77bdcd2a5..63e77ec0e67 100644
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@@ -9,7 +9,6 @@
   IOKit,
   Kernel,
   OpenGL,
-  cf-private,
   libicns,
   libpng,
   librsvg,
@@ -40,7 +39,6 @@ buildPythonApplication rec {
     IOKit
     Kernel
     OpenGL
-    cf-private
     libpng
     python3
     zlib
diff --git a/pkgs/applications/misc/masterpdfeditor/default.nix b/pkgs/applications/misc/masterpdfeditor/default.nix
index 7acebfad488..eb0e61ba6d7 100644
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, sane-backends, qtbase, qtsvg, nss, autoPatchelfHook, lib, makeWrapper }:
+{ stdenv, fetchurl, sane-backends, qtbase, qtsvg, nss, autoPatchelfHook, lib, wrapQtAppsHook }:
 
 let
   version = "5.4.10";
@@ -11,17 +11,12 @@ in stdenv.mkDerivation {
     sha256 = "1902ahb2g9xanrip1n0ihr31az8sv9fsvzddnzf70kbwlfclnqf7";
   };
 
-  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];
+  nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];
 
   buildInputs = [ nss qtbase qtsvg sane-backends stdenv.cc.cc ];
 
   dontStrip = true;
 
-  # Please remove this when #44047 is fixed
-  postInstall = ''
-    wrapProgram $out/bin/masterpdfeditor5 --prefix QT_PLUGIN_PATH : ${lib.getBin qtbase}/${qtbase.qtPluginPrefix}
-  '';
-
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/misc/subsurface/default.nix b/pkgs/applications/misc/subsurface/default.nix
index 50bb1df2eef..7bac1db813f 100644
--- a/pkgs/applications/misc/subsurface/default.nix
+++ b/pkgs/applications/misc/subsurface/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub, autoreconfHook, cmake, makeWrapper, pkgconfig, qmake
+{ stdenv, fetchurl, fetchFromGitHub, autoreconfHook, cmake, wrapQtAppsHook, pkgconfig, qmake
 , curl, grantlee, libgit2, libusb, libssh2, libxml2, libxslt, libzip, zlib
 , qtbase, qtconnectivity, qtlocation, qtsvg, qttools, qtwebkit, libXcomposite
 }:
@@ -79,18 +79,13 @@ in stdenv.mkDerivation rec {
     qtbase qtconnectivity qtsvg qttools qtwebkit
   ];
 
-  nativeBuildInputs = [ cmake makeWrapper pkgconfig ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook pkgconfig ];
 
   cmakeFlags = [
     "-DLIBDC_FROM_PKGCONFIG=ON"
     "-DNO_PRINTING=OFF"
   ];
 
-  postInstall = ''
-    wrapProgram $out/bin/subsurface \
-      --prefix QT_PLUGIN_PATH : "${googlemaps}/${googlemaps.pluginsSubdir}"
-  '';
-
   enableParallelBuilding = true;
 
   passthru = { inherit version libdc googlemaps; };
diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix
index 25855c2a613..5f12bdb4dfc 100644
--- a/pkgs/applications/misc/synergy/default.nix
+++ b/pkgs/applications/misc/synergy/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, fetchurl, cmake, xlibsWrapper
-, ApplicationServices, Carbon, Cocoa, CoreServices, ScreenSaver, cf-private
+, ApplicationServices, Carbon, Cocoa, CoreServices, ScreenSaver
 , libX11, libXi, libXtst, libXrandr, xinput, curl, openssl, unzip }:
 
 stdenv.mkDerivation rec {
@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cmake curl openssl
   ] ++ lib.optionals stdenv.isDarwin [
-    ApplicationServices Carbon Cocoa CoreServices ScreenSaver cf-private
+    ApplicationServices Carbon Cocoa CoreServices ScreenSaver
   ] ++ lib.optionals stdenv.isLinux [ xlibsWrapper libX11 libXi libXtst libXrandr xinput ];
 
   installPhase = ''
diff --git a/pkgs/applications/misc/xpdf/default.nix b/pkgs/applications/misc/xpdf/default.nix
index eb76448391e..d524482dee7 100644
--- a/pkgs/applications/misc/xpdf/default.nix
+++ b/pkgs/applications/misc/xpdf/default.nix
@@ -1,6 +1,6 @@
 { enableGUI ? true, enablePDFtoPPM ? true, useT1Lib ? false
 , stdenv, fetchurl, zlib, libpng, freetype ? null, t1lib ? null
-, cmake, qtbase ? null, qtsvg ? null, makeWrapper
+, cmake, qtbase ? null, qtsvg ? null, wrapQtAppsHook
 }:
 
 assert enableGUI -> qtbase != null && qtsvg != null && freetype != null;
@@ -22,7 +22,9 @@ stdenv.mkDerivation {
   # https://cmake.org/cmake/help/v3.10/command/cmake_minimum_required.html
   patches = stdenv.lib.optional stdenv.isDarwin  ./cmake_version.patch;
 
-  nativeBuildInputs = [ cmake makeWrapper ];
+  nativeBuildInputs =
+    [ cmake ]
+    ++ stdenv.lib.optional enableGUI wrapQtAppsHook;
 
   cmakeFlags = ["-DSYSTEM_XPDFRC=/etc/xpdfrc" "-DA4_PAPER=ON"];
 
@@ -36,11 +38,6 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "format" ];
 
-  postInstall = stdenv.lib.optionalString (stdenv.isDarwin && enableGUI) ''
-    wrapProgram $out/bin/xpdf \
-      --set QT_PLUGIN_PATH ${qtbase.bin}/${qtbase.qtPluginPrefix}:${qtsvg.bin}/${qtbase.qtPluginPrefix}
-  '';
-
   meta = with stdenv.lib; {
     homepage = https://www.xpdfreader.com;
     description = "Viewer for Portable Document Format (PDF) files";
diff --git a/pkgs/applications/misc/zola/default.nix b/pkgs/applications/misc/zola/default.nix
index 48f5b216ea1..7418640e072 100644
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, cmake, pkgconfig, openssl, CoreServices, cf-private }:
+{ stdenv, fetchFromGitHub, rustPlatform, cmake, pkgconfig, openssl, CoreServices }:
 
 rustPlatform.buildRustPackage rec {
   pname = "zola";
@@ -14,7 +14,8 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "1brmlg6nqyls1v62z0fg0km150q9m7h71wy67lidcnw76icmqr24";
 
   nativeBuildInputs = [ cmake pkgconfig ];
-  buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices cf-private ];
+  buildInputs = [ openssl ]
+    ++ stdenv.lib.optional stdenv.isDarwin CoreServices;
 
   postInstall = ''
     install -D -m 444 completions/zola.bash \
diff --git a/pkgs/applications/networking/browsers/qtchan/default.nix b/pkgs/applications/networking/browsers/qtchan/default.nix
index df956addf5c..1519c382ebb 100644
--- a/pkgs/applications/networking/browsers/qtchan/default.nix
+++ b/pkgs/applications/networking/browsers/qtchan/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   ];
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ qt.qmake makeWrapper ];
+  nativeBuildInputs = [ qt.qmake qt.wrapQtAppsHook ];
   buildInputs = [ qt.qtbase ];
 
   qmakeFlags = [ "CONFIG-=app_bundle" ];
@@ -29,11 +29,6 @@ stdenv.mkDerivation rec {
     cp qtchan $out/bin
   '';
 
-  preFixup = ''
-    wrapProgram $out/bin/qtchan \
-      --suffix QT_PLUGIN_PATH : ${qt.qtbase.bin}/${qt.qtbase.qtPluginPrefix}
-  '';
-
   meta = with stdenv.lib; {
     description = "4chan browser in qt5";
     homepage    = "https://github.com/siavash119/qtchan";
diff --git a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
index df06dc49eef..ab5f6c154df 100644
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/generic.nix
@@ -1,7 +1,7 @@
 { stable, version, sha256Hash, archPatchesRevision, archPatchesHash }:
 
 { mkDerivation, lib, fetchFromGitHub, fetchsvn
-, pkgconfig, pythonPackages, cmake, wrapGAppsHook, gcc8
+, pkgconfig, pythonPackages, cmake, wrapGAppsHook, wrapQtAppsHook, gcc8
 , qtbase, qtimageformats, gtk3, libappindicator-gtk3, libnotify, xdg_utils
 , dee, ffmpeg, openalSoft, minizip, libopus, alsaLib, libpulseaudio, range-v3
 }:
@@ -43,7 +43,7 @@ mkDerivation rec {
       --replace '"notify"' '"${libnotify}/lib/libnotify.so"'
   '';
 
-  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook gcc8 ];
+  nativeBuildInputs = [ pkgconfig pythonPackages.gyp cmake wrapGAppsHook wrapQtAppsHook gcc8 ];
 
   # We want to run wrapProgram manually (with additional parameters)
   dontWrapGApps = true;
@@ -137,12 +137,13 @@ mkDerivation rec {
     done
   '';
 
+  dontWrapQtApps = true;
   postFixup = ''
     # This is necessary to run Telegram in a pure environment.
     # We also use gappsWrapperArgs from wrapGAppsHook.
     wrapProgram $out/bin/telegram-desktop \
       "''${gappsWrapperArgs[@]}" \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}" \
+      "''${qtWrapperArgs[@]}" \
       --prefix PATH : ${xdg_utils}/bin \
       --set XDG_RUNTIME_DIR "XDG-RUNTIME-DIR"
     sed -i $out/bin/telegram-desktop \
diff --git a/pkgs/applications/networking/linssid/default.nix b/pkgs/applications/networking/linssid/default.nix
index be010c47179..14ee8095247 100644
--- a/pkgs/applications/networking/linssid/default.nix
+++ b/pkgs/applications/networking/linssid/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qtbase, qtsvg, qmake, pkgconfig, boost, wirelesstools, iw, qwt, makeWrapper }:
+{ stdenv, fetchurl, qtbase, qtsvg, qmake, pkgconfig, boost, wirelesstools, iw, qwt, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "linssid-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "13d35rlcjncd8lx3khkgn9x8is2xjd5fp6ns5xsn3w6l4xj9b4gl";
   };
 
-  nativeBuildInputs = [ pkgconfig qmake makeWrapper ];
+  nativeBuildInputs = [ pkgconfig qmake wrapQtAppsHook ];
   buildInputs = [ qtbase qtsvg boost qwt ];
 
   patches = [ ./0001-unbundled-qwt.patch ];
@@ -26,11 +26,8 @@ stdenv.mkDerivation rec {
     rm -fr qwt-lib
   '';
 
-  postInstall = ''
-    wrapProgram $out/bin/linssid \
-      --prefix QT_PLUGIN_PATH : ${qtbase}/${qtbase.qtPluginPrefix} \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ wirelesstools iw ]}  
-      '';
+  qtWrapperArgs =
+    [ ''--prefix PATH : ${stdenv.lib.makeBinPath [ wirelesstools iw ]}'' ];
 
   meta = with stdenv.lib; {
     description = "Graphical wireless scanning for Linux";
diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index a5c8162701b..9642c54a26a 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchFromGitHub, fetchpatch, makeWrapper, pkgconfig
+{ stdenv, fetchurl, fetchFromGitHub, fetchpatch, pkgconfig
 , qt4, qmake4Hook, qt5, avahi, boost, libopus, libsndfile, protobuf3_6, speex, libcap
 , alsaLib, python
 , jackSupport ? false, libjack2 ? null
@@ -158,11 +158,6 @@ in {
   murmur_git = (server gitSource).overrideAttrs (old: {
     meta = old.meta // { broken = iceSupport; };
 
-    nativeBuildInputs = old.nativeBuildInputs or [] ++ [ makeWrapper ];
-
-    installPhase = old.installPhase or "" + ''
-      wrapProgram $out/bin/murmurd --suffix QT_PLUGIN_PATH : \
-        ${getBin qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}
-    '';
+    nativeBuildInputs = old.nativeBuildInputs or [] ++ [ qt5.wrapQtAppsHook ];
   });
 }
diff --git a/pkgs/applications/networking/newsreaders/quiterss/default.nix b/pkgs/applications/networking/newsreaders/quiterss/default.nix
index b0bc5edba84..898b7706bd6 100644
--- a/pkgs/applications/networking/newsreaders/quiterss/default.nix
+++ b/pkgs/applications/networking/newsreaders/quiterss/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, qmake, pkgconfig, makeWrapper
+{ stdenv, fetchFromGitHub, qmake, pkgconfig, wrapQtAppsHook
 , qtbase, qttools, qtwebkit, sqlite
 }:
 
@@ -13,14 +13,9 @@ stdenv.mkDerivation rec {
     sha256 = "0xav9qr8n6310636nfbgx4iix65fs3ya5rz2isxsf38bkjm7r3pa";
   };
 
-  nativeBuildInputs = [ qmake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
   buildInputs = [ qtbase qttools qtwebkit sqlite.dev ];
 
-  postFixup = ''
-    wrapProgram $out/bin/quiterss \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}"
-  '';
-
   meta = with stdenv.lib; {
     description = "A Qt-based RSS/Atom news feed reader";
     longDescription = ''
diff --git a/pkgs/applications/networking/nextcloud-client/default.nix b/pkgs/applications/networking/nextcloud-client/default.nix
index 7aa7d88149f..37eb248fb48 100644
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchgit, cmake, pkgconfig, qtbase, qtwebkit, qtkeychain, qttools, sqlite
-, inotify-tools, makeWrapper, openssl_1_1, pcre, qtwebengine, libsecret
+, inotify-tools, wrapQtAppsHook, openssl_1_1, pcre, qtwebengine, libsecret
 , libcloudproviders
 }:
 
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ pkgconfig cmake makeWrapper ];
+  nativeBuildInputs = [ pkgconfig cmake wrapQtAppsHook ];
 
   buildInputs = [ qtbase qtwebkit qtkeychain qttools qtwebengine sqlite openssl_1_1.out pcre inotify-tools libcloudproviders ];
 
@@ -31,13 +31,13 @@ stdenv.mkDerivation rec {
     "-DINOTIFY_INCLUDE_DIR=${inotify-tools}/include"
   ];
 
+  qtWrapperArgs = [
+    ''--prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libsecret ]}''
+  ];
+
   postInstall = ''
     sed -i 's/\(Icon.*\)=nextcloud/\1=Nextcloud/g' \
     $out/share/applications/nextcloud.desktop
-
-    wrapProgram "$out/bin/nextcloud" \
-      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libsecret ]} \
-      --prefix QT_PLUGIN_PATH : ${qtbase}/${qtbase.qtPluginPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/protonmail-bridge/default.nix b/pkgs/applications/networking/protonmail-bridge/default.nix
index 2870f3158fb..807b8116b46 100644
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtsvg, qtdeclarative, qttools, full,
-  libsecret, libGL, libpulseaudio, glib, makeWrapper, makeDesktopItem }:
+{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtsvg, qtdeclarative, qttools, full
+, libsecret, libGL, libpulseaudio, glib, wrapQtAppsHook, makeDesktopItem }:
 
 let
   version = "1.1.5-1";
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
     sha256 = "1y5mphrs60zd6km9z64vskk70q9zzw4g6js7qvgl572wv81w2l75";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ wrapQtAppsHook ];
 
   sourceRoot = ".";
 
@@ -60,18 +60,11 @@ in stdenv.mkDerivation rec {
       libpulseaudio
       glib
     ];
-
-    qtPath = prefix: "${full}/${prefix}";
   in ''
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${rpath}" \
       $out/lib/protonmail-bridge
-
-    wrapProgram $out/lib/protonmail-bridge \
-      --set QT_PLUGIN_PATH "${qtPath qtbase.qtPluginPrefix}" \
-      --set QML_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \
-      --set QML2_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/networking/sniffers/wireshark/default.nix b/pkgs/applications/networking/sniffers/wireshark/default.nix
index 401e4964801..ac9fa8f4ce8 100644
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@@ -30,7 +30,7 @@ in stdenv.mkDerivation {
 
   nativeBuildInputs = [
     bison cmake extra-cmake-modules flex pkgconfig
-  ];
+  ] ++ optional withQt qt5.wrapQtAppsHook;
 
   buildInputs = [
     gettext pcre perl libpcap lua5 libssh nghttp2 openssl libgcrypt
@@ -70,12 +70,9 @@ in stdenv.mkDerivation {
         done
     done
 
-    wrapProgram $out/Applications/Wireshark.app/Contents/MacOS/Wireshark \
-        --set QT_PLUGIN_PATH ${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}
+    wrapQtApp $out/Applications/Wireshark.app/Contents/MacOS/Wireshark
   '' else optionalString withQt ''
     install -Dm644 -t $out/share/applications ../wireshark.desktop
-    wrapProgram $out/bin/wireshark \
-        --set QT_PLUGIN_PATH ${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}
 
     substituteInPlace $out/share/applications/*.desktop \
         --replace "Exec=wireshark" "Exec=$out/bin/wireshark"
diff --git a/pkgs/applications/office/kmymoney/default.nix b/pkgs/applications/office/kmymoney/default.nix
index a29e256675f..d3a216fb71a 100644
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchurl, doxygen, extra-cmake-modules, graphviz, kdoctools
+, wrapQtAppsHook
 
 , akonadi, alkimia, aqbanking, gmp, gwenhywfar, kactivities, karchive
 , kcmutils, kcontacts, kdewebkit, kdiagram, kholidays, kidentitymanagement
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     doxygen extra-cmake-modules graphviz kdoctools python2Packages.wrapPython
+    wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -57,13 +59,11 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = stdenv.hostPlatform == stdenv.buildPlatform;
   installCheckInputs = [ xvfb_run ];
-  installCheckPhase = let
-    pluginPath = "${qtbase.bin}/${qtbase.qtPluginPrefix}";
-  in lib.optionalString doInstallCheck ''
-    QT_PLUGIN_PATH=${lib.escapeShellArg pluginPath} \
+  installCheckPhase =
+    lib.optionalString doInstallCheck ''
       xvfb-run -s '-screen 0 1024x768x24' make test \
-      ARGS="-E '(reports-chart-test)'" # Test fails, so exclude it for now.
-  '';
+        ARGS="-E '(reports-chart-test)'" # Test fails, so exclude it for now.
+    '';
 
   meta = {
     description = "Personal finance manager for KDE";
diff --git a/pkgs/applications/office/scribus/unstable.nix b/pkgs/applications/office/scribus/unstable.nix
index 32758b462f7..eb2bebb3993 100644
--- a/pkgs/applications/office/scribus/unstable.nix
+++ b/pkgs/applications/office/scribus/unstable.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchsvn, makeWrapper, pkgconfig, cmake, qtbase, cairo, pixman,
+{ stdenv, fetchsvn, wrapQtAppsHook, pkgconfig, cmake, qtbase, cairo, pixman,
 boost, cups, fontconfig, freetype, hunspell, libjpeg, libtiff, libxml2, lcms2,
 podofo, poppler, poppler_data, python2, harfbuzz, qtimageformats, qttools }:
 
 let
   pythonEnv = python2.withPackages(ps: [ps.tkinter ps.pillow]);
   revision = "22806";
-in 
+in
 stdenv.mkDerivation rec {
   name = "scribus-unstable-${version}";
   version = "2019-01-16";
@@ -18,17 +18,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  nativeBuildInputs = [ wrapQtAppsHook ];
   buildInputs = [
-    makeWrapper pkgconfig cmake qtbase cairo pixman boost cups fontconfig
+    pkgconfig cmake qtbase cairo pixman boost cups fontconfig
     freetype hunspell libjpeg libtiff libxml2 lcms2 podofo poppler
     poppler_data pythonEnv harfbuzz qtimageformats qttools
   ];
 
-  postFixup = ''
-    wrapProgram $out/bin/scribus \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}"
-  '';
-
   meta = {
     maintainers = [ stdenv.lib.maintainers.erictapen ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/applications/science/astronomy/stellarium/default.nix b/pkgs/applications/science/astronomy/stellarium/default.nix
index 2480b80316e..e3c66199f11 100644
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, lib, fetchFromGitHub
 , cmake, freetype, libpng, libGLU_combined, openssl, perl, libiconv
 , qtscript, qtserialport, qttools
-, qtmultimedia, qtlocation, makeWrapper, qtbase
+, qtmultimedia, qtlocation, qtbase, wrapQtAppsHook
 }:
 
 mkDerivation rec {
@@ -15,18 +15,13 @@ mkDerivation rec {
     sha256 = "0hf1wv2bb5j7ny2xh29mj9m4hjblhn02zylay8gl85w7xlqs7s5r";
   };
 
-  nativeBuildInputs = [ cmake perl ];
+  nativeBuildInputs = [ cmake perl wrapQtAppsHook ];
 
   buildInputs = [
     freetype libpng libGLU_combined openssl libiconv qtscript qtserialport qttools
-    qtmultimedia qtlocation qtbase makeWrapper
+    qtmultimedia qtlocation qtbase
   ];
 
-  postInstall = ''
-    wrapProgram $out/bin/stellarium \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/lib/qt-5.${lib.versions.minor qtbase.version}/plugins"
-  '';
-
   meta = with lib; {
     description = "Free open-source planetarium";
     homepage = http://stellarium.org/;
diff --git a/pkgs/applications/science/electronics/dsview/default.nix b/pkgs/applications/science/electronics/dsview/default.nix
index ecbbeff108d..55e8a7b4ffe 100644
--- a/pkgs/applications/science/electronics/dsview/default.nix
+++ b/pkgs/applications/science/electronics/dsview/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, cmake,
 libzip, boost, fftw, qtbase,
-libusb, makeWrapper, libsigrok4dsl, libsigrokdecode4dsl
+libusb, wrapQtAppsHook, libsigrok4dsl, libsigrokdecode4dsl
 }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     ./install.patch
   ];
 
