Merge remote-tracking branch 'nixpkgs/nixos-unstable'

14 files changed, 668 insertions, 42 deletions

diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix b/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
index 261374b7d93e..63e893ea69ff 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.12/default.nix
@@ -99,6 +99,7 @@ let
         sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
       })
       ./qtwebkit.patch
+      ./qtwebkit-icu68.patch
 
       ./qtwebkit-darwin-no-readline.patch
       ./qtwebkit-darwin-no-qos-classes.patch
@@ -136,7 +137,7 @@ let
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
         withGtk3 = true; inherit dconf gtk3;
-        inherit developerBuild decryptSslTraffic;
+        inherit debug developerBuild decryptSslTraffic;
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
@@ -188,6 +189,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.12/qtwebkit-icu68.patch b/nixpkgs/pkgs/development/libraries/qt-5/5.12/qtwebkit-icu68.patch
new file mode 100644
index 000000000000..73463d7567a3
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.12/qtwebkit-icu68.patch
@@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
++++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
++        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
++++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
++            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
++            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix b/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
index 14b99fab4e27..45cf6209ea08 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.14/default.nix
@@ -112,6 +112,7 @@ let
         sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
       })
       ./qtwebkit.patch
+      ./qtwebkit-icu68.patch
     ] ++ optionals stdenv.isDarwin [
       ./qtwebkit-darwin-no-readline.patch
       ./qtwebkit-darwin-no-qos-classes.patch
@@ -149,7 +150,7 @@ let
         patches = patches.qtbase;
         inherit bison cups harfbuzz libGL;
         withGtk3 = true; inherit dconf gtk3;
-        inherit developerBuild decryptSslTraffic;
+        inherit debug developerBuild decryptSslTraffic;
       };
 
       qtcharts = callPackage ../modules/qtcharts.nix {};
@@ -199,6 +200,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwebkit-icu68.patch b/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwebkit-icu68.patch
new file mode 100644
index 000000000000..73463d7567a3
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.14/qtwebkit-icu68.patch
@@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
++++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
++        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
++++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
++            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
++            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix b/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
index 6333f889b684..f969254b5952 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.15/default.nix
@@ -16,7 +16,7 @@ top-level attribute to `top-level/all-packages.nix`.
 
 {
   newScope,
-  lib, stdenv, fetchurl, fetchpatch, fetchFromGitHub, makeSetupHook, makeWrapper,
+  lib, stdenv, fetchurl, fetchpatch, fetchgit, fetchFromGitHub, makeSetupHook, makeWrapper,
   bison, cups ? null, harfbuzz, libGL, perl,
   gstreamer, gst-plugins-base, gtk3, dconf,
   llvmPackages_5,
@@ -48,6 +48,42 @@ let
       };
       version = "5.212.0-alpha4";
     };
+
+    # Even if developed in the public, QtWebEngine does not have official
+    # releases or new tags since the Qt company made 5.15.3 proprietary.
+    # Apparently they care more about licensing than the security of their users.
+    # See https://lists.qt-project.org/pipermail/interest/2021-March/036387.html
+    qtwebengine =
+      let
+        branchName = "5.15.3";
+        rev = "a059e7404a6db799f4da0ad696e65ae9c854b4b0";
+      in
+      {
+        version = "${branchName}-${lib.substring 0 7 rev}";
+
+        src = fetchgit {
+          url = "https://github.com/qt/qtwebengine.git";
+          sha256 = "1vdgxfbmx4z4qrm2g61dl64gqn3fv5f83jwpp7h1gyfx5z2qvfmv";
+          inherit rev branchName;
+          fetchSubmodules = true;
+          leaveDotGit = true;
+          name = "qtwebengine-${substring 0 7 rev}.tar.gz";
+          postFetch = ''
+            # remove submodule .git directory
+            rm -rf $out/src/3rdparty/.git
+
+            # compress to not exceed the 2GB output limit
+            mv $out source
+            # try to make a deterministic tarball
+            tar -I 'gzip -n' \
+              --sort name \
+              --mtime 1970-01-01 \
+              --owner=root --group=root \
+              --numeric-owner --mode=go=rX,u+rw,a-s \
+              -cf $out source
+          '';
+        };
+      };
   };
 