-  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
 
   buildInputs = [
    boost fftw qtbase libusb libzip libsigrokdecode4dsl libsigrok4dsl
@@ -32,11 +32,6 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  postFixup = ''
-    wrapProgram $out/bin/DSView --suffix QT_PLUGIN_PATH : \
-      ${qtbase.bin}/${qtbase.qtPluginPrefix}
-  '';
-
   meta = with stdenv.lib; {
     description = "A GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
     homepage = https://www.dreamsourcelab.com/;
diff --git a/pkgs/applications/science/misc/root/5.nix b/pkgs/applications/science/misc/root/5.nix
index 871f5ece9cf..0199373b082 100644
--- a/pkgs/applications/science/misc/root/5.nix
+++ b/pkgs/applications/science/misc/root/5.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, fetchpatch, cmake, pcre, pkgconfig, python2
 , libX11, libXpm, libXft, libXext, libGLU_combined, zlib, libxml2, lzma, gsl_1
-, Cocoa, OpenGL, cf-private, noSplash ? false }:
+, Cocoa, OpenGL, noSplash ? false }:
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake pcre python2 zlib libxml2 lzma gsl_1 ]
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU_combined ]
-    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL cf-private ]
+    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
     ;
 
   patches = [
diff --git a/pkgs/applications/science/misc/root/default.nix b/pkgs/applications/science/misc/root/default.nix
index 8b9573ce4e8..2ec1ded68a2 100644
--- a/pkgs/applications/science/misc/root/default.nix
+++ b/pkgs/applications/science/misc/root/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, cmake, pcre, pkgconfig, python2
 , libX11, libXpm, libXft, libXext, libGLU_combined, zlib, libxml2, lz4, lzma, gsl, xxHash
-, Cocoa, OpenGL, cf-private, noSplash ? false }:
+, Cocoa, OpenGL, noSplash ? false }:
 
 stdenv.mkDerivation rec {
   name = "root-${version}";
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ cmake pcre python2 zlib libxml2 lz4 lzma gsl xxHash ]
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXpm libXft libXext libGLU_combined ]
-    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL cf-private ]
+    ++ stdenv.lib.optionals (stdenv.isDarwin) [ Cocoa OpenGL ]
     ;
 
   patches = [
diff --git a/pkgs/applications/version-management/p4v/default.nix b/pkgs/applications/version-management/p4v/default.nix
index f82b80067bf..314c379c4e6 100644
--- a/pkgs/applications/version-management/p4v/default.nix
+++ b/pkgs/applications/version-management/p4v/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtscript, qtsensors, qtwebkit, openssl, xkeyboard_config, makeWrapper }:
+{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtscript, qtsensors, qtwebkit, openssl, xkeyboard_config, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "p4v-${version}";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   dontBuild = true;
-  nativeBuildInputs = [makeWrapper];
+  nativeBuildInputs = [ wrapQtAppsHook ];
 
   ldLibraryPath = lib.makeLibraryPath [
       stdenv.cc.cc.lib
@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
       openssl
   ];
 
+  dontWrapQtApps = true;
   installPhase = ''
     mkdir $out
     cp -r bin $out
@@ -31,10 +32,9 @@ stdenv.mkDerivation rec {
     for f in $out/bin/*.bin ; do
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $f
 
-      wrapProgram $f \
+      wrapQtApp $f \
         --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
-        --suffix QT_XKB_CONFIG_ROOT : ${xkeyboard_config}/share/X11/xkb \
-        --suffix QT_PLUGIN_PATH : ${qtbase.bin}/${qtbase.qtPluginPrefix}
+        --suffix QT_XKB_CONFIG_ROOT : ${xkeyboard_config}/share/X11/xkb
     done
   '';
 
diff --git a/pkgs/applications/video/avidemux/default.nix b/pkgs/applications/video/avidemux/default.nix
index 7912fe60bbc..8e87a0589c5 100644
--- a/pkgs/applications/video/avidemux/default.nix
+++ b/pkgs/applications/video/avidemux/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, cmake, pkgconfig
 , zlib, gettext, libvdpau, libva, libXv, sqlite
 , yasm, freetype, fontconfig, fribidi
-, makeWrapper, libXext, libGLU, qttools, qtbase
+, makeWrapper, libXext, libGLU, qttools, qtbase, wrapQtAppsHook
 , alsaLib
 , withX265 ? true, x265
 , withX264 ? true, x264
@@ -37,7 +37,9 @@ stdenv.mkDerivation rec {
     ./bootstrap_logging.patch
   ];
 
-  nativeBuildInputs = [ yasm cmake pkgconfig ];
+  nativeBuildInputs =
+    [ yasm cmake pkgconfig ]
+    ++ lib.optional withQT wrapQtAppsHook;
   buildInputs = [
     zlib gettext libvdpau libva libXv sqlite fribidi fontconfig
     freetype alsaLib libXext libGLU makeWrapper
@@ -55,7 +57,10 @@ stdenv.mkDerivation rec {
 
   buildCommand = let
     qtVersion = "5.${stdenv.lib.versions.minor qtbase.version}";
-    wrapProgram = f: "wrapProgram ${f} --set ADM_ROOT_DIR $out --prefix LD_LIBRARY_PATH : ${libXext}/lib";
+    wrapWith = makeWrapper: filename:
+      "${makeWrapper} ${filename} --set ADM_ROOT_DIR $out --prefix LD_LIBRARY_PATH : ${libXext}/lib";
+    wrapQtApp = wrapWith "wrapQtApp";
+    wrapProgram = wrapWith "wrapProgram";
   in ''
     unpackPhase
     cd "$sourceRoot"
@@ -74,8 +79,8 @@ stdenv.mkDerivation rec {
     ${wrapProgram "$out/bin/avidemux3_cli"}
 
     ${stdenv.lib.optionalString withQT ''
-      ${wrapProgram "$out/bin/avidemux3_qt5"} --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-${qtVersion}/plugins
-      ${wrapProgram "$out/bin/avidemux3_jobs_qt5"} --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-${qtVersion}/plugins
+      ${wrapQtApp "$out/bin/avidemux3_qt5"}
+      ${wrapQtApp "$out/bin/avidemux3_jobs_qt5"}
     ''}
 
     ln -s "$out/bin/avidemux3_${default}" "$out/bin/avidemux"
diff --git a/pkgs/applications/video/minitube/default.nix b/pkgs/applications/video/minitube/default.nix
index 3b8dce90243..5ee437a19be 100644
--- a/pkgs/applications/video/minitube/default.nix
+++ b/pkgs/applications/video/minitube/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, phonon, phonon-backend-vlc, qtbase, qmake
+{ stdenv, fetchFromGitHub, wrapQtAppsHook, phonon, phonon-backend-vlc, qtbase, qmake
 , qtdeclarative, qttools
 
 # "Free" key generated by nckx <github@tobias.gr>. I no longer have a Google
@@ -17,17 +17,12 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [ phonon phonon-backend-vlc qtbase qtdeclarative qttools ];
-  nativeBuildInputs = [ makeWrapper qmake ];
+  nativeBuildInputs = [ wrapQtAppsHook qmake ];
 
   qmakeFlags = [ "DEFINES+=APP_GOOGLE_API_KEY=${withAPIKey}" ];
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    wrapProgram $out/bin/minitube \
-      --prefix QT_PLUGIN_PATH : "${phonon-backend-vlc}/lib/qt-5.${stdenv.lib.versions.minor qtbase.version}/plugins"
-  '';
-
   meta = with stdenv.lib; {
     description = "Stand-alone YouTube video player";
     longDescription = ''
diff --git a/pkgs/build-support/cc-wrapper/setup-hook.sh b/pkgs/build-support/cc-wrapper/setup-hook.sh
index 28060de7411..211b5063291 100644
--- a/pkgs/build-support/cc-wrapper/setup-hook.sh
+++ b/pkgs/build-support/cc-wrapper/setup-hook.sh
@@ -70,12 +70,12 @@ ccWrapper_addCVars () {
     local role_post role_pre
     getHostRoleEnvHook
 
-    if [[ -d "$1/include" ]]; then
-        export NIX_${role_pre}CFLAGS_COMPILE+=" ${ccIncludeFlag:--isystem} $1/include"
+    if [ -d "$1/include" ]; then
+        export NIX_${role_pre}CFLAGS_COMPILE+=" -isystem $1/include"
     fi
 
-    if [[ -d "$1/Library/Frameworks" ]]; then
-        export NIX_${role_pre}CFLAGS_COMPILE+=" -F$1/Library/Frameworks"
+    if [ -d "$1/Library/Frameworks" ]; then
+        export NIX_${role_pre}CFLAGS_COMPILE+=" -iframework $1/Library/Frameworks"
     fi
 }
 
diff --git a/pkgs/desktops/plasma-5/plasma-workspace/default.nix b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
index 680021e350b..1403c9e4c8b 100644
--- a/pkgs/desktops/plasma-5/plasma-workspace/default.nix
+++ b/pkgs/desktops/plasma-5/plasma-workspace/default.nix
@@ -34,7 +34,8 @@ mkDerivation {
 
     qtgraphicaleffects qtquickcontrols qtquickcontrols2 qtscript qtwayland qtx11extras
   ];
-  outputs = [ "bin" "dev" "out" ];
+  propagatedUserEnvPkgs = [ qtgraphicaleffects ];
+  outputs = [ "out" "dev" ];
 
   cmakeFlags = [
     "-DNIXPKGS_XMESSAGE=${getBin xmessage}/bin/xmessage"
@@ -45,7 +46,7 @@ mkDerivation {
     "-DNIXPKGS_XPROP=${getBin xprop}/bin/xprop"
     "-DNIXPKGS_ID=${getBin coreutils}/bin/id"
     "-DNIXPKGS_DBUS_UPDATE_ACTIVATION_ENVIRONMENT=${getBin dbus}/bin/dbus-update-activation-environment"
-    "-DNIXPKGS_START_KDEINIT_WRAPPER=${getLib kinit}/lib/libexec/kf5/start_kdeinit_wrapper"
+    "-DNIXPKGS_START_KDEINIT_WRAPPER=${getLib kinit}/libexec/kf5/start_kdeinit_wrapper"
     "-DNIXPKGS_QDBUS=${getBin qttools}/bin/qdbus"
     "-DNIXPKGS_KWRAPPER5=${getBin kinit}/bin/kwrapper5"
     "-DNIXPKGS_KREADCONFIG5=${getBin kconfig}/bin/kreadconfig5"
@@ -72,10 +73,6 @@ mkDerivation {
 
   preConfigure = ''
     NIX_CFLAGS_COMPILE+=" -DNIXPKGS_KDOSTARTUPCONFIG5=\"''${!outputBin}/bin/kdostartupconfig5\""
-    cmakeFlags+=" -DNIXPKGS_STARTPLASMA=''${!outputBin}/lib/libexec/startplasma"
-  '';
-
-  postInstall = ''
-    moveToOutput lib/libexec/startplasma ''${!outputBin}
+    cmakeFlags+=" -DNIXPKGS_STARTPLASMA=''${!outputBin}/libexec/startplasma"
   '';
 }
diff --git a/pkgs/development/compilers/llvm/4/lldb.nix b/pkgs/development/compilers/llvm/4/lldb.nix
index 0be8a4d4186..325149fc19b 100644
--- a/pkgs/development/compilers/llvm/4/lldb.nix
+++ b/pkgs/development/compilers/llvm/4/lldb.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/5/lldb.nix b/pkgs/development/compilers/llvm/5/lldb.nix
index 7be9a7e47b7..5e670d4de15 100644
--- a/pkgs/development/compilers/llvm/5/lldb.nix
+++ b/pkgs/development/compilers/llvm/5/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/6/lldb.nix b/pkgs/development/compilers/llvm/6/lldb.nix
index d33de248835..9571e7ab5a6 100644
--- a/pkgs/development/compilers/llvm/6/lldb.nix
+++ b/pkgs/development/compilers/llvm/6/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/llvm/7/lldb.nix b/pkgs/development/compilers/llvm/7/lldb.nix
index f58871f1d7c..1b2dff2c76c 100644
--- a/pkgs/development/compilers/llvm/7/lldb.nix
+++ b/pkgs/development/compilers/llvm/7/lldb.nix
@@ -9,6 +9,7 @@
 , libxml2
 , llvm
 , clang-unwrapped
+, perl
 , python
 , version
 , darwin
@@ -19,6 +20,11 @@ stdenv.mkDerivation {
 
   src = fetch "lldb" "0klsscg1sczc4nw2l53xggi969k361cng2sjjrfp3bv4g5x14s4v";
 
+  nativeBuildInputs = [ cmake perl python which swig ];
+  buildInputs = [ ncurses zlib libedit libxml2 llvm ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
+
+
   postPatch = ''
     # Fix up various paths that assume llvm and clang are installed in the same place
     sed -i 's,".*ClangConfig.cmake","${clang-unwrapped}/lib/cmake/clang/ClangConfig.cmake",' \
@@ -30,22 +36,21 @@ stdenv.mkDerivation {
     sed -i -e 's,message(SEND_ERROR "Cannot find debugserver on system."),,' \
            -e 's,string(STRIP ''${XCODE_DEV_DIR} XCODE_DEV_DIR),,' \
            tools/debugserver/source/CMakeLists.txt
+
+    # Fix /usr/bin references for sandboxed builds.
+    patchShebangs scripts
   '';
 
-  nativeBuildInputs = [ cmake python which swig ];
-  buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
+  cmakeFlags = [
+    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+    "-DSKIP_DEBUGSERVER=ON"
+  ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
 
   NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang "-I${libxml2.dev}/include/libxml2";
 
-  cmakeFlags = [
-    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
-    "-DSKIP_DEBUGSERVER=ON"
-  ];
-
   enableParallelBuilding = true;
 
   postInstall = ''
diff --git a/pkgs/development/compilers/llvm/8/lldb.nix b/pkgs/development/compilers/llvm/8/lldb.nix
index ae9198e99d2..861ef1f3510 100644
--- a/pkgs/development/compilers/llvm/8/lldb.nix
+++ b/pkgs/development/compilers/llvm/8/lldb.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ cmake python which swig ];
   buildInputs = [ ncurses zlib libedit libxml2 llvm ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa darwin.cf-private ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.libobjc darwin.apple_sdk.libs.xpc darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa ];
 
   CXXFLAGS = "-fno-rtti";
   hardeningDisable = [ "format" ];
diff --git a/pkgs/development/compilers/nextpnr/default.nix b/pkgs/development/compilers/nextpnr/default.nix
index ec5deb4e22a..d1c0db25351 100644
--- a/pkgs/development/compilers/nextpnr/default.nix
+++ b/pkgs/development/compilers/nextpnr/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper
+{ stdenv, fetchFromGitHub, cmake
 , boost, python3, eigen
 , icestorm, trellis
 
@@ -6,7 +6,7 @@
 # laptop (and over a remote X server on my server...), so mark it broken for
 # now, with intent to fix later.
 , enableGui ? false
-, qtbase
+, qtbase, wrapQtAppsHook
 }:
 
 let
@@ -36,7 +36,9 @@ stdenv.mkDerivation rec {
     sha256 = "1y14jpa948cwk0i19bsfqh7yxsxkgskm4xym4z179sjcvcdvrn3a";
   };
 
-  nativeBuildInputs = [ cmake makeWrapper ];
+  nativeBuildInputs
+     = [ cmake ]
+    ++ (stdenv.lib.optional enableGui wrapQtAppsHook);
   buildInputs
      = [ boostPython python3 eigen ]
     ++ (stdenv.lib.optional enableGui qtbase);
@@ -56,13 +58,6 @@ stdenv.mkDerivation rec {
       --replace 'git log -1 --format=%h' 'echo ${substring 0 11 src.rev}'
   '';
 
-  postInstall = stdenv.lib.optionalString enableGui ''
-    for x in generic ice40 ecp5; do
-      wrapProgram $out/bin/nextpnr-$x \
-        --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}"
-    done
-  '';
-
   meta = with stdenv.lib; {
     description = "Place and route tool for FPGAs";
     homepage    = https://github.com/yosyshq/nextpnr;
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 7f21d03fc3a..42fcae5e179 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -77,10 +77,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "6";
-      patch = "8";
+      patch = "9";
       suffix = "";
     };
-    sha256 = "14qi6n5gpcjnwy165wi9hkfcmbadc95ny6bxxldknxwmx50n4i1m";
+    sha256 = "1nkh70azbv866aw5a9bbxsxarsf40233vrzpjq17z3rz9ramybsy";
     inherit (darwin) CF configd;
     inherit passthruFun;
   };
@@ -90,10 +90,10 @@ in {
     sourceVersion = {
       major = "3";
       minor = "7";
-      patch = "3";
+      patch = "4";
       suffix = "";
     };
-    sha256 = "066ka8csjwkycqpgyv424d8hhqhfd7r6svsp4sfcvkylci0baq6s";
+    sha256 = "0gxiv5617zd7dnqm5k9r4q2188lk327nf9jznwq9j6b8p0s92ygv";
     inherit (darwin) CF configd;
     inherit passthruFun;
   };
diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix
index fd3c6b47145..a8d5d608f89 100644
--- a/pkgs/development/libraries/SDL/default.nix
+++ b/pkgs/development/libraries/SDL/default.nix
@@ -6,7 +6,6 @@
 , libXext, libICE, libXrandr
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid, libpulseaudio
 , OpenGL, CoreAudio, CoreServices, AudioUnit, Kernel, Cocoa
-, cf-private
 }:
 
 # NOTE: When editing this expression see if the same change applies to
@@ -41,11 +40,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ]
     ++ optional (!stdenv.hostPlatform.isMinGW && alsaSupport) audiofile
-    ++ optionals stdenv.isDarwin [
-      AudioUnit CoreAudio CoreServices Kernel OpenGL
-      # Needed for NSDefaultRunLoopMode symbols.
-      cf-private
-    ];
+    ++ optionals stdenv.isDarwin [ AudioUnit CoreAudio CoreServices Kernel OpenGL ];
 
   configureFlags = [
     "--disable-oss"
diff --git a/pkgs/development/libraries/SDL2/default.nix b/pkgs/development/libraries/SDL2/default.nix
index a2db9c2349d..94aca192852 100644
--- a/pkgs/development/libraries/SDL2/default.nix
+++ b/pkgs/development/libraries/SDL2/default.nix
@@ -14,7 +14,7 @@
 , pulseaudioSupport ? config.pulseaudio or stdenv.isLinux && !stdenv.hostPlatform.isAndroid
 , libpulseaudio
 , AudioUnit, Cocoa, CoreAudio, CoreServices, ForceFeedback, OpenGL
-, audiofile, cf-private, libiconv
+, audiofile, libiconv
 }:
 
 # NOTE: When editing this expression see if the same change applies to
@@ -58,11 +58,7 @@ stdenv.mkDerivation rec {
     ++ dlopenBuildInputs
     ++ optional  ibusSupport ibus
     ++ optional  fcitxSupport fcitx
-    ++ optionals stdenv.isDarwin [
-      AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL
-      # Needed for NSDefaultRunLoopMode symbols.
-      cf-private
-    ];
+    ++ optionals stdenv.isDarwin [ AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/development/libraries/cutelyst/default.nix b/pkgs/development/libraries/cutelyst/default.nix
index 784a282f6b2..c4778e5b030 100644
--- a/pkgs/development/libraries/cutelyst/default.nix
+++ b/pkgs/development/libraries/cutelyst/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig, makeWrapper
+{ stdenv, lib, fetchFromGitHub, cmake, pkgconfig, wrapQtAppsHook
 , qtbase, libuuid, libcap, uwsgi, grantlee, pcre
 }:
 
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "09cgfpr2k1jp98h1ahxqm5lmv3qbk0bcxpqpill6n5wmq2c8kl8b";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig makeWrapper ];
+  nativeBuildInputs = [ cmake pkgconfig wrapQtAppsHook ];
   buildInputs = [ qtbase libuuid libcap uwsgi grantlee pcre ];
 
   cmakeFlags = [
@@ -31,12 +31,6 @@ stdenv.mkDerivation rec {
     unset LD_LIBRARY_PATH
   '';
 
-  postInstall = ''
-    for prog in $out/bin/*; do
-      wrapProgram "$prog" --set QT_PLUGIN_PATH '${qtbase}/${qtbase.qtPluginPrefix}'
-    done
-  '';
-
   meta = with lib; {
     description = "C++ Web Framework built on top of Qt";
     homepage = https://cutelyst.org/;
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index db606cc02d6..e16aee9f5ca 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -139,7 +139,7 @@
  *  Darwin frameworks
  */
 , Cocoa, CoreAudio, CoreServices, AVFoundation, MediaToolbox
-, VideoDecodeAcceleration, cf-private
+, VideoDecodeAcceleration
 }:
 
 /* Maintainer notes:
@@ -419,7 +419,7 @@ stdenv.mkDerivation rec {
     ++ optional nvenc nv-codec-headers
     ++ optionals stdenv.isDarwin [ Cocoa CoreServices CoreAudio AVFoundation
                                    MediaToolbox VideoDecodeAcceleration
-                                   libiconv cf-private /* For _OBJC_EHTYPE_$_NSException */ ];
+                                   libiconv ];
 
   buildFlags = [ "all" ]
     ++ optional qtFaststartProgram "tools/qt-faststart"; # Build qt-faststart executable
@@ -427,14 +427,6 @@ stdenv.mkDerivation rec {
   # Hacky framework patching technique borrowed from the phantomjs2 package
   postInstall = optionalString qtFaststartProgram ''
     cp -a tools/qt-faststart $out/bin/
-  '' + optionalString stdenv.isDarwin ''
-    FILES=($(ls $out/bin/*))
-    FILES+=($(ls $out/lib/*.dylib))
-    for f in ''${FILES[@]}; do
-      if [ ! -h "$f" ]; then
-        install_name_tool -change ${cf-private}/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation "$f"
-      fi
-    done
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/development/libraries/fltk/1.4.nix b/pkgs/development/libraries/fltk/1.4.nix
index 3cdebe184d7..cad4419a26c 100644
--- a/pkgs/development/libraries/fltk/1.4.nix
+++ b/pkgs/development/libraries/fltk/1.4.nix
@@ -1,11 +1,13 @@
 { stdenv, fetchurl, pkgconfig, xlibsWrapper, xorgproto, libXi
 , freeglut, libGLU_combined, libjpeg, zlib, libXft, libpng
-, libtiff, freetype, cf-private, Cocoa, AGL, GLUT
+, libtiff, freetype, Cocoa, AGL, GLUT
 }:
 
 let
   version = "1.4.x-r13121";
-in stdenv.mkDerivation {
+in
+
+stdenv.mkDerivation {
   name = "fltk-${version}";
 
   src = fetchurl {
@@ -13,19 +15,16 @@ in stdenv.mkDerivation {
     sha256 = "1v8wxvxcbk99i82x2v5fpqg5vj8n7g8a38g30ry7nzcjn5sf3r63";
   };
 
-  preConfigure = "make clean";
-
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./nsosv.patch ];
 
   nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libGLU_combined libjpeg zlib libpng libXft ]
+    ++ stdenv.lib.optional stdenv.isDarwin [ AGL Cocoa GLUT ];
 
-  buildInputs = [
-    libGLU_combined
-    libjpeg
-    zlib
-    libpng
-    libXft
-  ];
+  propagatedBuildInputs = [ xorgproto ]
+    ++ (if stdenv.isDarwin
+        then [ freetype libtiff ]
+        else [ xlibsWrapper libXi freeglut ]);
 
   configureFlags = [
     "--enable-gl"
@@ -35,18 +34,15 @@ in stdenv.mkDerivation {
     "--enable-xft"
   ];
 
-  propagatedBuildInputs = [ xorgproto ]
-    ++ (if stdenv.isDarwin
-        then [ Cocoa AGL GLUT freetype libtiff cf-private  /* Needed for NSDefaultRunLoopMode */ ]
-        else [ xlibsWrapper libXi freeglut ]);
+  preConfigure = "make clean";
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A C++ cross-platform lightweight GUI library";
     homepage = http://www.fltk.org;
-    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
-    license = stdenv.lib.licenses.gpl2;
+    platforms = platforms.linux ++ platforms.darwin;
+    license = licenses.gpl2;
   };
 
 }
diff --git a/pkgs/development/libraries/fltk/default.nix b/pkgs/development/libraries/fltk/default.nix
index 60773d29d3d..bb9f8fe76c9 100644
--- a/pkgs/development/libraries/fltk/default.nix
+++ b/pkgs/development/libraries/fltk/default.nix
@@ -1,11 +1,13 @@
 { stdenv, fetchurl, pkgconfig, xlibsWrapper, xorgproto, libXi
 , freeglut, libGLU_combined, libjpeg, zlib, libXft, libpng
-, libtiff, freetype, cf-private, Cocoa, AGL, GLUT
+, libtiff, freetype, Cocoa, AGL, GLUT
 }:
 
 let
   version = "1.3.5";
-in stdenv.mkDerivation {
+in
+
+stdenv.mkDerivation {
   name = "fltk-${version}";
 
   src = fetchurl {
@@ -16,14 +18,13 @@ in stdenv.mkDerivation {
   patches = stdenv.lib.optionals stdenv.isDarwin [ ./nsosv.patch ];
 
   nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libGLU_combined libjpeg zlib libpng libXft ]
+    ++ stdenv.lib.optional stdenv.isDarwin [ AGL Cocoa GLUT ];
 
-  buildInputs = [
-    libGLU_combined
-    libjpeg
-    zlib
-    libpng
-    libXft
-  ];
+  propagatedBuildInputs = [ xorgproto ]
+    ++ (if stdenv.isDarwin
+        then [ freetype libtiff ]
+        else [ xlibsWrapper libXi freeglut ]);
 
   configureFlags = [
     "--enable-gl"
@@ -33,18 +34,12 @@ in stdenv.mkDerivation {
     "--enable-xft"
   ];
 
-  propagatedBuildInputs = [ xorgproto ]
-    ++ (if stdenv.isDarwin
-        then [ Cocoa AGL GLUT freetype libtiff cf-private  /* Needed for NSDefaultRunLoopMode */ ]
-        else [ xlibsWrapper libXi freeglut ]);
-
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "A C++ cross-platform lightweight GUI library";
     homepage = http://www.fltk.org;
-    platforms = stdenv.lib.platforms.linux ++ stdenv.lib.platforms.darwin;
-    license = stdenv.lib.licenses.gpl2;
+    platforms = platforms.linux ++ platforms.darwin;
+    license = licenses.gpl2;
   };
-
 }
diff --git a/pkgs/development/libraries/glfw/3.x.nix b/pkgs/development/libraries/glfw/3.x.nix
index 13bd4a456c9..6944d5b9292 100644
--- a/pkgs/development/libraries/glfw/3.x.nix
+++ b/pkgs/development/libraries/glfw/3.x.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, libGL, libXrandr, libXinerama, libXcursor, libX11
-, cf-private, Cocoa, Kernel, fixDarwinDylibNames
+, Cocoa, Kernel, fixDarwinDylibNames
 }:
 
 stdenv.mkDerivation rec {
@@ -19,13 +19,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [
-    libX11 libXrandr libXinerama libXcursor
-  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa Kernel fixDarwinDylibNames
-    # Needed for NSDefaultRunLoopMode symbols.
-    cf-private
-  ];
+  buildInputs = [ libX11 libXrandr libXinerama libXcursor ]
+    ++ lib.optionals stdenv.isDarwin [ Cocoa Kernel fixDarwinDylibNames ];
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
 
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 4b577d36857..1de54becb5b 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -81,9 +81,6 @@ stdenv.mkDerivation rec {
     utillinuxMinimal # for libmount
   ] ++ optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
     AppKit Carbon Cocoa CoreFoundation CoreServices Foundation
-    # Needed for CFURLCreateFromFSRef, etc. which have deen deprecated
-    # since 10.9 and are not part of swift-corelibs CoreFoundation.
-    darwin.cf-private
   ]);
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gsettings-qt/default.nix b/pkgs/development/libraries/gsettings-qt/default.nix
index 3f9cd8120d8..744d9eb6de9 100644
--- a/pkgs/development/libraries/gsettings-qt/default.nix
+++ b/pkgs/development/libraries/gsettings-qt/default.nix
@@ -1,4 +1,7 @@
-{ stdenv, fetchbzr, pkgconfig, qmake, qtbase, qtdeclarative, glib, gobject-introspection }:
+{ stdenv, fetchbzr, pkgconfig
+, qmake, qtbase, qtdeclarative, wrapQtAppsHook
+, glib, gobject-introspection
+}:
 
 stdenv.mkDerivation rec {
   name = "gsettings-qt-${version}";
@@ -14,6 +17,7 @@ stdenv.mkDerivation rec {
     pkgconfig
     qmake
     gobject-introspection
+    wrapQtAppsHook
   ];
 
   buildInputs = [
diff --git a/pkgs/development/libraries/kde-frameworks/default.nix b/pkgs/development/libraries/kde-frameworks/default.nix
index 62ae433ff71..7745d78f8fc 100644
--- a/pkgs/development/libraries/kde-frameworks/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/default.nix
@@ -45,17 +45,9 @@ let
                 if [ "$hookName" != postHook ]; then
                     postHooks+=("source @dev@/nix-support/setup-hook")
                 else
-                    # Propagate $${out} output
-                    propagatedUserEnvPkgs="$propagatedUserEnvPkgs @${out}@"
-
-                    if [ -z "$outputDev" ]; then
-                        echo "error: \$outputDev is unset!" >&2
-                        exit 1
-                    fi
-
                     # Propagate $dev so that this setup hook is propagated
                     # But only if there is a separate $dev output
-                    if [ "$outputDev" != out ]; then
+                    if [ "''${outputDev:?}" != out ]; then
                         propagatedBuildInputs="$propagatedBuildInputs @dev@"
                     fi
                 fi
@@ -75,10 +67,9 @@ let
             inherit (srcs."${name}") src version;
 
             outputs = args.outputs or [ "bin" "dev" "out" ];
-            hasBin = lib.elem "bin" outputs;
-            hasDev = lib.elem "dev" outputs;
+            hasSeparateDev = lib.elem "dev" outputs;
 
-            defaultSetupHook = if hasBin && hasDev then propagateBin else null;
+            defaultSetupHook = if hasSeparateDev then propagateBin else null;
             setupHook = args.setupHook or defaultSetupHook;
 
             meta = {
diff --git a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
index 88091e78a0c..4df086ddbf2 100644
--- a/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
+++ b/pkgs/development/libraries/kde-frameworks/extra-cmake-modules/setup-hook.sh
@@ -1,16 +1,16 @@
-_ecmEnvHook() {
+ecmEnvHook() {
     addToSearchPath XDG_DATA_DIRS "$1/share"
     addToSearchPath XDG_CONFIG_DIRS "$1/etc/xdg"
 }
-addEnvHooks "$targetOffset" _ecmEnvHook
+addEnvHooks "$targetOffset" ecmEnvHook
 
-_ecmPreConfigureHook() {
+ecmPostHook() {
     # Because we need to use absolute paths here, we must set *all* the paths.
     cmakeFlags+=" -DKDE_INSTALL_EXECROOTDIR=${!outputBin}"
     cmakeFlags+=" -DKDE_INSTALL_BINDIR=${!outputBin}/bin"
     cmakeFlags+=" -DKDE_INSTALL_SBINDIR=${!outputBin}/sbin"
     cmakeFlags+=" -DKDE_INSTALL_LIBDIR=${!outputLib}/lib"
-    cmakeFlags+=" -DKDE_INSTALL_LIBEXECDIR=${!outputLib}/lib/libexec"
+    cmakeFlags+=" -DKDE_INSTALL_LIBEXECDIR=${!outputLib}/libexec"
     cmakeFlags+=" -DKDE_INSTALL_CMAKEPACKAGEDIR=${!outputDev}/lib/cmake"
     cmakeFlags+=" -DKDE_INSTALL_INCLUDEDIR=${!outputInclude}/include"
     cmakeFlags+=" -DKDE_INSTALL_LOCALSTATEDIR=/var"
@@ -51,4 +51,58 @@ _ecmPreConfigureHook() {
         cmakeFlags+=" -DKDE_INSTALL_QMLDIR=${!outputBin}/$qtQmlPrefix"
     fi
 }
-preConfigureHooks+=(_ecmPreConfigureHook)
+postHooks+=(ecmPostHook)
+
+xdgDataSubdirs=(
+    "doc" "config.kcfg" "kconf_update" "kservices5" "kservicetypes5" \
+    "kxmlgui5" "knotifications5" "icons" "locale" "sounds" "templates" \
+    "wallpapers" "applications" "desktop-directories" "mime" "appdata" "dbus-1" \
+)
+
+
+ecmHostPathSeen=( )
+
+ecmUnseenHostPath() {
+    for pkg in "${ecmHostPathSeen[@]}"
+    do
+        if [ "${pkg:?}" == "$1" ]
+        then
+            return 1
+        fi
+    done
+
+    ecmHostPathSeen+=("$1")
+    return 0
+}
+
+ecmHostPathHook() {
+    ecmUnseenHostPath "$1" || return 0
+
+    local xdgConfigDir="$1/etc/xdg"
+    if [ -d "$xdgConfigDir" ]
+    then
+        qtWrapperArgs+=(--prefix XDG_CONFIG_DIRS : "$xdgConfigDir")
+    fi
+
+    for xdgDataSubdir in "${xdgDataSubdirs[@]}"
+    do
+        if [ -d "$1/share/$xdgDataSubdir" ]
+        then
+            qtWrapperArgs+=(--prefix XDG_DATA_DIRS : "$1/share")
+            break
+        fi
+    done
+
+    local manDir="$1/man"
+    if [ -d "$manDir" ]
+    then
+        qtWrapperArgs+=(--prefix MANPATH : "$manDir")
+    fi
+
+    local infoDir="$1/info"
+    if [ -d "$infoDir" ]
+    then
+        qtWrapperArgs+=(--prefix INFOPATH : "$infoDir")
+    fi
+}
+addEnvHooks "$hostOffset" ecmHostPathHook
diff --git a/pkgs/development/libraries/kde-frameworks/kinit/default.nix b/pkgs/development/libraries/kde-frameworks/kinit/default.nix
index 538078fd745..42a1e157a91 100644
--- a/pkgs/development/libraries/kde-frameworks/kinit/default.nix
+++ b/pkgs/development/libraries/kde-frameworks/kinit/default.nix
@@ -9,6 +9,7 @@ let inherit (lib) getLib; in
 mkDerivation {
   name = "kinit";
   meta = { maintainers = [ lib.maintainers.ttuegel ]; };
+  outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kconfig kcrash ki18n kio kservice kwindowsystem
@@ -19,9 +20,6 @@ mkDerivation {
     ''-DNIXPKGS_KF5_PARTS=\"${getLib kparts}/lib/libKF5Parts.so.5\"''
     ''-DNIXPKGS_KF5_PLASMA=\"${getLib plasma-framework}/lib/libKF5Plasma.so.5\"''
   ];
-  postFixup = ''
-    moveToOutput "lib/libexec/kf5/start_kdeinit" "$bin"
-  '';
   setupHook = writeScript "setup-hook.sh" ''
     kinitFixupOutputHook() {
         if [ $prefix != ''${!outputBin} ] && [ -d $prefix/lib ]; then
diff --git a/pkgs/development/libraries/libgdata/default.nix b/pkgs/development/libraries/libgdata/default.nix
index 59e19750715..91994a5cfba 100644
--- a/pkgs/development/libraries/libgdata/default.nix
+++ b/pkgs/development/libraries/libgdata/default.nix
@@ -1,20 +1,69 @@
-{ stdenv, fetchurl, pkgconfig, intltool, libxml2, glib, json-glib, gcr
-, gobject-introspection, liboauth, gnome3, p11-kit, openssl, uhttpmock }:
+{ stdenv
+, fetchurl
+, pkgconfig
+, meson
+, ninja
+, vala
+, gettext
+, libxml2
+, glib
+, json-glib
+, gcr
+, gobject-introspection
+, liboauth
+, gnome3
+, p11-kit
+, openssl
+, uhttpmock
+, libsoup
+}:
 
 stdenv.mkDerivation rec {
   pname = "libgdata";
-  version = "0.17.9";
+  version = "0.17.10";
+
+  outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0fj54yqxdapdppisqm1xcyrpgcichdmipq0a0spzz6009ikzgi45";
+    sha256 = "04mh2p5x2iidfx0d1cablxbi3hvna8cmlddc1mm4387n0grx3ly1";
   };
 
-  nativeBuildInputs = [ pkgconfig intltool gobject-introspection ];
+  patches = [
+    ./installed-tests-path.patch
+  ];
+
+  nativeBuildInputs = [
+    gettext
+    gobject-introspection
+    meson
+    ninja
+    pkgconfig
+    vala
+  ];
+
+  buildInputs = [
+    gcr
+    glib
+    gnome3.gnome-online-accounts
+    liboauth
+    libsoup
+    libxml2
+    openssl
+    p11-kit
+    uhttpmock
+  ];
 
-  buildInputs = [ gnome3.libsoup libxml2 glib liboauth gcr gnome3.gnome-online-accounts p11-kit openssl uhttpmock ];
+  propagatedBuildInputs = [
+    json-glib
+  ];
 
-  propagatedBuildInputs = [ json-glib ];
+  mesonFlags = [
+    "-Dgtk_doc=false"
+    "-Dinstalled_test_bindir=${placeholder ''installedTests''}/libexec"
+    "-Dinstalled_test_datadir=${placeholder ''installedTests''}/share"
+    "-Dinstalled_tests=true"
+  ];
 
   passthru = {
     updateScript = gnome3.updateScript {
@@ -26,7 +75,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "GData API library";
     homepage = https://wiki.gnome.org/Projects/libgdata;
-    maintainers = with maintainers; [ raskin lethalman ];
+    maintainers = with maintainers; [ raskin lethalman ] ++ gnome3.maintainers;
     platforms = platforms.linux;
     license = licenses.lgpl21Plus;
   };
diff --git a/pkgs/development/libraries/libgdata/installed-tests-path.patch b/pkgs/development/libraries/libgdata/installed-tests-path.patch
new file mode 100644
index 00000000000..18669817cfe
--- /dev/null
+++ b/pkgs/development/libraries/libgdata/installed-tests-path.patch
@@ -0,0 +1,94 @@
+diff --git a/gdata/tests/meson.build b/gdata/tests/meson.build
+index 52154e7a..1a44d1d8 100644
+--- a/gdata/tests/meson.build
++++ b/gdata/tests/meson.build
+@@ -1,5 +1,12 @@
+-tests_execdir = gdata_libexecdir / 'installed-tests' / gdata_name
+-tests_metadir = gdata_datadir / 'installed-tests' / gdata_name
++tests_bindir = get_option('installed_test_bindir') / 'installed-tests' / gdata_name
++if tests_bindir == ''
++    test_bindir = gdata_libexecdir / 'installed-tests' / gdata_name
++endif
++
++tests_datadir = get_option('installed_test_datadir') / 'installed-tests' / gdata_name
++if tests_datadir == ''
++    tests_datadir = gdata_datadir / 'installed-tests' / gdata_name
++endif
+ 
+ tests_sources = files(
+   'common.c',
+@@ -48,7 +55,7 @@ foreach test_name, extra_args: tests
+     dependencies: common_deps + extra_args.get('dependencies', []),
+     sources: tests_sources,
+     install: install_tests,
+-    install_dir: tests_execdir,
++    install_dir: tests_bindir,
+   )
+ 
+   test(
+@@ -63,7 +70,7 @@ if install_tests
+   foreach test_name, extra_args: tests
+     tests_conf = {
+       'TEST_TYPE': 'session',
+-      'TEST_ABS_PATH': gdata_prefix / tests_execdir / test_name,
++      'TEST_ABS_PATH': tests_bindir / test_name,
+     }
+ 
+     configure_file (
+@@ -71,13 +78,13 @@ if install_tests
+       output: test_name + '.test',
+       configuration: tests_conf,
+       install: true,
+-      install_dir: tests_metadir,
++      install_dir: tests_datadir,
+     )
+   endforeach
+ 
+   install_subdir(
+     'traces',
+-    install_dir: tests_execdir,
++    install_dir: tests_bindir,
+   )
+ 
+   test_data = [
+@@ -96,6 +103,6 @@ if install_tests
+ 
+   install_data(
+     test_data,
+-    install_dir: tests_execdir,
++    install_dir: tests_bindir,
+   )
+ endif
+diff --git a/meson.build b/meson.build
+index 7d2f5254..bed3e189 100644
+--- a/meson.build
++++ b/meson.build
+@@ -20,9 +20,9 @@ gdata_api_version_minor = 0
+ 
+ # Define the install directories
+ gdata_prefix = get_option('prefix')
+-gdata_datadir = get_option('datadir')
+-gdata_libexecdir = get_option('libexecdir')
+-gdata_includedir = get_option('includedir')
++gdata_datadir = gdata_prefix / get_option('datadir')
++gdata_libexecdir = gdata_prefix / get_option('libexecdir')
++gdata_includedir = gdata_prefix / get_option('includedir')
+ 
+ gdata_include_subdir = gdata_name / 'gdata'
+ 
+diff --git a/meson_options.txt b/meson_options.txt
+index 25cc6b55..6fc2cfa3 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -43,3 +43,11 @@ option('vapi',
+   type: 'boolean',
+   value: true,
+   description: 'Enable creation of vapi files')
++
++option('installed_test_datadir', type: 'string',
++  value: '',
++  description: 'Installation directory for data files in tests')
++
++option('installed_test_bindir', type: 'string',
++  value: '',
++  description: 'Installation directory for binary files in tests')
diff --git a/pkgs/development/libraries/librime/default.nix b/pkgs/development/libraries/librime/default.nix
index 71362fd7ef7..e1d0a51a668 100644
--- a/pkgs/development/libraries/librime/default.nix
+++ b/pkgs/development/libraries/librime/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librime";
-  version = "1.5.0";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "rime";
     repo = "librime";
     rev = "${version}";
-    sha256 = "10wvh1l4317yzcys4rzlkw42i6cj5p8g62r1xzyjw32ky2d0ndxl";
+    sha256 = "0xskhdhk7dgpc71r39pfzxi5vrlzy90aqj1gzv8nnapq91p2awhv";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage    = https://rime.im/;
+    homepage    = "https://rime.im/";
     description = "Rime Input Method Engine, the core library";
     license     = licenses.bsd3;
     maintainers = with maintainers; [ sifmelcara ];
diff --git a/pkgs/development/libraries/libui/default.nix b/pkgs/development/libraries/libui/default.nix
index dcc406accbd..446d30c609e 100644
--- a/pkgs/development/libraries/libui/default.nix
+++ b/pkgs/development/libraries/libui/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, cmake, pkgconfig, gtk3, cf-private, Cocoa }:
+{ stdenv, fetchgit, cmake, pkgconfig, gtk3, Cocoa }:
 
 let
   shortName = "libui";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = stdenv.lib.optional stdenv.isLinux gtk3
-    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa cf-private /* For NSDefaultRunLoopMode */ ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa ];
 
   preConfigure = stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i 's/set(CMAKE_OSX_DEPLOYMENT_TARGET "10.8")//' ./CMakeLists.txt
diff --git a/pkgs/development/libraries/libxkbcommon/default.nix b/pkgs/development/libraries/libxkbcommon/default.nix
index 65a1207dab3..9b43c449e9a 100644
--- a/pkgs/development/libraries/libxkbcommon/default.nix
+++ b/pkgs/development/libraries/libxkbcommon/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, fetchpatch, meson, ninja, pkgconfig, yacc, xkeyboard_config, libxcb, libX11, doxygen }:
 
 stdenv.mkDerivation rec {
-  name = "libxkbcommon-0.8.0";
+  pname = "libxkbcommon";
+  version = "0.8.4";
 
   src = fetchurl {
-    url = "https://xkbcommon.org/download/${name}.tar.xz";
-    sha256 = "0vgy84vfbig5bqznr137h5arjidnfwrxrdli0pxyn2jfn1fjcag8";
+    url = "https://xkbcommon.org/download/${pname}-${version}.tar.xz";
+    sha256 = "12vc91ydhphd5sddz15560r41l7k0i7mq6nma8kkbzdp6bwwzpb0";
   };
 
   outputs = [ "out" "dev" "doc" ];
@@ -13,14 +14,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ meson ninja pkgconfig yacc doxygen ];
   buildInputs = [ xkeyboard_config libxcb ];
 