   patches = {
@@ -83,11 +119,16 @@ let
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
-    qtwebengine = [ ]
-      ++ optionals stdenv.isDarwin [
-        ./qtwebengine-darwin-no-platform-check.patch
-        ./qtwebengine-mac-dont-set-dsymutil-path.patch
-      ];
+    qtwebengine = [
+      # Fix crashes with non en_US.UTF-8 locales
+      (fetchpatch {
+        url = "https://github.com/qt/qtwebengine/commit/199ea00a9eea13315a652c62778738629185b059.patch";
+        sha256 = "1b5k2g1v8913cvsgvp6ja4mcprjlk5vcwqzi0p1qq7b1wyi4f0g2";
+      })
+    ] ++ optionals stdenv.isDarwin [
+      ./qtwebengine-darwin-no-platform-check.patch
+      ./qtwebengine-mac-dont-set-dsymutil-path.patch
+    ];
     qtwebkit = [
       (fetchpatch {
         name = "qtwebkit-bison-3.7-build.patch";
@@ -95,6 +136,7 @@ let
         sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
       })
       ./qtwebkit.patch
+      ./qtwebkit-icu68.patch
     ] ++ optionals stdenv.isDarwin [
       ./qtwebkit-darwin-no-readline.patch
       ./qtwebkit-darwin-no-qos-classes.patch
@@ -161,7 +203,9 @@ let
       qtvirtualkeyboard = callPackage ../modules/qtvirtualkeyboard.nix {};
       qtwayland = callPackage ../modules/qtwayland.nix {};
       qtwebchannel = callPackage ../modules/qtwebchannel.nix {};
-      qtwebengine = callPackage ../modules/qtwebengine.nix {};
+      qtwebengine = callPackage ../modules/qtwebengine.nix {
+        inherit (srcs.qtwebengine) version;
+      };
       qtwebglplugin = callPackage ../modules/qtwebglplugin.nix {};
       qtwebkit = callPackage ../modules/qtwebkit.nix {};
       qtwebsockets = callPackage ../modules/qtwebsockets.nix {};
@@ -182,6 +226,7 @@ let
       qmake = makeSetupHook {
         deps = [ self.qtbase.dev ];
         substitutions = {
+          inherit debug;
           fix_qmake_libtool = ../hooks/fix-qmake-libtool.sh;
         };
       } ../hooks/qmake-hook.sh;
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/5.15/qtwebkit-icu68.patch b/nixpkgs/pkgs/development/libraries/qt-5/5.15/qtwebkit-icu68.patch
new file mode 100644
index 000000000000..73463d7567a3
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/qt-5/5.15/qtwebkit-icu68.patch
@@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
++++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
++        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
++++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
++            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
++            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
++            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
++            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
++            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
++++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
++        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
++    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh b/nixpkgs/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
index 7f6ddb76ad57..741225a5aa81 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
+++ b/nixpkgs/pkgs/development/libraries/qt-5/hooks/qmake-hook.sh
@@ -3,6 +3,9 @@
 qmakeFlags=( ${qmakeFlags-} )
 
 qmakePrePhase() {
+    qmakeFlags_orig=( "${qmakeFlags[@]}" )
+
+    # These flags must be added _before_ the flags specified in the derivation.
     qmakeFlags=( \
         "PREFIX=$out" \
         "NIX_OUTPUT_OUT=$out" \
@@ -11,8 +14,15 @@ qmakePrePhase() {
         "NIX_OUTPUT_DOC=${!outputDev}/${qtDocPrefix:?}" \
         "NIX_OUTPUT_QML=${!outputBin}/${qtQmlPrefix:?}" \
         "NIX_OUTPUT_PLUGIN=${!outputBin}/${qtPluginPrefix:?}" \
-        "${qmakeFlags[@]}" \
     )
+
+    if [ -n "@debug@" ]; then
+        qmakeFlags+=( "CONFIG+=debug" )
+    else
+        qmakeFlags+=( "CONFIG+=release" )
+    fi
+
+    qmakeFlags+=( "${qmakeFlags_orig[@]}" )
 }
 prePhases+=" qmakePrePhase"
 