-  patches = [
-    # darwin compatibility
-    (fetchpatch {
-      url = https://github.com/xkbcommon/libxkbcommon/commit/edb1c662394578a54b7bbed231d918925e5d8150.patch;
-      sha256 = "0ydjlir32r3xfsbqhnsx1bz6ags2m908yhf9i09i1s7sgcimbcx5";
-    })
-  ];
-
   mesonFlags = [
     "-Denable-wayland=false"
     "-Dxkb-config-root=${xkeyboard_config}/etc/X11/xkb"
diff --git a/pkgs/development/libraries/libyaml/default.nix b/pkgs/development/libraries/libyaml/default.nix
index c1f34bd3398..7529d69ddde 100644
--- a/pkgs/development/libraries/libyaml/default.nix
+++ b/pkgs/development/libraries/libyaml/default.nix
@@ -1,31 +1,14 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
-let
-
-  version = "0.2.1";
-
-  # https://github.com/yaml/pyyaml/issues/214
-  p1 = fetchpatch {
-         url = https://github.com/yaml/libyaml/commit/8ee83c0da22fe9aa7dea667be8f899a7e32ffb83.patch;
-         sha256 = "00jh39zww6s4gyhxfmlxwb6lz90nl3p51k5h1qm6z3ymik5vljmz";
-       };
-  p2 = fetchpatch {
-         url = https://github.com/yaml/libyaml/commit/56f4b17221868593d6903ee58d6d679b690cf4df.patch;
-         sha256 = "0najcay1y4kgfpsidj7dnyafnwjbav5jyawhyv215zl9gg3386n0";
-       };
-
-in
-
-stdenv.mkDerivation {
-  name = "libyaml-${version}";
+stdenv.mkDerivation rec {
+  pname = "libyaml";
+  version = "0.2.2";
 
   src = fetchurl {
     url = "https://pyyaml.org/download/libyaml/yaml-${version}.tar.gz";
     sha256 = "1karpcfgacgppa82wm2drcfn2kb6q2wqfykf5nrhy20sci2i2a3q";
   };
 
-  patches = [ p1 p2 ];  # remove when the next release comes out
-
   meta = with stdenv.lib; {
     homepage = https://pyyaml.org/;
     description = "A YAML 1.1 parser and emitter written in C";
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 5e78f9f92ec..43a68abf825 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -31,7 +31,7 @@
 , enableDC1394    ? false, libdc1394
 , enableDocs      ? false, doxygen, graphviz-nox
 
-, cf-private, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2
+, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2
 }:
 
 let
@@ -206,7 +206,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals enableTesseract [ tesseract leptonica ]
     ++ lib.optional enableTbb tbb
     ++ lib.optional enableCuda cudatoolkit
-    ++ lib.optionals stdenv.isDarwin [ cf-private AVFoundation Cocoa VideoDecodeAcceleration bzip2 ]
+    ++ lib.optionals stdenv.isDarwin [ bzip2 AVFoundation Cocoa VideoDecodeAcceleration ]
     ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index b4ad2bcb867..f96e6bf94bb 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -31,7 +31,7 @@
 , enableDC1394    ? false, libdc1394
 , enableDocs      ? false, doxygen, graphviz-nox
 
-, cf-private, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2
+, AVFoundation, Cocoa, VideoDecodeAcceleration, bzip2
 }:
 
 let
@@ -213,7 +213,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals enableTesseract [ tesseract leptonica ]
     ++ lib.optional enableTbb tbb
     ++ lib.optional enableCuda cudatoolkit
-    ++ lib.optionals stdenv.isDarwin [ cf-private AVFoundation Cocoa VideoDecodeAcceleration bzip2 ]
+    ++ lib.optionals stdenv.isDarwin [ bzip2 AVFoundation Cocoa VideoDecodeAcceleration ]
     ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
diff --git a/pkgs/development/libraries/opencv/default.nix b/pkgs/development/libraries/opencv/default.nix
index 123b8807a74..784071c6e4d 100644
--- a/pkgs/development/libraries/opencv/default.nix
+++ b/pkgs/development/libraries/opencv/default.nix
@@ -10,7 +10,7 @@
 , enableFfmpeg ? false, ffmpeg
 , enableGStreamer ? false, gst_all_1
 , enableEigen ? true, eigen
-, cf-private, Cocoa, QTKit
+, Cocoa, QTKit
 }:
 
 let
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableFfmpeg ffmpeg
     ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
     ++ lib.optional enableEigen eigen
-    ++ lib.optionals stdenv.isDarwin [ Cocoa QTKit cf-private /* For NSDefaultRunLoopMode */ ]
+    ++ lib.optionals stdenv.isDarwin [ Cocoa QTKit ]
     ;
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
diff --git a/pkgs/development/libraries/pcl/default.nix b/pkgs/development/libraries/pcl/default.nix
index fd2b9feff68..33158129469 100644
--- a/pkgs/development/libraries/pcl/default.nix
+++ b/pkgs/development/libraries/pcl/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake
 , qhull, flann, boost, vtk, eigen, pkgconfig, qtbase
-, libusb1, libpcap, libXt, libpng, Cocoa, AGL, cf-private, OpenGL
+, libusb1, libpcap, libXt, libpng, Cocoa, AGL, OpenGL
 }:
 
 stdenv.mkDerivation rec {
@@ -18,8 +18,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig cmake ];
   buildInputs = [ qhull flann boost eigen libusb1 libpcap
                   libpng vtk qtbase libXt ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa AGL ];
 
-    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa AGL cf-private ];
   cmakeFlags = stdenv.lib.optionals stdenv.isDarwin [
     "-DOPENGL_INCLUDE_DIR=${OpenGL}/Library/Frameworks"
   ];
diff --git a/pkgs/development/libraries/qt-4.x/4.8/default.nix b/pkgs/development/libraries/qt-4.x/4.8/default.nix
index 34ef7463817..afd2a01e722 100644
--- a/pkgs/development/libraries/qt-4.x/4.8/default.nix
+++ b/pkgs/development/libraries/qt-4.x/4.8/default.nix
@@ -14,7 +14,7 @@
 , examples ? false
 , demos ? false
 # darwin support
-, cf-private, libobjc, ApplicationServices, OpenGL, Cocoa, AGL, libcxx
+, libobjc, ApplicationServices, OpenGL, Cocoa, AGL, libcxx
 }:
 
 let
@@ -189,7 +189,7 @@ stdenv.mkDerivation rec {
       postgresql sqlite libjpeg libmng libtiff icu ]
     ++ lib.optionals (mysql != null) [ mysql.connector-c ]
     ++ lib.optionals gtkStyle [ gtk2 gdk_pixbuf ]
-    ++ lib.optionals stdenv.isDarwin [ cf-private ApplicationServices OpenGL Cocoa AGL libcxx libobjc ];
+    ++ lib.optionals stdenv.isDarwin [ ApplicationServices OpenGL Cocoa AGL libcxx libobjc ];
 
   nativeBuildInputs = [ perl pkgconfig which ];
 
diff --git a/pkgs/development/libraries/qt-5/5.11/default.nix b/pkgs/development/libraries/qt-5/5.11/default.nix
index f43329d3553..67c5047e507 100644
--- a/pkgs/development/libraries/qt-5/5.11/default.nix
+++ b/pkgs/development/libraries/qt-5/5.11/default.nix
@@ -17,10 +17,10 @@ top-level attribute to `top-level/all-packages.nix`.
 
 {
   newScope,
-  stdenv, fetchurl, fetchFromGitHub, makeSetupHook,
+  stdenv, fetchurl, fetchFromGitHub, makeSetupHook, makeWrapper,
   bison, cups ? null, harfbuzz, libGL, perl,
   gstreamer, gst-plugins-base, gtk3, dconf,
-  cf-private, llvmPackages_5,
+  llvmPackages_5,
 
   # options
   developerBuild ? false,
@@ -34,6 +34,8 @@ let
 
   qtCompatVersion = "5.11";
 
+  stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+
   mirror = "https://download.qt.io";
   srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
     # Community port of the now unmaintained upstream qtwebkit.
@@ -64,16 +66,18 @@ let
     qtwebkit = [ ./qtwebkit.patch ];
   };
 
-  mkDerivation =
-    import ../mkDerivation.nix {
-      inherit (stdenv) lib;
-      stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
-    }
-    { inherit debug; };
-
   qtModule =
     import ../qtModule.nix
-    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    {
+      inherit perl;
+      inherit (stdenv) lib;
+      # Use a variant of mkDerivation that does not include wrapQtApplications
+      # to avoid cyclic dependencies between Qt modules.
+      mkDerivation =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; wrapQtAppsHook = null; }
+        stdenvActual.mkDerivation;
+    }
     { inherit self srcs patches; };
 
   addPackages = self: with self;
@@ -81,7 +85,11 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
-      inherit mkDerivation;
+      mkDerivationWith =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; inherit (self) wrapQtAppsHook; };
+
+      mkDerivation = mkDerivationWith stdenvActual.mkDerivation;
 
       qtbase = callPackage ../modules/qtbase.nix {
         inherit (srcs.qtbase) src version;
@@ -92,17 +100,13 @@ let
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
-      qtconnectivity = callPackage ../modules/qtconnectivity.nix {
-        inherit cf-private;
-      };
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
       qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
       qtdoc = callPackage ../modules/qtdoc.nix {};
       qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
       qtimageformats = callPackage ../modules/qtimageformats.nix {};
       qtlocation = callPackage ../modules/qtlocation.nix { };
-      qtmacextras = callPackage ../modules/qtmacextras.nix {
-        inherit cf-private;
-      };
+      qtmacextras = callPackage ../modules/qtmacextras.nix {};
       qtmultimedia = callPackage ../modules/qtmultimedia.nix {
         inherit gstreamer gst-plugins-base;
       };
@@ -146,6 +150,12 @@ let
           fix_qt_builtin_paths = ../hooks/fix-qt-builtin-paths.sh;
         };
       } ../hooks/qmake-hook.sh;
+
+      wrapQtAppsHook = makeSetupHook {
+        deps =
+          [ self.qtbase.dev makeWrapper ]
+          ++ optional stdenv.isLinux self.qtwayland.dev;
+      } ../hooks/wrap-qt-apps-hook.sh;
     };
 
    self = makeScope newScope addPackages;
diff --git a/pkgs/development/libraries/qt-5/5.12/default.nix b/pkgs/development/libraries/qt-5/5.12/default.nix
index 2aa7d0f71ee..1fbf7b57289 100644
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -17,10 +17,10 @@ top-level attribute to `top-level/all-packages.nix`.
 
 {
   newScope,
-  stdenv, fetchurl, fetchFromGitHub, makeSetupHook,
+  stdenv, fetchurl, fetchFromGitHub, makeSetupHook, makeWrapper,
   bison, cups ? null, harfbuzz, libGL, perl,
   gstreamer, gst-plugins-base, gtk3, dconf,
-  cf-private, llvmPackages_5,
+  llvmPackages_5,
 
   # options
   developerBuild ? false,
@@ -34,6 +34,8 @@ let
 
   qtCompatVersion = "5.12";
 
+  stdenvActual = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
+
   mirror = "https://download.qt.io";
   srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; } // {
     # Community port of the now unmaintained upstream qtwebkit.
@@ -69,16 +71,18 @@ let
     qttools = [ ./qttools.patch ];
   };
 
-  mkDerivation =
-    import ../mkDerivation.nix {
-      inherit (stdenv) lib;
-      stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
-    }
-    { inherit debug; };
-
   qtModule =
     import ../qtModule.nix
-    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    {
+      inherit perl;
+      inherit (stdenv) lib;
+      # Use a variant of mkDerivation that does not include wrapQtApplications
+      # to avoid cyclic dependencies between Qt modules.
+      mkDerivation =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; wrapQtAppsHook = null; }
+        stdenvActual.mkDerivation;
+    }
     { inherit self srcs patches; };
 
   addPackages = self: with self;
@@ -86,7 +90,11 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
-      inherit mkDerivation;
+      mkDerivationWith =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; inherit (self) wrapQtAppsHook; };
+
+      mkDerivation = mkDerivationWith stdenvActual.mkDerivation;
 
       qtbase = callPackage ../modules/qtbase.nix {
         inherit (srcs.qtbase) src version;
@@ -97,17 +105,13 @@ let
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
-      qtconnectivity = callPackage ../modules/qtconnectivity.nix {
-        inherit cf-private;
-      };
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
       qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
       qtdoc = callPackage ../modules/qtdoc.nix {};
       qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
       qtimageformats = callPackage ../modules/qtimageformats.nix {};
       qtlocation = callPackage ../modules/qtlocation.nix {};
-      qtmacextras = callPackage ../modules/qtmacextras.nix {
-        inherit cf-private;
-      };
+      qtmacextras = callPackage ../modules/qtmacextras.nix {};
       qtmultimedia = callPackage ../modules/qtmultimedia.nix {
         inherit gstreamer gst-plugins-base;
       };
@@ -151,6 +155,12 @@ let
           fix_qt_builtin_paths = ../hooks/fix-qt-builtin-paths.sh;
         };
       } ../hooks/qmake-hook.sh;
+
+      wrapQtAppsHook = makeSetupHook {
+        deps =
+          [ self.qtbase.dev makeWrapper ]
+          ++ optional stdenv.isLinux self.qtwayland.dev;
+      } ../hooks/wrap-qt-apps-hook.sh;
     };
 
    self = makeScope newScope addPackages;
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index e493fc169ab..4f739b57ffe 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -26,10 +26,9 @@ existing packages here and modify it as necessary.
 
 {
   newScope,
-  stdenv, fetchurl, fetchpatch, makeSetupHook,
+  stdenv, fetchurl, fetchpatch, makeSetupHook, makeWrapper,
   bison, cups ? null, harfbuzz, libGL, perl,
   gstreamer, gst-plugins-base,
-  cf-private,
 
   # options
   developerBuild ? false,
@@ -105,14 +104,18 @@ let
     ];
   };
 
-  mkDerivation =
-    import ../mkDerivation.nix
-    { inherit stdenv; inherit (stdenv) lib; }
-    { inherit debug; };
-
   qtModule =
     import ../qtModule.nix
-    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    {
+      inherit perl;
+      inherit (stdenv) lib;
+      # Use a variant of mkDerivation that does not include wrapQtApplications
+      # to avoid cyclic dependencies between Qt modules.
+      mkDerivation =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; wrapQtAppsHook = null; }
+        stdenv.mkDerivation;
+    }
     { inherit self srcs patches; };
 
   addPackages = self: with self;
@@ -120,7 +123,11 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
-      inherit mkDerivation;
+      mkDerivationWith =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; inherit (self) wrapQtAppsHook; };
+
+      mkDerivation = mkDerivationWith stdenv.mkDerivation;
 
       qtbase = callPackage ../modules/qtbase.nix {
         inherit bison cups harfbuzz libGL;
@@ -133,9 +140,7 @@ let
       /* qtactiveqt = not packaged */
       /* qtandroidextras = not packaged */
       /* qtcanvas3d = not packaged */
-      qtconnectivity = callPackage ../modules/qtconnectivity.nix {
-        inherit cf-private;
-      };
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
       qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
       qtdoc = callPackage ../modules/qtdoc.nix {};
       qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
@@ -176,6 +181,12 @@ let
         deps = [ self.qtbase.dev ];
         substitutions = { inherit (stdenv) isDarwin; };
       } ../hooks/qmake-hook.sh;
+
+      wrapQtAppsHook = makeSetupHook {
+        deps =
+          [ self.qtbase.dev makeWrapper ]
+          ++ optional stdenv.isLinux self.qtwayland.dev;
+      } ../hooks/wrap-qt-apps-hook.sh;
     };
 
    self = makeScope newScope addPackages;
diff --git a/pkgs/development/libraries/qt-5/5.9/default.nix b/pkgs/development/libraries/qt-5/5.9/default.nix
index 9baca8124bd..f36f86e26ff 100644
--- a/pkgs/development/libraries/qt-5/5.9/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/default.nix
@@ -17,10 +17,9 @@ top-level attribute to `top-level/all-packages.nix`.
 
 {
   newScope,
-  stdenv, fetchurl, fetchpatch, makeSetupHook,
+  stdenv, fetchurl, fetchpatch, makeSetupHook, makeWrapper,
   bison, cups ? null, harfbuzz, libGL, perl,
   gstreamer, gst-plugins-base, gtk3, dconf,
-  cf-private,
 
   # options
   developerBuild ? false,
@@ -68,14 +67,18 @@ let
 
   };
 
-  mkDerivation =
-    import ../mkDerivation.nix
-    { inherit stdenv; inherit (stdenv) lib; }
-    { inherit debug; };
-
   qtModule =
     import ../qtModule.nix
-    { inherit mkDerivation perl; inherit (stdenv) lib; }
+    {
+      inherit perl;
+      inherit (stdenv) lib;
+      # Use a variant of mkDerivation that does not include wrapQtApplications
+      # to avoid cyclic dependencies between Qt modules.
+      mkDerivation =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; wrapQtAppsHook = null; }
+        stdenv.mkDerivation;
+    }
     { inherit self srcs patches; };
 
   addPackages = self: with self;
@@ -83,7 +86,11 @@ let
       callPackage = self.newScope { inherit qtCompatVersion qtModule srcs; };
     in {
 
-      inherit mkDerivation;
+      mkDerivationWith =
+        import ../mkDerivation.nix
+        { inherit (stdenv) lib; inherit debug; inherit (self) wrapQtAppsHook; };
+
+      mkDerivation = mkDerivationWith stdenv.mkDerivation;
 
       qtbase = callPackage ../modules/qtbase.nix {
         inherit (srcs.qtbase) src version;
@@ -94,17 +101,13 @@ let
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
-      qtconnectivity = callPackage ../modules/qtconnectivity.nix {
-        inherit cf-private;
-      };
+      qtconnectivity = callPackage ../modules/qtconnectivity.nix {};
       qtdeclarative = callPackage ../modules/qtdeclarative.nix {};
       qtdoc = callPackage ../modules/qtdoc.nix {};
       qtgraphicaleffects = callPackage ../modules/qtgraphicaleffects.nix {};
       qtimageformats = callPackage ../modules/qtimageformats.nix {};
       qtlocation = callPackage ../modules/qtlocation.nix {};
-      qtmacextras = callPackage ../modules/qtmacextras.nix {
-        inherit cf-private;
-      };
+      qtmacextras = callPackage ../modules/qtmacextras.nix {};
       qtmultimedia = callPackage ../modules/qtmultimedia.nix {
         inherit gstreamer gst-plugins-base;
       };
@@ -145,6 +148,12 @@ let
           fix_qt_builtin_paths = ../hooks/fix-qt-builtin-paths.sh;
         };
       } ../hooks/qmake-hook.sh;
+
+      wrapQtAppsHook = makeSetupHook {
+        deps =
+          [ self.qtbase.dev makeWrapper ]
+          ++ optional stdenv.isLinux self.qtwayland.dev;
+      } ../hooks/wrap-qt-apps-hook.sh;
     };
 
    self = makeScope newScope addPackages;
diff --git a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 3a558153988..436c2e1d032 100644
--- a/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -19,12 +19,14 @@ export QMAKEPATH
 QMAKEMODULES=
 export QMAKEMODULES
 
-addToQMAKEPATH() {
-    if [ -d "$1/mkspecs" ]; then
+qmakePathHook() {
+    if [ -d "$1/mkspecs" ]
+    then
         QMAKEMODULES="${QMAKEMODULES}${QMAKEMODULES:+:}/mkspecs"
         QMAKEPATH="${QMAKEPATH}${QMAKEPATH:+:}$1"
     fi
 }
+envBuildHostHooks+=(qmakePathHook)
 
 # Propagate any runtime dependency of the building package.
 # Each dependency is propagated to the user environment and as a build
@@ -32,18 +34,18 @@ addToQMAKEPATH() {
 # package depending on the building package. (This is necessary in case
 # the building package does not provide runtime dependencies itself and so
 # would not be propagated to the user environment.)
-qtEnvHook() {
-    addToQMAKEPATH "$1"
-    if providesQtRuntime "$1"; then
-        if [ "z${!outputBin}" != "z${!outputDev}" ]; then
-            propagatedBuildInputs+=" $1"
-        fi
-        propagatedUserEnvPkgs+=" $1"
+qtEnvHostTargetHook() {
+    if providesQtRuntime "$1" && [ "z${!outputBin}" != "z${!outputDev}" ]
+    then
+        propagatedBuildInputs+=" $1"
     fi
 }
-envHostTargetHooks+=(qtEnvHook)
+envHostTargetHooks+=(qtEnvHostTargetHook)
 
 postPatchMkspecs() {
+    # Prevent this hook from running multiple times
+    dontPatchMkspecs=1
+
     local bin="${!outputBin}"
     local dev="${!outputDev}"
     local doc="${!outputDoc}"
diff --git a/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
new file mode 100644
index 00000000000..83f62e4ec2b
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -0,0 +1,106 @@
+# Inherit arguments given in mkDerivation
+qtWrapperArgs=( $qtWrapperArgs )
+
+qtHostPathSeen=()
+
+qtUnseenHostPath() {
+    for pkg in "${qtHostPathSeen[@]}"
+    do
+        if [ "${pkg:?}" == "$1" ]
+        then
+            return 1
+        fi
+    done
+
+    qtHostPathSeen+=("$1")
+    return 0
+}
+
+qtHostPathHook() {
+    qtUnseenHostPath "$1" || return 0
+
+    local pluginDir="$1/${qtPluginPrefix:?}"
+    if [ -d "$pluginDir" ]
+    then
+        qtWrapperArgs+=(--prefix QT_PLUGIN_PATH : "$pluginDir")
+    fi
+
+    local qmlDir="$1/${qtQmlPrefix:?}"
+    if [ -d "$qmlDir" ]
+    then
+        qtWrapperArgs+=(--prefix QML2_IMPORT_PATH : "$qmlDir")
+    fi
+}
+addEnvHooks "$hostOffset" qtHostPathHook
+
+makeQtWrapper() {
+    local original="$1"
+    local wrapper="$2"
+    shift 2
+    makeWrapper "$original" "$wrapper" "${qtWrapperArgs[@]}" "$@"
+}
+
+wrapQtApp() {
+    local program="$1"
+    shift 1
+    wrapProgram "$program" "${qtWrapperArgs[@]}" "$@"
+}
+
+qtOwnPathsHook() {
+    local xdgDataDir="${!outputBin}/share"
+    if [ -d "$xdgDataDir" ]
+    then
+        qtWrapperArgs+=(--prefix XDG_DATA_DIRS : "$xdgDataDir")
+    fi
+
+    local xdgConfigDir="${!outputBin}/etc/xdg"
+    if [ -d "$xdgConfigDir" ]
+    then
+        qtWrapperArgs+=(--prefix XDG_CONFIG_DIRS : "$xdgConfigDir")
+    fi
+
+    qtHostPathHook "${!outputBin}"
+}
+
+preFixupPhases+=" qtOwnPathsHook"
+
+isQtApp () {
+    readelf -d "$1" 2>/dev/null | grep -q -F 'libQt5Core'
+}
+
+# Note: $qtWrapperArgs still gets defined even if $dontWrapQtApps is set.
+wrapQtAppsHook() {
+    # skip this hook when requested
+    [ -z "$dontWrapQtApps" ] || return 0
+
+    # guard against running multiple times (e.g. due to propagation)
+    [ -z "$wrapQtAppsHookHasRun" ] || return 0
+    wrapQtAppsHookHasRun=1
+
+    local targetDirs=( "$prefix/bin" )
+    echo "wrapping Qt applications in ${targetDirs[@]}"
+
+    for targetDir in "${targetDirs[@]}"
+    do
+        [ -d "$targetDir" ] || continue
+
+        find "$targetDir" -executable -print0 | while IFS= read -r -d '' file
+        do
+            isQtApp "$file" || continue
+
+            if [ -f "$file" ]
+            then
+                echo "wrapping $file"
+                wrapQtApp "$file"
+            elif [ -h "$file" ]
+            then
+                target="$(readlink -e "$file")"
+                echo "wrapping $file -> $target"
+                rm "$file"
+                makeQtWrapper "$target" "$file"
+            fi
+        done
+    done
+}
+
+fixupOutputHooks+=(wrapQtAppsHook)
diff --git a/pkgs/development/libraries/qt-5/mkDerivation.nix b/pkgs/development/libraries/qt-5/mkDerivation.nix
index d4e2143d564..95357c096df 100644
--- a/pkgs/development/libraries/qt-5/mkDerivation.nix
+++ b/pkgs/development/libraries/qt-5/mkDerivation.nix
@@ -1,8 +1,8 @@
-{ stdenv, lib }:
+{ lib, debug, wrapQtAppsHook }:
 
 let inherit (lib) optional; in
 
-{ debug }:
+mkDerivation:
 
 args:
 
@@ -24,7 +24,9 @@ let
 
     enableParallelBuilding = args.enableParallelBuilding or true;
 
+    nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ wrapQtAppsHook ];
+
   };
 in
 
-stdenv.mkDerivation (args // args_)
+mkDerivation (args // args_)
diff --git a/pkgs/development/libraries/qt-5/modules/qtbase.nix b/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 2c050a105b8..458946b803d 100644
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -78,8 +78,6 @@ stdenv.mkDerivation {
       [ libinput ]
       ++ lib.optional withGtk3 gtk3
     )
-       # Needed for OBJC_CLASS_$_NSDate symbols.
-    ++ lib.optional stdenv.isDarwin darwin.cf-private
     ++ lib.optional developerBuild gdb
     ++ lib.optional (cups != null) cups
     ++ lib.optional (mysql != null) mysql.connector-c
diff --git a/pkgs/development/libraries/qt-5/modules/qtconnectivity.nix b/pkgs/development/libraries/qt-5/modules/qtconnectivity.nix
index 17e7f0ee7cf..36a736d03dc 100644
--- a/pkgs/development/libraries/qt-5/modules/qtconnectivity.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtconnectivity.nix
@@ -1,8 +1,8 @@
-{ qtModule, stdenv, qtbase, qtdeclarative, bluez, cf-private }:
+{ qtModule, stdenv, qtbase, qtdeclarative, bluez }:
 
 qtModule {
   name = "qtconnectivity";
   qtInputs = [ qtbase qtdeclarative ];
-  buildInputs = if stdenv.isDarwin then [ cf-private ] else [ bluez ];
+  buildInputs = stdenv.lib.optional stdenv.isLinux bluez;
   outputs = [ "out" "dev" "bin" ];
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtmacextras.nix b/pkgs/development/libraries/qt-5/modules/qtmacextras.nix
index 3f254885986..11964caf17b 100644
--- a/pkgs/development/libraries/qt-5/modules/qtmacextras.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtmacextras.nix
@@ -1,10 +1,8 @@
-{ stdenv, qtModule, qtbase, cf-private }:
+{ stdenv, qtModule, qtbase }:
 
 qtModule {
   name = "qtmacextras";
-  qtInputs = [ qtbase ]
-    # Needed for _OBJC_CLASS_$_NSData symbols.
-    ++ stdenv.lib.optional stdenv.isDarwin cf-private;
+  qtInputs = [ qtbase ];
   meta = with stdenv.lib; {
     maintainers = with maintainers; [ periklis ];
     platforms = platforms.darwin;
diff --git a/pkgs/development/libraries/qt-5/modules/qtspeech.nix b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
index 7b4b19ccab5..ddef01a9482 100644
--- a/pkgs/development/libraries/qt-5/modules/qtspeech.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtspeech.nix
@@ -3,5 +3,5 @@
 qtModule {
   name = "qtspeech";
   qtInputs = [ ];
-  outputs = [ "out" "dev" "bin" ];
+  outputs = [ "out" "dev" ];
 }
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index aa9cdb4d5ae..07fd048d653 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -200,14 +200,6 @@ EOF
     (runCommand "MacOS_SDK_sandbox.h" {} ''
       install -Dm444 "${lib.getDev darwin.apple_sdk.sdk}"/include/sandbox.h "$out"/include/sandbox.h
     '')
-
-    # For:
-    # _NSDefaultRunLoopMode
-    # _OBJC_CLASS_$_NSDate
-    # _OBJC_CLASS_$_NSDictionary
-    # _OBJC_CLASS_$_NSRunLoop
-    # _OBJC_CLASS_$_NSURL
-    darwin.cf-private
   ]);
 
   __impureHostDeps = optional stdenv.isDarwin "/usr/lib/libsandbox.1.dylib";
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
index 40f4c56e809..d65449023b3 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebkit.nix
@@ -28,7 +28,7 @@ qtModule {
     ++ optional (stdenv.isDarwin && lib.versionAtLeast qtbase.version "5.9.0") qtmultimedia
     ++ optional usingAnnulenWebkitFork qtwebchannel;
   buildInputs = [ fontconfig libwebp libxml2 libxslt sqlite glib gst_all_1.gstreamer gst_all_1.gst-plugins-base ]
-    ++ optionals (stdenv.isDarwin) (with darwin; with apple_sdk.frameworks; [ cf-private ICU OpenGL ])
+    ++ optionals (stdenv.isDarwin) (with darwin; with apple_sdk.frameworks; [ ICU OpenGL ])
     ++ optional usingAnnulenWebkitFork hyphen;
   nativeBuildInputs = [
     bison2 flex gdb gperf perl pkgconfig python2 ruby
diff --git a/pkgs/development/libraries/qt-5/modules/qtwebview.nix b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
index 6d5274cbc58..906d750c5d3 100644
--- a/pkgs/development/libraries/qt-5/modules/qtwebview.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebview.nix
@@ -1,20 +1,14 @@
 { darwin, stdenv, qtModule, qtdeclarative, qtwebengine }:
 
 with stdenv.lib;
- 
+
 qtModule {
   name = "qtwebview";
   qtInputs = [ qtdeclarative qtwebengine ];
   buildInputs = optional (stdenv.isDarwin) [
     darwin.apple_sdk.frameworks.CoreFoundation
     darwin.apple_sdk.frameworks.WebKit
-
-    # For:
-    # _OBJC_CLASS_$_NSArray
-    # _OBJC_CLASS_$_NSDate
-    # _OBJC_CLASS_$_NSURL
-    darwin.cf-private
   ];
   outputs = [ "out" "dev" "bin" ];
   NIX_LDFLAGS = optionalString stdenv.isDarwin "-framework CoreFoundation -framework WebKit";
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/libraries/sfml/default.nix b/pkgs/development/libraries/sfml/default.nix
index 8e1b9ae394b..1b043d33ad6 100644
--- a/pkgs/development/libraries/sfml/default.nix
+++ b/pkgs/development/libraries/sfml/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchzip, cmake, libX11, freetype, libjpeg, openal, flac, libvorbis
 , glew, libXrandr, libXrender, udev, xcbutilimage
-, cf-private, IOKit, Foundation, AppKit, OpenAL
+, IOKit, Foundation, AppKit, OpenAL
 }:
 
 let
@@ -19,10 +19,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ freetype libjpeg openal flac libvorbis glew ]
     ++ stdenv.lib.optional stdenv.isLinux udev
     ++ stdenv.lib.optionals (!stdenv.isDarwin) [ libX11 libXrandr libXrender xcbutilimage ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit Foundation AppKit OpenAL
-    # Needed for _NSDefaultRunLoopMode, _OBJC_CLASS_$_NSArray, _OBJC_CLASS_$_NSDate
-    cf-private
-    ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit Foundation AppKit OpenAL ];
 
   cmakeFlags = [ "-DSFML_INSTALL_PKGCONFIG_FILES=yes"
                  "-DSFML_MISC_INSTALL_PREFIX=share/SFML"
diff --git a/pkgs/development/libraries/tk/generic.nix b/pkgs/development/libraries/tk/generic.nix
index be09bb73b3a..a65c6053f29 100644
--- a/pkgs/development/libraries/tk/generic.nix
+++ b/pkgs/development/libraries/tk/generic.nix
@@ -32,11 +32,9 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optional enableAqua "--enable-aqua";
 
   nativeBuildInputs = [ pkgconfig ];
+  buildInputs = lib.optional enableAqua (with darwin.apple_sdk.frameworks; [ Cocoa ]);
 
-  propagatedBuildInputs = [ tcl libXft ]
-    ++ lib.optional enableAqua (with darwin; with apple_sdk.frameworks; [
-      Cocoa cf-private
-    ]);
+  propagatedBuildInputs = [ tcl libXft ];
 
   doCheck = false; # fails. can't find itself
 
diff --git a/pkgs/development/libraries/vtk/default.nix b/pkgs/development/libraries/vtk/default.nix
index 9843b1289cf..e2a82b7adcd 100644
--- a/pkgs/development/libraries/vtk/default.nix
+++ b/pkgs/development/libraries/vtk/default.nix
@@ -2,7 +2,7 @@
 , qtLib ? null
 # Darwin support
 , Cocoa, CoreServices, DiskArbitration, IOKit, CFNetwork, Security, GLUT, OpenGL
-, ApplicationServices, CoreText, IOSurface, cf-private, ImageIO, xpc, libobjc }:
+, ApplicationServices, CoreText, IOSurface, ImageIO, xpc, libobjc }:
 
 with stdenv.lib;
 
@@ -20,13 +20,13 @@ stdenv.mkDerivation rec {
     sha256 = "1hrjxkcvs3ap0bdhk90vymz5pgvxmg7q6sz8ab3wsyddbshr1abq";
   };
 
-  buildInputs =
-    if !stdenv.isDarwin
-    then [ cmake libGLU_combined libX11 xorgproto libXt ] ++ optional (qtLib != null) qtLib
-    else [ cmake qtLib xpc CoreServices DiskArbitration IOKit cf-private
-           CFNetwork Security ApplicationServices CoreText IOSurface ImageIO
-           OpenGL GLUT ];
-  propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ Cocoa libobjc ];
+  buildInputs = [ cmake ]
+    ++ optional (qtLib != null) qtLib
+    ++ optionals stdenv.isLinux [ libGLU_combined libX11 xorgproto libXt ]
+    ++ optionals stdenv.isDarwin [ xpc Cocoa CoreServices DiskArbitration IOKit
+                                   CFNetwork Security ApplicationServices CoreText
+                                   IOSurface ImageIO OpenGL GLUT ];
+  propagatedBuildInputs = stdenv.lib.optionals stdenv.isDarwin [ libobjc ];
 
 
   preBuild = ''
diff --git a/pkgs/development/libraries/wxwidgets/3.0/mac.nix b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
index 7a32aba24ff..cbe8bd8ac5e 100644
--- a/pkgs/development/libraries/wxwidgets/3.0/mac.nix
+++ b/pkgs/development/libraries/wxwidgets/3.0/mac.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchzip, expat, libiconv, libjpeg, libpng, libtiff, zlib
 # darwin only attributes
-, cf-private, derez, rez, setfile
+, derez, rez, setfile
 , AGL, Cocoa, Kernel
 }:
 
@@ -16,15 +16,9 @@ stdenv.mkDerivation rec {
   buildInputs = [
     expat libiconv libjpeg libpng libtiff zlib
     derez rez setfile
-    Cocoa Kernel
-
-    # Needed for CFURLGetFSRef, etc. which have deen deprecated
-    # since 10.9 and are not part of swift-corelibs CoreFoundation.
-    cf-private
+    AGL Cocoa Kernel
   ];
 
-  propagatedBuildInputs = [ AGL ];
-
   postPatch = ''
     substituteInPlace configure --replace "-framework System" -lSystem
   '';
@@ -71,6 +65,5 @@ stdenv.mkDerivation rec {
     homepage = https://www.wxwidgets.org/;
     description = "a C++ library that lets developers create applications for Windows, macOS, Linux and other platforms with a single code base";
     longDescription = "wxWidgets gives you a single, easy-to-use API for writing GUI applications on multiple platforms that still utilize the native platform's controls and utilities. Link with the appropriate library for your platform and compiler, and your application will adopt the look and feel appropriate to that platform. On top of great GUI functionality, wxWidgets gives you: online help, network programming, streams, clipboard and drag and drop, multithreading, image loading and saving in a variety of popular formats, database support, HTML viewing and printing, and much more.";
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/numpy/default.nix b/pkgs/development/python-modules/numpy/default.nix
index d82adaeea28..a02e7ee4c5f 100644
--- a/pkgs/development/python-modules/numpy/default.nix
+++ b/pkgs/development/python-modules/numpy/default.nix
@@ -1,4 +1,4 @@
-{ lib, fetchPypi, python, buildPythonPackage, gfortran, pytest, blas, writeTextFile }:
+{ lib, fetchPypi, python, buildPythonPackage, gfortran, pytest, blas, writeTextFile, isPyPy }:
 
 let
   blasImplementation = lib.nameFromURL blas.name "-";
@@ -45,6 +45,8 @@ in buildPythonPackage rec {
 
   enableParallelBuilding = true;
 
+  doCheck = !isPyPy; # numpy 1.16+ hits a bug in pypy's ctypes, using either numpy or pypy HEAD fixes this (https://github.com/numpy/numpy/issues/13807)
+
   checkPhase = ''
     runHook preCheck
     pushd dist
diff --git a/pkgs/development/python-modules/pytest/default.nix b/pkgs/development/python-modules/pytest/default.nix
index c74d59fd992..96001a2d952 100644
--- a/pkgs/development/python-modules/pytest/default.nix
+++ b/pkgs/development/python-modules/pytest/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, pythonOlder, fetchPypi, attrs, hypothesis, py
 , setuptools_scm, setuptools, six, pluggy, funcsigs, isPy3k, more-itertools
-, atomicwrites, mock, writeText, pathlib2, wcwidth, packaging
+, atomicwrites, mock, writeText, pathlib2, wcwidth, packaging, isPyPy
 }:
 buildPythonPackage rec {
   version = "4.6.3";
@@ -22,6 +22,7 @@ buildPythonPackage rec {
     ++ stdenv.lib.optionals (!isPy3k) [ funcsigs ]
     ++ stdenv.lib.optionals (pythonOlder "3.6") [ pathlib2 ];
 
+  doCheck = !isPyPy; # https://github.com/pytest-dev/pytest/issues/3460
   checkPhase = ''
     runHook preCheck
     $out/bin/py.test -x testing/ -k "not test_collect_pyargs_with_testpaths"
diff --git a/pkgs/development/python-modules/watchdog/default.nix b/pkgs/development/python-modules/watchdog/default.nix
index e785f5efa79..361baea4916 100644
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   };
 
   buildInputs = stdenv.lib.optionals stdenv.isDarwin
-    [ pkgs.darwin.apple_sdk.frameworks.CoreServices pkgs.darwin.cf-private ];
+    [ pkgs.darwin.apple_sdk.frameworks.CoreServices ];
   propagatedBuildInputs = [ argh pathtools pyyaml ];
 
   doCheck = false;
diff --git a/pkgs/development/r-modules/wrapper-rstudio.nix b/pkgs/development/r-modules/wrapper-rstudio.nix
index c89773c2dd5..5eeac8fed30 100644
--- a/pkgs/development/r-modules/wrapper-rstudio.nix
+++ b/pkgs/development/r-modules/wrapper-rstudio.nix
@@ -1,4 +1,4 @@
-{ lib, runCommand, R, rstudio, makeWrapper, recommendedPackages, packages, qtbase }:
+{ lib, runCommand, R, rstudio, wrapQtAppsHook, recommendedPackages, packages, qtbase }:
 
 let
   qtVersion = with lib.versions; "${major qtbase.version}.${minor qtbase.version}";
@@ -7,7 +7,8 @@ runCommand (rstudio.name + "-wrapper") {
   preferLocalBuild = true;
   allowSubstitutes = false;
 
-  nativeBuildInputs = [makeWrapper];
+  nativeBuildInputs = [wrapQtAppsHook];
+  dontWrapQtApps = true;
 
   buildInputs = [R rstudio] ++ recommendedPackages ++ packages;
 