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh b/nixpkgs/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
index 9f2a9f06f1ab..1b57d676e1fc 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
+++ b/nixpkgs/pkgs/development/libraries/qt-5/hooks/qtbase-setup-hook.sh
@@ -1,3 +1,14 @@
+if [[ -n "${__nix_qtbase-}" ]]; then
+    # Throw an error if a different version of Qt was already set up.
+    if [[ "$__nix_qtbase" != "@dev@" ]]; then
+        echo >&2 "Error: detected mismatched Qt dependencies:"
+        echo >&2 "    @dev@"
+        echo >&2 "    $__nix_qtbase"
+        exit 1
+    fi
+else # Only set up Qt once.
+__nix_qtbase="@dev@"
+
 qtPluginPrefix=@qtPluginPrefix@
 qtQmlPrefix=@qtQmlPrefix@
 qtDocPrefix=@qtDocPrefix@
@@ -5,6 +16,20 @@ qtDocPrefix=@qtDocPrefix@
 . @fix_qt_builtin_paths@
 . @fix_qt_module_paths@
 
+# Disable debug symbols if qtbase was built without debugging.
+# This stops -dev paths from leaking into other outputs.
+if [ -z "@debug@" ]; then
+    NIX_CFLAGS_COMPILE="${NIX_CFLAGS_COMPILE-}${NIX_CFLAGS_COMPILE:+ }-DQT_NO_DEBUG"
+fi
+
+# Integration with CMake:
+# Set the CMake build type corresponding to how qtbase was built.
+if [ -n "@debug@" ]; then
+    cmakeBuildType="Debug"
+else
+    cmakeBuildType="Release"
+fi
+
 providesQtRuntime() {
     [ -d "$1/$qtPluginPrefix" ] || [ -d "$1/$qtQmlPrefix" ]
 }
@@ -19,7 +44,12 @@ export QMAKEPATH
 QMAKEMODULES=
 export QMAKEMODULES
 
+declare -Ag qmakePathSeen=()
 qmakePathHook() {
+    # Skip this path if we have seen it before.
+    # MUST use 'if' because 'qmakePathSeen[$]' may be unset.
+    if [ -n "${qmakePathSeen[$1]-}" ]; then return; fi
+    qmakePathSeen[$1]=1
     if [ -d "$1/mkspecs" ]
     then
         QMAKEMODULES="${QMAKEMODULES}${QMAKEMODULES:+:}/mkspecs"
@@ -34,7 +64,12 @@ envBuildHostHooks+=(qmakePathHook)
 # package depending on the building package. (This is necessary in case
 # the building package does not provide runtime dependencies itself and so
 # would not be propagated to the user environment.)
+declare -Ag qtEnvHostTargetSeen=()
 qtEnvHostTargetHook() {
+    # Skip this path if we have seen it before.
+    # MUST use 'if' because 'qmakePathSeen[$]' may be unset.
+    if [ -n "${qtEnvHostTargetSeen[$1]-}" ]; then return; fi
+    qtEnvHostTargetSeen[$1]=1
     if providesQtRuntime "$1" && [ "z${!outputBin}" != "z${!outputDev}" ]
     then
         propagatedBuildInputs+=" $1"
@@ -64,3 +99,14 @@ postPatchMkspecs() {
 if [ -z "${dontPatchMkspecs-}" ]; then
     postPhases="${postPhases-}${postPhases:+ }postPatchMkspecs"
 fi
+
+qtPreHook() {
+    # Check that wrapQtAppsHook is used, or it is explicitly disabled.
+    if [[ -z "$__nix_wrapQtAppsHook" && -z "$dontWrapQtApps" ]]; then
+        echo >&2 "Error: wrapQtAppsHook is not used, and dontWrapQtApps is not set."
+        exit 1
+    fi
+}
+prePhases+=" qtPreHook"
+
+fi
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh b/nixpkgs/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
index 7356c8ee3560..ce4d78fbb50f 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
+++ b/nixpkgs/pkgs/development/libraries/qt-5/hooks/wrap-qt-apps-hook.sh
@@ -1,3 +1,6 @@
+if [[ -z "${__nix_wrapQtAppsHook-}" ]]; then
+__nix_wrapQtAppsHook=1  # Don't run this hook more than once.
+
 # Inherit arguments given in mkDerivation
 qtWrapperArgs=( ${qtWrapperArgs-} )
 