@@ -29,6 +30,6 @@ echo -n ".libPaths(c(.libPaths(), \"" >> $out/$fixLibsR
 echo -n $R_LIBS_SITE | sed -e 's/:/", "/g' >> $out/$fixLibsR
 echo -n "\"))" >> $out/$fixLibsR
 echo >> $out/$fixLibsR
-makeWrapper ${rstudio}/bin/rstudio $out/bin/rstudio --set R_PROFILE_USER $out/$fixLibsR \
-  --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-${qtVersion}/plugins
+makeQtWrapper ${rstudio}/bin/rstudio $out/bin/rstudio \
+  --set R_PROFILE_USER $out/$fixLibsR
 ''
diff --git a/pkgs/development/tools/analysis/flow/default.nix b/pkgs/development/tools/analysis/flow/default.nix
index 62c781e1c9d..80cfd6231bf 100644
--- a/pkgs/development/tools/analysis/flow/default.nix
+++ b/pkgs/development/tools/analysis/flow/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ocamlPackages, cf-private, CoreServices }:
+{ stdenv, fetchFromGitHub, ocamlPackages, CoreServices }:
 
 stdenv.mkDerivation rec {
   pname = "flow";
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = (with ocamlPackages; [ ocaml findlib ocamlbuild dtoa core_kernel sedlex ocaml_lwt lwt_log lwt_ppx ppx_deriving ppx_gen_rec ppx_tools_versioned visitors wtf8 ])
-    ++ stdenv.lib.optionals stdenv.isDarwin [ cf-private CoreServices ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with stdenv.lib; {
     description = "A static type checker for JavaScript";
diff --git a/pkgs/development/tools/analysis/hopper/default.nix b/pkgs/development/tools/analysis/hopper/default.nix
index 7158ea38c04..c9214ae7e35 100644
--- a/pkgs/development/tools/analysis/hopper/default.nix
+++ b/pkgs/development/tools/analysis/hopper/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgs, makeWrapper, lib }:
+{ stdenv, fetchurl, pkgs, lib }:
 
 stdenv.mkDerivation rec {
   pname    = "hopper";
@@ -16,22 +16,20 @@ stdenv.mkDerivation rec {
 libbsd.out libffi.out gmpxx.out python27Full.out python27Packages.libxml2 qt5.qtbase zlib  xlibs.libX11.out xorg_sys_opengl.out xlibs.libXrender.out gcc-unwrapped.lib
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ pkgs.qt5.wrapQtAppsHook ];
+
+  qtWrapperArgs = [ ''--suffix LD_LIBRARY_PATH : ${ldLibraryPath}'' ];
 
   installPhase = ''
-     mkdir -p $out/bin
-     mkdir -p $out/lib
-     mkdir -p $out/share
-     cp $sourceRoot/opt/hopper-${rev}/bin/Hopper $out/bin/hopper
-     cp -r $sourceRoot/opt/hopper-${rev}/lib $out
-     cp -r $sourceRoot/usr/share $out/share
+    mkdir -p $out/bin
+    mkdir -p $out/lib
+    mkdir -p $out/share
+    cp $sourceRoot/opt/hopper-${rev}/bin/Hopper $out/bin/hopper
+    cp -r $sourceRoot/opt/hopper-${rev}/lib $out
+    cp -r $sourceRoot/usr/share $out/share
     patchelf \
-    --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 \
-    $out/bin/hopper
-    # Details: https://nixos.wiki/wiki/Qt
-     wrapProgram $out/bin/hopper \
-    --suffix LD_LIBRARY_PATH : ${ldLibraryPath} \
-    --suffix QT_PLUGIN_PATH : ${pkgs.qt5.qtbase}/lib/qt-${pkgs.qt5.qtbase.qtCompatVersion}/plugins
+      --set-interpreter ${stdenv.glibc}/lib/ld-linux-x86-64.so.2 \
+      $out/bin/hopper
   '';
 
   meta = {
diff --git a/pkgs/development/tools/cargo-web/default.nix b/pkgs/development/tools/cargo-web/default.nix
index 262a3d31742..fa45ba689df 100644
--- a/pkgs/development/tools/cargo-web/default.nix
+++ b/pkgs/development/tools/cargo-web/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, openssl, perl, pkgconfig, rustPlatform
-, CoreServices, Security, cf-private
+, CoreServices, Security
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -16,11 +16,7 @@ rustPlatform.buildRustPackage rec {
   cargoSha256 = "1f4sj260q4rlzbajwimya1yhh90hmmbhr47yfg9i8xcv5cg0cqjn";
 
   nativeBuildInputs = [ openssl perl pkgconfig ];
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
-    CoreServices Security
-    # Needed for CFURLResourceIsReachable symbols.
-    cf-private
-  ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   meta = with stdenv.lib; {
     description = "A Cargo subcommand for the client-side Web";
diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index 03b758cbdc6..1b3bc7a2162 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -10,7 +10,7 @@ let
   revision = "1";
 
   # Fetch clang from qt vendor, this contains submodules like this:
-  # clang<-clang-tools-extra<-clazy. 
+  # clang<-clang-tools-extra<-clazy.
   clang_qt_vendor = llvmPackages_8.clang-unwrapped.overrideAttrs (oldAttrs: rec {
     src = fetchgit {
       url = "https://code.qt.io/clang/clang.git";
@@ -32,15 +32,15 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qtbase qtscript qtquickcontrols qtdeclarative llvmPackages_8.libclang clang_qt_vendor llvmPackages_8.llvm ];
 
-  nativeBuildInputs = [ qmake makeWrapper ];
+  nativeBuildInputs = [ qmake ];
 
-  # 0001-Fix-clang-libcpp-regexp.patch is for fixing regexp that is used to 
+  # 0001-Fix-clang-libcpp-regexp.patch is for fixing regexp that is used to
   # find clang libc++ library include paths. By default it's not covering paths
   # like libc++-version, which is default name for libc++ folder in nixos.
-  patches = [ ./0001-Fix-clang-libcpp-regexp.patch 
+  patches = [ ./0001-Fix-clang-libcpp-regexp.patch
 
-    # Fix clazy plugin name. This plugin was renamed with clang8 
-    # release, and patch didn't make it into 4.9.1 release. Should be removed 
+    # Fix clazy plugin name. This plugin was renamed with clang8
+    # release, and patch didn't make it into 4.9.1 release. Should be removed
     # on qtcreator update, if this problem is fixed.
     (fetchpatch {
       url = "https://code.qt.io/cgit/qt-creator/qt-creator.git/patch/src/plugins/clangcodemodel/clangeditordocumentprocessor.cpp?id=53c407bc0c87e0b65b537bf26836ddd8e00ead82";
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
       url = "https://code.qt.io/cgit/qt-creator/qt-creator.git/patch/src/plugins/clangtools/clangtidyclazyrunner.cpp?id=53c407bc0c87e0b65b537bf26836ddd8e00ead82";
       sha256 = "1rl0rc2l297lpfhhawvkkmj77zb081hhp0bbi7nnykf3q9ch0clh";
     })
-  ]; 
+  ];
 
   doCheck = true;
 
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
       --replace '$$clean_path($${LLVM_LIBDIR}/clang/$${LLVM_VERSION}/include)' '${clang_qt_vendor}/lib/clang/8.0.0/include' \
       --replace '$$clean_path($${LLVM_BINDIR})' '${clang_qt_vendor}/bin'
 
-    # Fix include path to find clang and clang-c include directories.  
+    # Fix include path to find clang and clang-c include directories.
     substituteInPlace src/plugins/clangtools/clangtools.pro \
       --replace 'INCLUDEPATH += $$LLVM_INCLUDEPATH' 'INCLUDEPATH += $$LLVM_INCLUDEPATH ${clang_qt_vendor}'
 
diff --git a/pkgs/development/tools/tora/default.nix b/pkgs/development/tools/tora/default.nix
index 5b46b975cf7..2bbe2cfe16d 100644
--- a/pkgs/development/tools/tora/default.nix
+++ b/pkgs/development/tools/tora/default.nix
@@ -53,10 +53,9 @@ in mkDerivation rec {
 
   NIX_CFLAGS_COMPILE = [ "-L${mysql.connector-c}/lib/mysql" "-I${mysql.connector-c}/include/mysql" ];
 
-  postFixup = ''
-    wrapProgram $out/bin/tora \
-      --prefix PATH : ${lib.getBin graphviz}/bin
-  '';
+  qtWrapperArgs = [
+    ''--prefix PATH : ${lib.getBin graphviz}/bin''
+  ];
 
   meta = with lib; {
     description = "Tora SQL tool";
diff --git a/pkgs/development/tools/watchman/default.nix b/pkgs/development/tools/watchman/default.nix
index b349ecf61e1..4a056db6c0c 100644
--- a/pkgs/development/tools/watchman/default.nix
+++ b/pkgs/development/tools/watchman/default.nix
@@ -1,12 +1,11 @@
-{ stdenv, lib, config, fetchFromGitHub, autoconf, automake, pcre,
-  libtool, pkgconfig, openssl,
-  confFile ? config.watchman.confFile or null,
-  withApple ? stdenv.isDarwin, CoreServices, CoreFoundation
+{ stdenv, lib, config, fetchFromGitHub, autoconf, automake, pcre
+, libtool, pkgconfig, openssl
+, confFile ? config.watchman.confFile or null
+, withApple ? stdenv.isDarwin, CoreServices
 }:
 
 stdenv.mkDerivation rec {
   name = "watchman-${version}";
-
   version = "4.9.0";
 
   src = fetchFromGitHub {
@@ -16,18 +15,18 @@ stdenv.mkDerivation rec {
     sha256 = "0fdaj5pmicm6j17d5q7px800m5rmam1a400x3hv1iiifnmhgnkal";
   };
 
-  buildInputs = [ pcre openssl ]
-               ++ lib.optionals withApple [ CoreFoundation CoreServices ];
   nativeBuildInputs = [ autoconf automake pkgconfig libtool ];
+  buildInputs = [ pcre openssl ]
+    ++ lib.optionals withApple [ CoreServices ];
 
   configureFlags = [
-      "--enable-lenient"
-      "--enable-conffile=${if confFile == null then "no" else confFile}"
-      "--with-pcre=yes"
+    "--enable-lenient"
+    "--enable-conffile=${if confFile == null then "no" else confFile}"
+    "--with-pcre=yes"
 
-      # For security considerations re: --disable-statedir, see:
-      # https://github.com/facebook/watchman/issues/178
-      "--disable-statedir"
+    # For security considerations re: --disable-statedir, see:
+    # https://github.com/facebook/watchman/issues/178
+    "--disable-statedir"
   ];
 
   prePatch = ''
diff --git a/pkgs/games/chessx/default.nix b/pkgs/games/chessx/default.nix
index 5800f8026ac..47432bca163 100644
--- a/pkgs/games/chessx/default.nix
+++ b/pkgs/games/chessx/default.nix
@@ -32,9 +32,6 @@ stdenv.mkDerivation rec {
     cp -pr release/chessx "$out/bin"
     cp -pr unix/chessx.desktop "$out/share/applications"
 
-    wrapProgram $out/bin/chessx \
-      --prefix QT_PLUGIN_PATH : ${qtbase}/lib/qt-5.${lib.versions.minor qtbase.version}/plugins
-
     runHook postInstall
   '';
 
diff --git a/pkgs/games/flightgear/default.nix b/pkgs/games/flightgear/default.nix
index 728709a12f6..9765a9c06ee 100644
--- a/pkgs/games/flightgear/default.nix
+++ b/pkgs/games/flightgear/default.nix
@@ -62,13 +62,12 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir -p "$out/share/applications/"
     cp "${desktopItem}"/share/applications/* "$out/share/applications/" #*/
-
-    for f in $out/bin/* #*/
-    do
-      wrapProgram $f --set FG_ROOT "${data}/share/FlightGear"
-    done
   '';
 
+  qtWrapperArgs = [
+    ''--set FG_ROOT "${data}/share/FlightGear"''
+  ];
+
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/games/gargoyle/default.nix b/pkgs/games/gargoyle/default.nix
index 62ea798e465..83a567fa578 100644
--- a/pkgs/games/gargoyle/default.nix
+++ b/pkgs/games/gargoyle/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, substituteAll, jam, cctools, pkgconfig
-, SDL, SDL_mixer, SDL_sound, cf-private, gtk2, libvorbis, smpeg }:
+, SDL, SDL_mixer, SDL_sound, gtk2, libvorbis, smpeg }:
 
 let
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ jam pkgconfig ] ++ stdenv.lib.optional stdenv.isDarwin cctools;
 
   buildInputs = [ SDL SDL_mixer SDL_sound gtk2 ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [ cf-private smpeg libvorbis ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ smpeg libvorbis ];
 
   buildPhase = jamenv + "jam -j$NIX_BUILD_CORES";
 
diff --git a/pkgs/games/nethack/default.nix b/pkgs/games/nethack/default.nix
index 5e476cdc7e9..24cc64ac9af 100644
--- a/pkgs/games/nethack/default.nix
+++ b/pkgs/games/nethack/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, coreutils, ncurses, gzip, flex, bison
-, less, makeWrapper
+, less
 , buildPackages
 , x11Mode ? false, qtMode ? false, libXaw, libXext, libXpm, bdftopcf, mkfontdir, pkgconfig, qt5
 }:
@@ -37,7 +37,7 @@ in stdenv.mkDerivation rec {
                       ++ lib.optionals x11Mode [ mkfontdir bdftopcf ]
                       ++ lib.optionals qtMode [
                            pkgconfig mkfontdir qt5.qtbase.dev
-                           qt5.qtmultimedia.dev makeWrapper
+                           qt5.qtmultimedia.dev qt5.wrapQtAppsHook
                            bdftopcf
                          ];
 
@@ -97,6 +97,10 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  preFixup = ''
+    wrapQtApp "$out/games/nethack"
+  '';
+
   postInstall = ''
     mkdir -p $out/games/lib/nethackuserdir
     for i in xlogfile logfile perm record save; do
@@ -137,11 +141,6 @@ in stdenv.mkDerivation rec {
     ${lib.optionalString (!(x11Mode || qtMode)) "install -Dm 555 util/dlb -t $out/libexec/nethack/"}
   '';
 
-  postFixup = lib.optionalString qtMode ''
-    wrapProgram $out/bin/nethack-qt \
-      --prefix QT_PLUGIN_PATH : "${qt5.qtbase}/${qt5.qtbase.qtPluginPrefix}"
-  '';
-
   meta = with stdenv.lib; {
     description = "Rogue-like game";
     homepage = http://nethack.org/;
diff --git a/pkgs/misc/emulators/dolphin-emu/master.nix b/pkgs/misc/emulators/dolphin-emu/master.nix
index d44560b4ddf..6f32e91044c 100644
--- a/pkgs/misc/emulators/dolphin-emu/master.nix
+++ b/pkgs/misc/emulators/dolphin-emu/master.nix
@@ -5,7 +5,7 @@
 , soundtouch, sfml, vulkan-loader ? null, libpulseaudio ? null
 
 # - Inputs used for Darwin
-, CoreBluetooth, cf-private, ForceFeedback, IOKit, OpenGL, libpng, hidapi }:
+, CoreBluetooth, ForceFeedback, IOKit, OpenGL, libpng, hidapi }:
 
 let
   desktopItem = makeDesktopItem {
@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
   ] ++ stdenv.lib.optionals stdenv.isLinux [
     bluez udev libevdev alsaLib vulkan-loader
   ] ++ stdenv.lib.optionals stdenv.isDarwin [
-    CoreBluetooth cf-private OpenGL ForceFeedback IOKit
+    CoreBluetooth OpenGL ForceFeedback IOKit
   ];
 
   cmakeFlags = [
diff --git a/pkgs/misc/emulators/mgba/default.nix b/pkgs/misc/emulators/mgba/default.nix
index 7a5ed31a580..039bc57e603 100644
--- a/pkgs/misc/emulators/mgba/default.nix
+++ b/pkgs/misc/emulators/mgba/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeDesktopItem, makeWrapper, pkgconfig
+{ stdenv, fetchFromGitHub, makeDesktopItem, wrapQtAppsHook, pkgconfig
 , cmake, epoxy, libzip, ffmpeg, imagemagick, SDL2, qtbase, qtmultimedia, libedit
 , qttools, minizip }:
 
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
   };
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ makeWrapper pkgconfig cmake ];
+  nativeBuildInputs = [ wrapQtAppsHook pkgconfig cmake ];
 
   buildInputs = [
     libzip epoxy ffmpeg imagemagick SDL2 qtbase qtmultimedia libedit minizip
@@ -34,8 +34,6 @@ in stdenv.mkDerivation rec {
 
   postInstall = ''
     cp -r ${desktopItem}/share/applications $out/share
-    wrapProgram $out/bin/mgba-qt --suffix QT_PLUGIN_PATH : \
-      ${qtbase.bin}/${qtbase.qtPluginPrefix}
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/misc/jackaudio/default.nix b/pkgs/misc/jackaudio/default.nix
index fb7c26a6d7a..f246c41d965 100644
--- a/pkgs/misc/jackaudio/default.nix
+++ b/pkgs/misc/jackaudio/default.nix
@@ -3,7 +3,7 @@
 , bash, libsamplerate, libsndfile, readline, eigen, celt
 , wafHook
 # Darwin Dependencies
-, aften, AudioUnit, CoreAudio, cf-private, libobjc, Accelerate
+, aften, AudioUnit, CoreAudio, libobjc, Accelerate
 
 # Optional Dependencies
 , dbus ? null, libffado ? null, alsaLib ? null
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libsamplerate libsndfile readline eigen celt
     optDbus optPythonDBus optLibffado optAlsaLib optLibopus
   ] ++ optionals stdenv.isDarwin [
-    aften AudioUnit CoreAudio Accelerate cf-private libobjc
+    aften AudioUnit CoreAudio Accelerate libobjc
   ];
 
   prePatch = ''
diff --git a/pkgs/os-specific/darwin/cf-private/setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index ae9ed5d1584..66e24fe5877 100644
--- a/pkgs/os-specific/darwin/cf-private/setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -1,12 +1,9 @@
-prependSearchPath() {
-  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks ${NIX_CFLAGS_COMPILE}"
-}
-
-linkWithRealCF() {
+linkSystemCoreFoundationFramework() {
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks $NIX_CFLAGS_COMPILE"
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
   NIX_LDFLAGS+=" /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
 }
 
-preConfigureHooks+=(prependSearchPath linkWithRealCF)
+preConfigureHooks+=(linkSystemCoreFoundationFramework)
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 2e3ae22e0b2..4d33fc0f3f8 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -156,7 +156,7 @@ in rec {
       __propagatedImpureHostDeps = [ "/usr/lib/libXplugin.1.dylib" ];
 
       propagatedBuildInputs = with frameworks; [
-        OpenGL ApplicationServices Carbon IOKit pkgs.darwin.CF CoreGraphics CoreServices CoreText
+        OpenGL ApplicationServices Carbon IOKit CoreGraphics CoreServices CoreText
       ];
 
       installPhase = ''
@@ -187,6 +187,10 @@ in rec {
       ];
     });
 
+    CoreFoundation = stdenv.lib.overrideDerivation super.CoreFoundation (drv: {
+      setupHook = ./cf-setup-hook.sh;
+    });
+
     CoreMedia = stdenv.lib.overrideDerivation super.CoreMedia (drv: {
       __propagatedImpureHostDeps = drv.__propagatedImpureHostDeps ++ [
         "/System/Library/Frameworks/CoreImage.framework"
@@ -222,7 +226,7 @@ in rec {
 
   bareFrameworks = stdenv.lib.mapAttrs framework (import ./frameworks.nix {
     inherit frameworks libs;
-    inherit (pkgs.darwin) CF cf-private libobjc;
+    inherit (pkgs.darwin) libobjc;
   });
 
   frameworks = bareFrameworks // overrides bareFrameworks;
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index 03c800b8dae..c803bf42187 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -2,81 +2,81 @@
 # Epic weird knot-tying happening here.
 # TODO: clean up the process for generating this and include it
 
-{ frameworks, libs, CF, libobjc, cf-private }:
+{ frameworks, libs, libobjc, }:
 
 with frameworks; with libs; {
   AGL                     = [ Carbon OpenGL ];
   AVFoundation            = [ ApplicationServices CoreGraphics ];
   AVKit                   = [];
   Accounts                = [];
-  AddressBook             = [ Carbon CF ];
+  AddressBook             = [ Carbon ];
   AppKit                  = [ AudioToolbox AudioUnit Foundation QuartzCore ];
   AppKitScripting         = [];
   AppleScriptKit          = [];
   AppleScriptObjC         = [];
-  AudioToolbox            = [ CoreAudio CF CoreMIDI ];
-  AudioUnit               = [ AudioToolbox Carbon CoreAudio CF ];
+  AudioToolbox            = [ CoreAudio CoreMIDI ];
+  AudioUnit               = [ AudioToolbox Carbon CoreAudio ];
   AudioVideoBridging      = [ Foundation ];
   Automator               = [];
-  CFNetwork               = [ CF ];
+  CFNetwork               = [];
   CalendarStore           = [];
   Cocoa                   = [ AppKit ];
   Collaboration           = [];
   # Impure version of CoreFoundation, this should not be used unless another
   # framework includes headers that are not available in the pure version.
   CoreFoundation          = [];
-  CoreAudio               = [ CF IOKit ];
+  CoreAudio               = [ IOKit ];
   CoreAudioKit            = [ AudioUnit ];
   CoreData                = [];
-  CoreGraphics            = [ Accelerate CF IOKit IOSurface SystemConfiguration ];
-  CoreImage               = [ ];
+  CoreGraphics            = [ Accelerate IOKit IOSurface SystemConfiguration ];
+  CoreImage               = [];
   CoreLocation            = [];
-  CoreMIDI                = [ CF ];
+  CoreMIDI                = [];
   CoreMIDIServer          = [];
-  CoreMedia               = [ ApplicationServices AudioToolbox AudioUnit CoreAudio CF CoreGraphics CoreVideo ];
-  CoreMediaIO             = [ CF CoreMedia ];
-  CoreText                = [ CF CoreGraphics ];
-  CoreVideo               = [ ApplicationServices CF CoreGraphics IOSurface OpenGL ];
+  CoreMedia               = [ ApplicationServices AudioToolbox AudioUnit CoreAudio CoreGraphics CoreVideo ];
+  CoreMediaIO             = [ CoreMedia ];
+  CoreText                = [ CoreGraphics ];
+  CoreVideo               = [ ApplicationServices CoreGraphics IOSurface OpenGL ];
   CoreWLAN                = [ SecurityFoundation ];
   DVDPlayback             = [];
-  DirectoryService        = [ CF ];
-  DiscRecording           = [ CF CoreServices IOKit ];
+  DirectoryService        = [];
+  DiscRecording           = [ CoreServices IOKit ];
   DiscRecordingUI         = [];
-  DiskArbitration         = [ CF IOKit ];
+  DiskArbitration         = [ IOKit ];
   EventKit                = [];
   ExceptionHandling       = [];
   FWAUserLib              = [];
-  ForceFeedback           = [ CF IOKit ];
-  Foundation              = [ cf-private libobjc Security ApplicationServices SystemConfiguration ];
-  GLKit                   = [ CF ];
+  ForceFeedback           = [ IOKit ];
+  Foundation              = [ libobjc CoreFoundation Security ApplicationServices SystemConfiguration ];
+  GLKit                   = [];
   GLUT                    = [ OpenGL ];
   GSS                     = [];
   GameController          = [];
   GameKit                 = [ Foundation ];
   Hypervisor              = [];
-  ICADevices              = [ Carbon CF IOBluetooth ];
+  ICADevices              = [ Carbon IOBluetooth ];
   IMServicePlugIn         = [];
   IOBluetoothUI           = [ IOBluetooth ];
-  IOKit                   = [ CF ];
-  IOSurface               = [ CF IOKit xpc ];
+  IOKit                   = [];
+  IOSurface               = [ IOKit xpc ];
   ImageCaptureCore        = [];
-  ImageIO                 = [ CF CoreGraphics ];
+  ImageIO                 = [ CoreGraphics ];
   InputMethodKit          = [ Carbon ];
   InstallerPlugins        = [];
   InstantMessage          = [];
   JavaFrameEmbedding      = [];
-  JavaScriptCore          = [ CF ];
+  JavaScriptCore          = [];
   Kerberos                = [];
-  Kernel                  = [ CF IOKit ];
+  Kernel                  = [ IOKit ];
   LDAP                    = [];
-  LatentSemanticMapping   = [ Carbon CF ];
+  LatentSemanticMapping   = [ Carbon ];
   MapKit                  = [];
-  MediaAccessibility      = [ CF CoreGraphics CoreText QuartzCore ];
-  MediaToolbox            = [ AudioToolbox AudioUnit CF CoreMedia ];
+  MediaAccessibility      = [ CoreGraphics CoreText QuartzCore ];
+  MediaToolbox            = [ AudioToolbox AudioUnit CoreMedia ];
   Metal                   = [];
   MetalKit                = [ ModelIO Metal ];
   ModelIO                 = [ ];
-  NetFS                   = [ CF ];
+  NetFS                   = [];
   OSAKit                  = [ Carbon ];
   OpenAL                  = [];
   OpenCL                  = [ IOSurface OpenGL ];
@@ -85,37 +85,38 @@ with frameworks; with libs; {
   PreferencePanes         = [];
   PubSub                  = [];
   QTKit                   = [ CoreMediaIO CoreMedia MediaToolbox QuickTime VideoToolbox ];
-  QuickLook               = [ ApplicationServices CF ];
+  QuickLook               = [ ApplicationServices ];
   SceneKit                = [];
   ScreenSaver             = [];
   Scripting               = [];
   ScriptingBridge         = [];
-  Security                = [ CF IOKit ];
+  Security                = [ IOKit ];
   SecurityFoundation      = [];
   SecurityInterface       = [ Security ];
-  ServiceManagement       = [ CF Security ];
+  ServiceManagement       = [ Security ];
   Social                  = [];
   SpriteKit               = [];
   StoreKit                = [];
   SyncServices            = [];
-  SystemConfiguration     = [ CF Security ];
+  SystemConfiguration     = [ Security ];
   TWAIN                   = [ Carbon ];
   Tcl                     = [];
-  VideoDecodeAcceleration = [ CF CoreVideo ];
-  VideoToolbox            = [ CF CoreMedia CoreVideo ];
+  VideoDecodeAcceleration = [ CoreVideo ];
+  VideoToolbox            = [ CoreMedia CoreVideo ];
   WebKit                  = [ ApplicationServices Carbon JavaScriptCore OpenGL ];
 