@@ -100,3 +103,5 @@ wrapQtAppsHook() {
 }
 
 fixupOutputHooks+=(wrapQtAppsHook)
+
+fi
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/mkDerivation.nix b/nixpkgs/pkgs/development/libraries/qt-5/mkDerivation.nix
index 2c6333cb0204..98f9a05fac7c 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/mkDerivation.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/mkDerivation.nix
@@ -9,21 +9,6 @@ args:
 let
   args_ = {
 
-    qmakeFlags = [ ("CONFIG+=" + (if debug then "debug" else "release")) ]
-              ++ (args.qmakeFlags or []);
-
-    NIX_CFLAGS_COMPILE = toString (
-      optional (!debug) "-DQT_NO_DEBUG"
-      ++ lib.toList (args.NIX_CFLAGS_COMPILE or []));
-
-    cmakeFlags =
-      (args.cmakeFlags or [])
-      ++ [
-        ("-DCMAKE_BUILD_TYPE=" + (if debug then "Debug" else "Release"))
-      ];
-
-    enableParallelBuilding = args.enableParallelBuilding or true;
-
     nativeBuildInputs = (args.nativeBuildInputs or []) ++ [ wrapQtAppsHook ];
 
   };
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/modules/qtbase.nix b/nixpkgs/pkgs/development/libraries/qt-5/modules/qtbase.nix
index 24f1d6f81a24..0d0bef342b02 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/modules/qtbase.nix
@@ -22,6 +22,7 @@
   libGL,
   buildExamples ? false,
   buildTests ? false,
+  debug ? false,
   developerBuild ? false,
   decryptSslTraffic ? false
 }:
@@ -33,12 +34,14 @@ let
   compareVersion = v: builtins.compareVersions version v;
   qmakeCacheName =
     if compareVersion "5.12.4" < 0 then ".qmake.cache" else ".qmake.stash";
+  debugSymbols = debug || developerBuild;
 in
 
 stdenv.mkDerivation {
 
   name = "qtbase-${version}";
   inherit qtCompatVersion src version;
+  debug = debugSymbols;
 
   propagatedBuildInputs =
     [
@@ -241,6 +244,7 @@ stdenv.mkDerivation {
       "-I" "${icu.dev}/include"
       "-pch"
     ]
+    ++ lib.optional debugSymbols "-debug"
     ++ lib.optionals (compareVersion "5.11.0" < 0)
     [
       "-qml-debug"
@@ -397,6 +401,8 @@ stdenv.mkDerivation {
           -e "/^host_bins=/ c host_bins=$dev/bin"
     '';
 
+  dontStrip = debugSymbols;
+
   setupHook = ../hooks/qtbase-setup-hook.sh;
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix b/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
index 7e5582cca481..cd3fa583303d 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@@ -2,6 +2,7 @@
 , qtdeclarative, qtquickcontrols, qtlocation, qtwebchannel
 
 , bison, coreutils, flex, git, gperf, ninja, pkg-config, python2, which
+, nodejs, qtbase, perl
 
 , xorg, libXcursor, libXScrnSaver, libXrandr, libXtst
 , fontconfig, freetype, harfbuzz, icu, dbus, libdrm
@@ -16,6 +17,7 @@
 , cups, darwin, openbsm, runCommand, xcbuild, writeScriptBin
 , ffmpeg_3 ? null
 , lib, stdenv, fetchpatch
+, version ? null
 , qtCompatVersion
 }:
 
@@ -25,7 +27,15 @@ qtModule {
   name = "qtwebengine";
   qtInputs = [ qtdeclarative qtquickcontrols qtlocation qtwebchannel ];
   nativeBuildInputs = [
-    bison coreutils flex git gperf ninja pkg-config python2 which gn
+    bison coreutils flex git gperf ninja pkg-config python2 which gn nodejs
+
+    # qmake looks for syncqt instead of syncqt.pl and fails with a cryptic
+    # error if it can't find it. syncqt.pl also has a /usr/bin/env shebang, so
+    # it can't be directly used in a sandboxed build environment.
+    (writeScriptBin "syncqt" ''
+      #!${stdenv.shell}
+      exec ${perl}/bin/perl ${qtbase.dev}/bin/syncqt.pl "$@"
+    '')
   ] ++ optional stdenv.isDarwin xcbuild;
   doCheck = true;
   outputs = [ "bin" "dev" "out" ];
@@ -40,9 +50,17 @@ qtModule {
   hardeningDisable = [ "format" ];
 