   # Umbrellas
   Accelerate          = [ CoreWLAN IOBluetooth ];
-  ApplicationServices = [ CF CoreServices CoreText ImageIO ];
-  Carbon              = [ ApplicationServices CF CoreServices Foundation IOKit Security QuartzCore ];
+  ApplicationServices = [ CoreServices CoreText ImageIO ];
+  Carbon              = [ ApplicationServices CoreServices Foundation IOKit Security QuartzCore ];
   CoreBluetooth       = [];
-  CoreServices        = [ CFNetwork CoreAudio CoreData CF DiskArbitration Security NetFS OpenDirectory ServiceManagement ];
+  # TODO: figure out which part of the umbrella depends on CoreFoundation and move it there.
+  CoreServices        = [ CFNetwork CoreFoundation CoreAudio CoreData DiskArbitration Security NetFS OpenDirectory ServiceManagement ];
   IOBluetooth         = [ IOKit ];
   JavaVM              = [];
   OpenDirectory       = [];
   Quartz              = [ QuickLook QTKit ];
-  QuartzCore          = [ ApplicationServices CF CoreVideo OpenCL CoreImage Metal ];
+  QuartzCore          = [ ApplicationServices CoreVideo OpenCL CoreImage Metal ];
   QuickTime           = [ ApplicationServices AudioUnit Carbon CoreAudio CoreServices OpenGL QuartzCore ];
 
   vmnet = [];
diff --git a/pkgs/os-specific/darwin/cf-private/default.nix b/pkgs/os-specific/darwin/cf-private/default.nix
deleted file mode 100644
index eb5f651a1a0..00000000000
--- a/pkgs/os-specific/darwin/cf-private/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ CF, apple_sdk }:
-
-# cf-private is a bit weird, but boils down to CF with a weird setup-hook that
-# makes a build link against the system CoreFoundation rather than our pure one.
-# The reason it exists is that although our CF headers and build are pretty legit
-# now, the underlying runtime is quite different. Apple's in a bit of flux around CF
-# right now, and support three different backends for it: swift, "C", and an ObjC
-# one. The former two can be built from public sources, but the ObjC one isn't really
-# public. Unfortunately, it's also one of the core underpinnings of a lot of Mac-
-# specific behavior, and defines a lot of symbols that some Objective C apps depend
-# on, even though one might expect those symbols to derive from Foundation. So if
-# your app relies on NSArray and several other basic ObjC types, it turns out that
-# because of their magic "toll-free bridging" support, the symbols for those types
-# live in CoreFoundation with an ObjC runtime. And because that isn't public, we have
-# this hack in place to let people link properly anyway. Phew!
-#
-# This can be revisited if Apple ever decide to release the ObjC backend in a publicly
-# buildable form.
-#
-# This doesn't really need to rebuild CF, but it's cheap, and adding a setup hook to
-# an existing package was annoying. We need a buildEnv that knows how to add those
-CF.overrideAttrs (orig: {
-  # PLEASE if you add things to this derivation, explain in reasonable detail why
-  # you're adding them and when the workaround can go away. This whole derivation is
-  # a workaround and if you don't explain what you're working around, it makes it
-  # very hard for people to clean it up later.
-
-  name = "${orig.name}-private";
-  setupHook = ./setup-hook.sh;
-
-  # TODO: consider re-adding https://github.com/NixOS/nixpkgs/blob/master/pkgs/os-specific/darwin/apple-source-releases/CF/cf-bridging.patch
-  # once the missing headers are in and see if that fixes all need for this.
-
-  # This can go away once https://bugs.swift.org/browse/SR-8741 happens, which is
-  # looking more likely these days with the friendly people at Apple! We only need
-  # the header because the setup hook takes care of linking us against a version
-  # of the framework with the functionality built into it. The main user I know of
-  # this is watchman, who can almost certainly switch to the pure CF once the header
-  # and functionality is merged in.
-  installPhase = orig.installPhase + ''
-    basepath="Library/Frameworks/CoreFoundation.framework/Headers"
-
-    # Append the include at top level or nobody will notice the header we're about to add
-    sed -i '/CFNotificationCenter.h/a #include <CoreFoundation/CFFileDescriptor.h>' \
-      "$out/$basepath/CoreFoundation.h"
-
-    cp ${apple_sdk.frameworks.CoreFoundation}/$basepath/CFFileDescriptor.h $out/$basepath/CFFileDescriptor.h
-  '' +
-  # This one is less likely to go away, but I'll mention it anyway. The issue is at
-  # https://bugs.swift.org/browse/SR-8744, and the main user I know of is qtbase
-  ''
-    path="$basepath/CFURLEnumerator.h"
-    sed -i '/CFNotificationCenter.h/a #include <CoreFoundation/CFURLEnumerator.h>' \
-      "$out/$basepath/CoreFoundation.h"
-
-    cp ${apple_sdk.frameworks.CoreFoundation}/$path $out/$path
-  '';
-})
diff --git a/pkgs/os-specific/darwin/trash/default.nix b/pkgs/os-specific/darwin/trash/default.nix
index 4044ee4d0dd..fcbcfe00a3e 100644
--- a/pkgs/os-specific/darwin/trash/default.nix
+++ b/pkgs/os-specific/darwin/trash/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, perl, cf-private, AppKit, Cocoa, ScriptingBridge }:
+{ stdenv, fetchFromGitHub, perl, AppKit, Cocoa, ScriptingBridge }:
 
 stdenv.mkDerivation rec {
   version = "0.9.2";
@@ -11,12 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1d3rc03vgz32faj7qi18iiggxvxlqrj9lsk5jkpa9r1mcs5d89my";
   };
 
-  buildInputs = [
-    perl
-    Cocoa AppKit ScriptingBridge
-    # Neded for OBJC_CLASS_$_NSMutableArray symbols.
-    cf-private
-  ];
+  buildInputs = [ perl Cocoa AppKit ScriptingBridge ];
 
   patches = [ ./trash.diff ];
 
diff --git a/pkgs/os-specific/linux/apparmor/cross.patch b/pkgs/os-specific/linux/apparmor/cross.patch
new file mode 100644
index 00000000000..f7e95ecfb40
--- /dev/null
+++ b/pkgs/os-specific/linux/apparmor/cross.patch
@@ -0,0 +1,19 @@
+--- a/parser/libapparmor_re/Makefile	2018-10-14 07:38:06.000000000 +0800
++++ b/parser/libapparmor_re/Makefile	2019-06-28 16:16:33.741916660 +0800
+@@ -10,6 +10,7 @@
+ 
+ TARGET=libapparmor_re.a
+ 
++AR ?= ar
+ CFLAGS ?= -g -Wall -O2 ${EXTRA_CFLAGS} -std=gnu++0x
+ CXXFLAGS := ${CFLAGS} ${INCLUDE_APPARMOR}
+ 
+@@ -22,7 +23,7 @@
+ UNITTESTS = tst_parse
+ 
+ libapparmor_re.a: parse.o expr-tree.o hfa.o chfa.o aare_rules.o
+-	ar ${ARFLAGS} $@ $^
++	${AR} ${ARFLAGS} $@ $^
+ 
+ expr-tree.o: expr-tree.cc expr-tree.h
+ 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index ccad9795301..06c37d00d5e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -49,7 +49,9 @@ let
       sha256 = "1m4dx901biqgnr4w4wz8a2z9r9dxyw7wv6m6mqglqwf2lxinqmp4";
     })
     # (alpine patches {1,4,5,6,8} are needed for apparmor 2.11, but not 2.12)
-  ];
+    ] ++ [
+      ./cross.patch
+    ];
 
   # Set to `true` after the next FIXME gets fixed or this gets some
   # common derivation infra. Too much copy-paste to fix one by one.
@@ -185,7 +187,7 @@ let
     '';
     inherit patches;
     postPatch = "cd ./parser";
-    makeFlags = ''LANGS= USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include'';
+    makeFlags = ''LANGS= USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include AR=${stdenv.cc.bintools.targetPrefix}ar'';
     installFlags = ''DESTDIR=$(out) DISTRO=unknown'';
 
     inherit doCheck;
diff --git a/pkgs/servers/x11/quartz-wm/default.nix b/pkgs/servers/x11/quartz-wm/default.nix
index 52cb1e750a6..92350595dd8 100644
--- a/pkgs/servers/x11/quartz-wm/default.nix
+++ b/pkgs/servers/x11/quartz-wm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xorg, pixman, pkgconfig, AppKit, Foundation, Xplugin, cf-private }:
+{ stdenv, fetchurl, xorg, pixman, pkgconfig, AppKit, Foundation, Xplugin }:
 
 let version = "1.3.1";
 in stdenv.mkDerivation {
@@ -20,8 +20,6 @@ in stdenv.mkDerivation {
     pixman
     pkgconfig
     AppKit Xplugin Foundation
-    # Needed for CFNotificationCenterAddObserver symbols.
-    cf-private
   ];
   meta = with stdenv.lib; {
     license = licenses.apsl20;
diff --git a/pkgs/servers/x11/xorg/overrides.nix b/pkgs/servers/x11/xorg/overrides.nix
index 7b6299105b1..1da5c31c25f 100644
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@@ -5,7 +5,7 @@
   libGL, spice-protocol, zlib, libGLU, dbus, libunwind, libdrm,
   mesa, udev, bootstrap_cmds, bison, flex, clangStdenv, autoreconfHook,
   mcpp, epoxy, openssl, pkgconfig, llvm_6,
-  cf-private, ApplicationServices, Carbon, Cocoa, Xplugin
+  ApplicationServices, Carbon, Cocoa, Xplugin
 }:
 
 let
@@ -469,11 +469,7 @@ self: super:
               sha256 = "1j1i3n5xy1wawhk95kxqdc54h34kg7xp4nnramba2q8xqfr5k117";
             };
             nativeBuildInputs = [ pkgconfig ];
-            buildInputs = [ xorgproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ]
-              ++ stdenv.lib.optionals stdenv.isDarwin [
-                # Needed for NSDefaultRunLoopMode symbols.
-                cf-private
-              ];
+            buildInputs = [ xorgproto libdrm openssl libX11 libXau libXaw libxcb xcbutil xcbutilwm xcbutilimage xcbutilkeysyms xcbutilrenderutil libXdmcp libXfixes libxkbfile libXmu libXpm libXrender libXres libXt ];
             postPatch = stdenv.lib.optionalString stdenv.isLinux "sed '1i#include <malloc.h>' -i include/os.h";
             meta.platforms = stdenv.lib.platforms.unix;
         } else throw "unsupported xorg abiCompat ${abiCompat} for ${attrs_passed.name}";
diff --git a/pkgs/servers/x11/xquartz/default.nix b/pkgs/servers/x11/xquartz/default.nix
index 22f6ce45673..f18a50fe7e9 100644
--- a/pkgs/servers/x11/xquartz/default.nix
+++ b/pkgs/servers/x11/xquartz/default.nix
@@ -1,7 +1,6 @@
 { stdenv, buildEnv, makeFontsConf, gnused, writeScript, xorg, bashInteractive, xterm, makeWrapper, ruby
 , quartz-wm, fontconfig, xlsfonts, xfontsel
 , ttf_bitstream_vera, freefont_ttf, liberation_ttf
-, cf-private
 , shell ? "${bashInteractive}/bin/bash"
 }:
 
@@ -98,11 +97,7 @@ let
 in stdenv.mkDerivation {
   name = "xquartz-${stdenv.lib.getVersion xorg.xorgserver}";
 
-  buildInputs = [
-    ruby makeWrapper
-    # Needed for NSDefaultRunLoopMode symbols.
-    cf-private
-  ];
+  nativeBuildInputs = [ ruby makeWrapper ];
 
   unpackPhase = "sourceRoot=.";
 
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index c5651d0418e..42da24e3239 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, qmake, qtbase, qttools, substituteAll, libGLU, makeWrapper }:
+{ stdenv, fetchFromGitHub, qmake, qtbase, qttools, substituteAll, libGLU, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "nifskope-${version}";
@@ -20,8 +20,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  buildInputs = [ qtbase qttools libGLU.dev makeWrapper ];
-  nativeBuildInputs = [ qmake ];
+  buildInputs = [ qtbase qttools libGLU.dev ];
+  nativeBuildInputs = [ qmake wrapQtAppsHook ];
 
   preConfigure = ''
     shopt -s globstar
@@ -33,9 +33,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Inspired by install/linux-install/nifskope.spec.in.
-  installPhase = let
-    qtVersion = "5.${stdenv.lib.versions.minor qtbase.version}";
-  in ''
+  installPhase = ''
     runHook preInstall
 
     d=$out/share/nifskope
@@ -53,8 +51,6 @@ stdenv.mkDerivation rec {
 
     find $out/share -type f -exec chmod -x {} \;
 
-    wrapProgram $out/bin/NifSkope --prefix QT_PLUGIN_PATH : "${qtbase}/lib/qt-${qtVersion}/plugins"
-
     runHook postInstall
   '';
 
diff --git a/pkgs/tools/misc/contacts/default.nix b/pkgs/tools/misc/contacts/default.nix
index b262626b136..a7d230d8e89 100644
--- a/pkgs/tools/misc/contacts/default.nix
+++ b/pkgs/tools/misc/contacts/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xcbuildHook, cf-private, Foundation, AddressBook }:
+{ stdenv, fetchurl, xcbuildHook, Foundation, AddressBook }:
 
 stdenv.mkDerivation rec {
   version = "1.1a-3";
@@ -10,12 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ xcbuildHook ];
-
-  buildInputs = [
-    Foundation AddressBook
-    # Needed for OBJC_CLASS_$_NSArray symbols.
-    cf-private
-  ];
+  buildInputs = [ Foundation AddressBook ];
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/tools/misc/noti/default.nix b/pkgs/tools/misc/noti/default.nix
index 43165b4f54b..23646abe787 100644
--- a/pkgs/tools/misc/noti/default.nix
+++ b/pkgs/tools/misc/noti/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, cf-private, Cocoa }:
+{ stdenv, buildGoPackage, fetchFromGitHub, Cocoa }:
 
 buildGoPackage rec {
   name = "noti-${version}";
@@ -11,7 +11,7 @@ buildGoPackage rec {
     sha256 = "1chsqfqk0pnhx5k2nr4c16cpb8m6zv69l1jvv4v4903zgfzcm823";
   };
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Cocoa cf-private /* For OBJC_CLASS_$_NSDate */ ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Cocoa ];
   # TODO: Remove this when we update apple_sdk
   NIX_CFLAGS_COMPILE = stdenv.lib.optionals stdenv.isDarwin [ "-fno-objc-arc" ];
 
diff --git a/pkgs/tools/misc/partition-manager/default.nix b/pkgs/tools/misc/partition-manager/default.nix
index 4599309b238..1c094c291d8 100644
--- a/pkgs/tools/misc/partition-manager/default.nix
+++ b/pkgs/tools/misc/partition-manager/default.nix
@@ -1,7 +1,7 @@
 { mkDerivation, fetchurl, lib
-, extra-cmake-modules, kdoctools, wrapGAppsHook
+, extra-cmake-modules, kdoctools, wrapGAppsHook, wrapQtAppsHook
 , kconfig, kcrash, kinit, kpmcore
-, eject, libatasmart , utillinux, makeWrapper, qtbase
+, eject, libatasmart , utillinux, qtbase
 }:
 
 let
@@ -17,16 +17,12 @@ in mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook makeWrapper ];
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook wrapQtAppsHook ];
 
   # refer to kpmcore for the use of eject
   buildInputs = [ eject libatasmart utillinux ];
   propagatedBuildInputs = [ kconfig kcrash kinit kpmcore ];
 
-  postInstall = ''
-    wrapProgram "$out/bin/partitionmanager" --prefix QT_PLUGIN_PATH : "${kpmcore}/lib/qt-5.${lib.versions.minor qtbase.version}/plugins"
-  '';
-
   meta = with lib; {
     description = "KDE Partition Manager";
     license = licenses.gpl2;
diff --git a/pkgs/tools/misc/watchexec/default.nix b/pkgs/tools/misc/watchexec/default.nix
index b0471e56c07..d15bfb3887a 100644
--- a/pkgs/tools/misc/watchexec/default.nix
+++ b/pkgs/tools/misc/watchexec/default.nix
@@ -13,11 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1sqwplvpg0n9j0h9j94m7a6ylgqi4y4wyx489y09z9gm7aqgrsjc";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
-    CoreServices
-    # This is needed to avoid an undefined symbol error "_CFURLResourceIsReachable"
-    darwin.cf-private
-  ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with stdenv.lib; {
     description = "Executes commands in response to file modifications";
diff --git a/pkgs/tools/misc/yubikey-manager-qt/default.nix b/pkgs/tools/misc/yubikey-manager-qt/default.nix
index a1d0b185a0a..44b2f3451c1 100644
--- a/pkgs/tools/misc/yubikey-manager-qt/default.nix
+++ b/pkgs/tools/misc/yubikey-manager-qt/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , fetchurl
-, makeWrapper
+, wrapQtAppsHook
 , pcsclite
 , pyotherside
 , pythonPackages
@@ -16,16 +16,9 @@
 , yubikey-personalization
 }:
 
-let
-  qmlPath = qmlLib: "${qmlLib}/${qtbase.qtQmlPrefix}";
+let inherit (stdenv) lib; in
 
-  inherit (stdenv) lib;
-
-  qml2ImportPath = lib.concatMapStringsSep ":" qmlPath [
-    qtbase.bin qtdeclarative.bin pyotherside qtquickcontrols qtquickcontrols2.bin qtgraphicaleffects
-  ];
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "yubikey-manager-qt";
   version = "1.1.2";
 
@@ -34,7 +27,7 @@ in stdenv.mkDerivation rec {
     sha256 = "01ax8zjrahs2sjbgsys2ahh57sdcap0ij3y1r1bbvsgzr7xxm2q8";
   };
 
-  nativeBuildInputs = [ makeWrapper python3.pkgs.wrapPython qmake ];
+  nativeBuildInputs = [ wrapQtAppsHook python3.pkgs.wrapPython qmake ];
 
   postPatch = ''
     substituteInPlace ykman-gui/deployment.pri --replace '/usr/bin' "$out/bin"
@@ -46,22 +39,20 @@ in stdenv.mkDerivation rec {
 
   pythonPath = [ yubikey-manager ];
 
+  dontWrapQtApps = true;
   postInstall = ''
     buildPythonPath "$pythonPath"
 
-    wrapProgram $out/bin/ykman-gui \
+    wrapQtApp $out/bin/ykman-gui \
       --prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib" \
-      --prefix PYTHONPATH : "$program_PYTHONPATH" \
-      --set QML2_IMPORT_PATH "${qml2ImportPath}" \
-      --set QT_QPA_PLATFORM_PLUGIN_PATH ${qtbase.bin}/lib/qt-*/plugins/platforms \
-      --prefix QT_PLUGIN_PATH : "${qtsvg.bin}/${qtbase.qtPluginPrefix}"
+      --prefix PYTHONPATH : "$program_PYTHONPATH"
 
-      mkdir -p $out/share/applications
-      cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
-      mkdir -p $out/share/ykman-gui/icons
-      cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
-      substituteInPlace $out/share/applications/ykman-gui.desktop \
-        --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
+    mkdir -p $out/share/applications
+    cp resources/ykman-gui.desktop $out/share/applications/ykman-gui.desktop
+    mkdir -p $out/share/ykman-gui/icons
+    cp resources/icons/*.{icns,ico,png,xpm} $out/share/ykman-gui/icons
+    substituteInPlace $out/share/applications/ykman-gui.desktop \
+      --replace 'Exec=ykman-gui' "Exec=$out/bin/ykman-gui" \
   '';
 
   meta = with lib; {
diff --git a/pkgs/tools/security/keybase/default.nix b/pkgs/tools/security/keybase/default.nix
index 8b832bf00d6..18e3836c99d 100644
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, buildGoPackage, fetchFromGitHub, cf-private
+{ stdenv, lib, buildGoPackage, fetchFromGitHub
 , AVFoundation, AudioToolbox, ImageIO, CoreMedia
 , Foundation, CoreGraphics, MediaToolbox
 }:
@@ -19,11 +19,7 @@ buildGoPackage rec {
     sha256 = "00mxyy4jhdbcvbwabf4yvq4h5mpnlfp2z93gy2266kz6gkd5myzk";
   };
 
-  buildInputs = lib.optionals stdenv.isDarwin [
-    AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox
-    # Needed for OBJC_CLASS_$_NSData symbols.
-    cf-private
-  ];
+  buildInputs = lib.optionals stdenv.isDarwin [ AVFoundation AudioToolbox ImageIO CoreMedia Foundation CoreGraphics MediaToolbox ];
   buildFlags = [ "-tags production" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/tools/security/nitrokey-app/default.nix b/pkgs/tools/security/nitrokey-app/default.nix
index e7f7547e4ad..1b18f0e1e11 100644
--- a/pkgs/tools/security/nitrokey-app/default.nix
+++ b/pkgs/tools/security/nitrokey-app/default.nix
@@ -1,5 +1,5 @@
-{ stdenv, makeWrapper, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
-, qtbase, qttranslations, qtsvg }:
+{ stdenv, bash-completion, cmake, fetchFromGitHub, hidapi, libusb1, pkgconfig
+, qtbase, qttranslations, qtsvg, wrapQtAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "nitrokey-app-${version}";
@@ -29,15 +29,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkgconfig
-    makeWrapper
+    wrapQtAppsHook
   ];
   cmakeFlags = "-DCMAKE_BUILD_TYPE=Release";
 
-  postFixup = ''
-    wrapProgram $out/bin/nitrokey-app \
-      --prefix QT_PLUGIN_PATH : "${qtbase}/${qtbase.qtPluginPrefix}"
-  '';
-
   meta = with stdenv.lib; {
     description      = "Provides extra functionality for the Nitrokey Pro and Storage";
     longDescription  = ''
diff --git a/pkgs/tools/security/pinentry/mac.nix b/pkgs/tools/security/pinentry/mac.nix
index 8168aa94b3d..1fbb52985fb 100644
--- a/pkgs/tools/security/pinentry/mac.nix
+++ b/pkgs/tools/security/pinentry/mac.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, xcbuildHook, libiconv, Cocoa, ncurses, cf-private }:
+{ stdenv, fetchFromGitHub, xcbuildHook, libiconv, ncurses, Cocoa }:
 
 stdenv.mkDerivation rec {
   name = "pinentry-mac-0.9.4";
@@ -11,12 +11,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ xcbuildHook ];
-
-  buildInputs = [
-    libiconv Cocoa ncurses
-    # Needed for OBJC_CLASS_$_NSArray symbols.
-    cf-private
-  ];
+  buildInputs = [ libiconv ncurses Cocoa ];
 
   installPhase = ''
     mkdir -p $out/Applications
diff --git a/pkgs/tools/text/mdbook/default.nix b/pkgs/tools/text/mdbook/default.nix
index 6e1faa3331f..52d197759ea 100644
--- a/pkgs/tools/text/mdbook/default.nix
+++ b/pkgs/tools/text/mdbook/default.nix
@@ -13,11 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "1xpsc4qff2lrq15mz1gvmw6n5vl88sfwpjbsnp5ja5k1im156lam";
 
-  buildInputs = stdenv.lib.optionals stdenv.isDarwin [
-    CoreServices
-    # This is needed to avoid an undefined symbol error for "_CFURLResourceIsReachable"
-    darwin.cf-private
-  ];
+  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ CoreServices ];
 
   meta = with stdenv.lib; {
     description = "Create books from MarkDown";
diff --git a/pkgs/tools/video/atomicparsley/default.nix b/pkgs/tools/video/atomicparsley/default.nix
index f0ad4297c00..711a3c00a12 100644
--- a/pkgs/tools/video/atomicparsley/default.nix
+++ b/pkgs/tools/video/atomicparsley/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchhg, autoreconfHook, zlib, cf-private, Cocoa }:
+{ stdenv, fetchhg, autoreconfHook, zlib, Cocoa }:
 
 stdenv.mkDerivation rec {
   name = "atomicparsley-${version}";
@@ -12,11 +12,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
 
   buildInputs = [ zlib ]
-    ++ stdenv.lib.optionals stdenv.isDarwin [
-      Cocoa
-      # Needed for OBJC_CLASS_$_NSDictionary symbols.
-      cf-private
-    ];
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa ];
 
   configureFlags = stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     # AC_FUNC_MALLOC is broken on cross builds.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a5e8315b36b..17913fa63ac 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -526,8 +526,7 @@ in
 
   alacritty = callPackage ../applications/misc/alacritty {
     inherit (xorg) libXcursor libXxf86vm libXi;
-    inherit (darwin) cf-private;
-    inherit (darwin.apple_sdk.frameworks) AppKit CoreFoundation CoreGraphics CoreServices CoreText Foundation OpenGL;
+    inherit (darwin.apple_sdk.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
   };
 
   aldo = callPackage ../applications/radio/aldo { };
@@ -615,7 +614,6 @@ in
   };
 
   atomicparsley = callPackage ../tools/video/atomicparsley {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -1337,7 +1335,6 @@ in
   codec2 = callPackage ../development/libraries/codec2 { };
 
   contacts = callPackage ../tools/misc/contacts {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Foundation AddressBook;
     xcbuildHook = xcbuild6Hook;
   };
@@ -1756,7 +1753,6 @@ in
   noteshrink = callPackage ../tools/misc/noteshrink { };
 
   noti = callPackage ../tools/misc/noti {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -2572,7 +2568,6 @@ in
   dolphinEmu = callPackage ../misc/emulators/dolphin-emu { };
   dolphinEmuMaster = callPackage ../misc/emulators/dolphin-emu/master.nix {
     inherit (darwin.apple_sdk.frameworks) CoreBluetooth ForceFeedback IOKit OpenGL;
-    inherit (darwin) cf-private;
   };
 
   doomseeker = qt5.callPackage ../applications/misc/doomseeker { };
@@ -3997,7 +3992,6 @@ in
   kexpand = callPackage ../development/tools/kexpand { };
 
   keybase = callPackage ../tools/security/keybase {
-    inherit (darwin) cf-private;
     # Reasoning for the inherited apple_sdk.frameworks:
     # 1. specific compiler errors about: AVFoundation, AudioToolbox, MediaToolbox
     # 2. the rest are added from here: https://github.com/keybase/client/blob/68bb8c893c5214040d86ea36f2f86fbb7fac8d39/go/chat/attachments/preview_darwin.go#L7
@@ -5313,7 +5307,6 @@ in
   };
 
   pinentry_mac = callPackage ../tools/security/pinentry/mac.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
     xcbuildHook = xcbuild6Hook;
   };
@@ -6589,7 +6582,6 @@ in
 
   watchman = callPackage ../development/tools/watchman {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
-    CoreFoundation = darwin.cf-private;
   };
 
   wavefunctioncollapse = callPackage ../tools/graphics/wavefunctioncollapse {};
@@ -8059,7 +8051,6 @@ in
 
   cargo-web = callPackage ../development/tools/cargo-web {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
-    inherit (darwin) cf-private;
   };
 
   carnix = (callPackage ../build-support/rust/carnix.nix { }).carnix { };
@@ -9241,7 +9232,6 @@ in
 
   flow = callPackage ../development/tools/analysis/flow {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
-    inherit (darwin) cf-private;
   };
 
   foreman = callPackage ../tools/system/foreman { };
@@ -10404,7 +10394,6 @@ in
     vid-stab = if stdenv.isDarwin then null else vid-stab;
     x265 = if stdenv.isDarwin then null else x265;
     xavs = if stdenv.isDarwin then null else xavs;
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks)
       Cocoa CoreServices CoreAudio AVFoundation MediaToolbox
       VideoDecodeAcceleration;
@@ -10432,11 +10421,9 @@ in
   flite = callPackage ../development/libraries/flite { };
 
   fltk13 = callPackage ../development/libraries/fltk {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa AGL GLUT;
   };
   fltk14 = callPackage ../development/libraries/fltk/1.4.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa AGL GLUT;
   };
   fltk = res.fltk13;
@@ -10599,7 +10586,6 @@ in
   glfw = glfw3;
   glfw2 = callPackage ../development/libraries/glfw/2.x.nix { };
   glfw3 = callPackage ../development/libraries/glfw/3.x.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa Kernel;
   };
 
@@ -12075,7 +12061,6 @@ in
   libuecc = callPackage ../development/libraries/libuecc { };
 
   libui = callPackage ../development/libraries/libui {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa;
   };
 
@@ -12536,12 +12521,10 @@ in
   openct = callPackage ../development/libraries/openct { };
 
   opencv = callPackage ../development/libraries/opencv {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa QTKit;
   };
 
   opencv3 = callPackage ../development/libraries/opencv/3.x.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa VideoDecodeAcceleration;
   };
 
@@ -12550,7 +12533,6 @@ in
   };
 
   opencv4 = callPackage ../development/libraries/opencv/4.x.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa VideoDecodeAcceleration;
   };
 
@@ -12636,7 +12618,6 @@ in
   pcg_c = callPackage ../development/libraries/pcg-c { };
 
   pcl = libsForQt5.callPackage ../development/libraries/pcl {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa AGL OpenGL;
   };
 
@@ -12783,7 +12764,7 @@ in
     # XXX: mariadb doesn't built on fbsd as of nov 2015
     mysql = if (!stdenv.isFreeBSD) then mysql else null;
 
-    inherit (pkgs.darwin) cf-private libobjc;
+    inherit (pkgs.darwin) libobjc;
     inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices OpenGL Cocoa AGL;
   };
 
@@ -12803,13 +12784,12 @@ in
   qt56 = recurseIntoAttrs (makeOverridable
     (import ../development/libraries/qt-5/5.6) {
       inherit newScope;
-      inherit stdenv fetchurl fetchpatch makeSetupHook;
+      inherit stdenv fetchurl fetchpatch makeSetupHook makeWrapper;
       bison = bison2; # error: too few arguments to function 'int yylex(...
       inherit cups;
       harfbuzz = harfbuzzFull;
       inherit libGL;
       inherit perl;
-      inherit (darwin) cf-private;
       inherit (gst_all_1) gstreamer gst-plugins-base;
     });
 
@@ -12818,13 +12798,12 @@ in
   qt59 = recurseIntoAttrs (makeOverridable
     (import ../development/libraries/qt-5/5.9) {
       inherit newScope;
-      inherit stdenv fetchurl fetchpatch makeSetupHook;
+      inherit stdenv fetchurl fetchpatch makeSetupHook makeWrapper;
       bison = bison2; # error: too few arguments to function 'int yylex(...
       inherit cups;
       harfbuzz = harfbuzzFull;
       inherit libGL;
       inherit perl;
-      inherit (darwin) cf-private;
       inherit (gst_all_1) gstreamer gst-plugins-base;
       inherit gtk3;
       inherit (gnome3) dconf;
@@ -12835,13 +12814,12 @@ in
   qt511 = recurseIntoAttrs (makeOverridable
     (import ../development/libraries/qt-5/5.11) {
       inherit newScope;
-      inherit stdenv fetchurl fetchFromGitHub makeSetupHook;
+      inherit stdenv fetchurl fetchFromGitHub makeSetupHook makeWrapper;
       bison = bison2; # error: too few arguments to function 'int yylex(...
       inherit cups;
       harfbuzz = harfbuzzFull;
       inherit libGL;
       inherit perl;
-      inherit (darwin) cf-private;
       inherit gtk3;
       inherit (gnome3) dconf;
       inherit (gst_all_1) gstreamer gst-plugins-base;
@@ -12853,13 +12831,12 @@ in
   qt512 = recurseIntoAttrs (makeOverridable
     (import ../development/libraries/qt-5/5.12) {
       inherit newScope;
-      inherit stdenv fetchurl fetchFromGitHub makeSetupHook;
+      inherit stdenv fetchurl fetchFromGitHub makeSetupHook makeWrapper;
       bison = bison2; # error: too few arguments to function 'int yylex(...
       inherit cups;
       harfbuzz = harfbuzzFull;
       inherit libGL;
       inherit perl;
-      inherit (darwin) cf-private;
       inherit gtk3;
       inherit (gnome3) dconf;
       inherit (gst_all_1) gstreamer gst-plugins-base;
@@ -13119,7 +13096,6 @@ in
   schroedinger = callPackage ../development/libraries/schroedinger { };
 
   SDL = callPackage ../development/libraries/SDL ({
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) OpenGL CoreAudio CoreServices AudioUnit Kernel Cocoa;
   } // lib.optionalAttrs stdenv.hostPlatform.isAndroid {
     # libGLU doesn’t work with Android’s SDL
@@ -13145,7 +13121,6 @@ in
   SDL_ttf = callPackage ../development/libraries/SDL_ttf { };
 
   SDL2 = callPackage ../development/libraries/SDL2 {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AudioUnit Cocoa CoreAudio CoreServices ForceFeedback OpenGL;
   };
 
@@ -13197,7 +13172,6 @@ in
 
   sfml = callPackage ../development/libraries/sfml {
     inherit (darwin.apple_sdk.frameworks) IOKit Foundation AppKit OpenAL;
-    inherit (darwin) cf-private;
   };
   csfml = callPackage ../development/libraries/csfml { };
 
@@ -13642,7 +13616,7 @@ in
   vte-ng = callPackage ../development/libraries/vte/ng.nix { };
 
   vtk = callPackage ../development/libraries/vtk {
-    inherit (darwin) cf-private libobjc;
+    inherit (darwin) libobjc;
     inherit (darwin.apple_sdk.libs) xpc;
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreServices DiskArbitration
                                           IOKit CFNetwork Security ApplicationServices
@@ -13758,7 +13732,6 @@ in
   wxmac = callPackage ../development/libraries/wxwidgets/3.0/mac.nix {
     inherit (darwin.apple_sdk.frameworks) AGL Cocoa Kernel;
     inherit (darwin.stubs) setfile rez derez;
-    inherit (darwin) cf-private;
   };
 
   wxSVG = callPackage ../development/libraries/wxSVG {
@@ -14933,13 +14906,10 @@ in
 
   xqilla = callPackage ../development/tools/xqilla { };
 
-  xquartz = callPackage ../servers/x11/xquartz {
-    inherit (darwin) cf-private;
-  };
+  xquartz = callPackage ../servers/x11/xquartz { };
 
   quartz-wm = callPackage ../servers/x11/quartz-wm {
     stdenv = clangStdenv;
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
     inherit (darwin.apple_sdk.libs) Xplugin;
   };
@@ -14949,7 +14919,6 @@ in
   # have created a cycle.
   xorg = recurseIntoAttrs ((lib.callPackageWith __splicedPackages ../servers/x11/xorg {
   }).overrideScope' (lib.callPackageWith __splicedPackages ../servers/x11/xorg/overrides.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa;
     inherit (darwin.apple_sdk.libs) Xplugin;
     inherit (buildPackages.darwin) bootstrap_cmds;
@@ -17564,7 +17533,6 @@ in
     imagemagick = null;
     acl = null;
     gpm = null;
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AppKit GSS ImageIO;
   };
 
@@ -17583,7 +17551,6 @@ in
     imagemagick = null;
     acl = null;
     gpm = null;
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AppKit GSS ImageIO;
   };
 
@@ -17594,7 +17561,6 @@ in
   }));
 
   emacsMacport = callPackage ../applications/editors/emacs/macport.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks)
       AppKit Carbon Cocoa IOKit OSAKit Quartz QuartzCore WebKit
       ImageCaptureCore GSS ImageIO;
@@ -18191,7 +18157,6 @@ in
     gegl = gegl_0_4;
     lcms = lcms2;
     inherit (darwin.apple_sdk.frameworks) AppKit Cocoa;
-    inherit (darwin) cf-private;
   };
 
   gimp-with-plugins = callPackage ../applications/graphics/gimp/wrapper.nix {
@@ -18801,10 +18766,7 @@ in
   kipi-plugins = libsForQt5.callPackage ../applications/graphics/kipi-plugins { };
 
   kitty = callPackage ../applications/misc/kitty {
-    harfbuzz = if stdenv.isDarwin then harfbuzz.override {
-      withCoreText = true;
-    } else harfbuzz;
-    inherit (darwin) cf-private;
+    harfbuzz = harfbuzz.override { withCoreText = stdenv.isDarwin; };
     inherit (darwin.apple_sdk.frameworks) Cocoa CoreGraphics Foundation IOKit Kernel OpenGL;
   };
 
@@ -20425,7 +20387,7 @@ in
   syncthing-tray = callPackage ../applications/misc/syncthing-tray { };
 
   synergy = callPackage ../applications/misc/synergy {
-    inherit (darwin) cf-private;
+    stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
     inherit (darwin.apple_sdk.frameworks) ApplicationServices Carbon Cocoa CoreServices ScreenSaver;
   };
 
@@ -20499,7 +20461,6 @@ in
 
   aminal = callPackage ../applications/misc/aminal {
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa Kernel;
-    inherit (darwin) cf-private;
   };
 
   termite-unwrapped = callPackage ../applications/misc/termite { };
@@ -20696,7 +20657,6 @@ in
   };
 
   vim = callPackage ../applications/editors/vim {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Carbon Cocoa;
   };
 
@@ -20708,7 +20668,7 @@ in
 
   vim_configurable = vimUtils.makeCustomizable (callPackage ../applications/editors/vim/configurable.nix {
     inherit (darwin.apple_sdk.frameworks) CoreServices Cocoa Foundation CoreData;
-    inherit (darwin) libobjc cf-private;
+    inherit (darwin) libobjc;
     gtk2 = if stdenv.isDarwin then gtk2-x11 else gtk2;
     gtk3 = if stdenv.isDarwin then gtk3-x11 else gtk3;
   });
@@ -21364,7 +21324,6 @@ in
 
   zola = callPackage ../applications/misc/zola {
     inherit (darwin.apple_sdk.frameworks) CoreServices;
-    inherit (darwin) cf-private;
   };
 
   zoom-us = libsForQt59.callPackage ../applications/networking/instant-messengers/zoom-us { };
@@ -21639,7 +21598,7 @@ in
   garden-of-coloured-lights = callPackage ../games/garden-of-coloured-lights { allegro = allegro4; };
 
   gargoyle = callPackage ../games/gargoyle {
-    inherit (darwin) cctools cf-private;
+    inherit (darwin) cctools;
   };
 
   gav = callPackage ../games/gav { };
@@ -23112,13 +23071,11 @@ in
   ns-3 = callPackage ../development/libraries/science/networking/ns3 { };
 
   root = callPackage ../applications/science/misc/root {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
     stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
   };
 
   root5 = lowPrio (callPackage ../applications/science/misc/root/5.nix {
-    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) Cocoa OpenGL;
     stdenv = if stdenv.cc.isClang then llvmPackages_5.stdenv else stdenv;
   });
@@ -23454,7 +23411,7 @@ in
   jack2 = callPackage ../misc/jackaudio {
     libopus = libopus.override { withCustomModes = true; };
     inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio Accelerate;
-    inherit (darwin) cf-private libobjc;
+    inherit (darwin) libobjc;
   };
   libjack2 = jack2.override { prefix = "lib"; };
   jack2Full = jack2; # TODO: move to aliases.nix
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 1753ac9dc7a..5ef05061e8d 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -10,6 +10,10 @@ in
 
   callPackage = newScope (darwin.apple_sdk.frameworks // darwin);
 
+  stdenvNoCF = stdenv.override {
+    extraBuildInputs = [];
+  };
+
   apple_sdk = callPackage ../os-specific/darwin/apple-sdk { };
 
   binutils-unwrapped = callPackage ../os-specific/darwin/binutils {
@@ -32,9 +36,8 @@ in
     libcxxabi = pkgs.libcxxabi;
   };
 
-  cf-private = callPackage ../os-specific/darwin/cf-private {
-    inherit (darwin) CF apple_sdk;
-  };
+  # TODO: remove alias.
+  cf-private = darwin.apple_sdk.frameworks.CoreFoundation;
 
   DarwinTools = callPackage ../os-specific/darwin/DarwinTools { };