   postPatch =
-    # Patch Chromium build tools
     ''
-      ( cd src/3rdparty/chromium; patchShebangs . )
+      # Patch Chromium build tools
+      (
+        cd src/3rdparty/chromium;
+
+        # Manually fix unsupported shebangs
+        substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
+          --replace "/usr/bin/env -S make -f" "/usr/bin/make -f" || true
+
+        patchShebangs .
+      )
     ''
     # Prevent Chromium build script from making the path to `clang` relative to
     # the build directory.  `clang_base_path` is the value of `QMAKE_CLANG_DIR`
@@ -90,11 +108,7 @@ qtModule {
     '' else ''
     substituteInPlace src/3rdparty/chromium/base/mac/mach_port_broker.mm \
       --replace "audit_token_to_pid(msg.trailer.msgh_audit)" "msg.trailer.msgh_audit.val[5]"
-    '')
-    + ''
-    substituteInPlace src/3rdparty/chromium/sandbox/mac/BUILD.gn \
-      --replace 'libs = [ "sandbox" ]' 'libs = [ "/usr/lib/libsandbox.1.dylib" ]'
-    '');
+    ''));
 
   NIX_CFLAGS_COMPILE = lib.optionals stdenv.cc.isGNU [
     # with gcc8, -Wclass-memaccess became part of -Wall and this exceeds the logging limit
@@ -124,7 +138,7 @@ qtModule {
     if [ -d "$PWD/tools/qmake" ]; then
         QMAKEPATH="$PWD/tools/qmake''${QMAKEPATH:+:}$QMAKEPATH"
     fi
-   '';
+  '';
 
   qmakeFlags = if stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64
     then [ "--" "-system-ffmpeg" ] ++ optional enableProprietaryCodecs "-proprietary-codecs"
@@ -190,6 +204,7 @@ qtModule {
 
   buildInputs = optionals stdenv.isDarwin (with darwin; [
     cups
+    apple_sdk.libs.sandbox
 
     # `sw_vers` is used by `src/3rdparty/chromium/build/config/mac/sdk_info.py`
     # to get some information about the host platform.
@@ -205,15 +220,8 @@ qtModule {
         shift
       done
     '')
-
-    # For sandbox.h include
-    (runCommand "MacOS_SDK_sandbox.h" {} ''
-      install -Dm444 "${lib.getDev darwin.apple_sdk.sdk}"/include/sandbox.h "$out"/include/sandbox.h
-    '')
   ]);
 
-  __impureHostDeps = optional stdenv.isDarwin "/usr/lib/libsandbox.1.dylib";
-
   dontUseNinjaBuild = true;
   dontUseNinjaInstall = true;
   dontUseXcbuild = true;
@@ -223,12 +231,17 @@ qtModule {
     [Paths]
     Prefix = ..
     EOF
+  '' + lib.optionalString (lib.versions.majorMinor qtCompatVersion == "5.15") ''
+    # Fix for out-of-sync QtWebEngine and Qt releases (since 5.15.3)
+    sed 's/${lib.head (lib.splitString "-" version)} /${qtCompatVersion} /' -i "$out"/lib/cmake/*/*Config.cmake
   '';
 
   meta = with lib; {
     description = "A web engine based on the Chromium web browser";
     maintainers = with maintainers; [ matthewbauer ];
     platforms = platforms.unix;
+    # This build takes a long time; particularly on slow architectures
+    timeout = 24 * 3600;
   };
 
 }
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/qt-env.nix b/nixpkgs/pkgs/development/libraries/qt-5/qt-env.nix
index da56c07779b9..b4a201c08cc4 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/qt-env.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/qt-env.nix
@@ -5,7 +5,7 @@ buildEnv {
   paths = [ qtbase ] ++ paths;
 
   pathsToLink = [ "/bin" "/mkspecs" "/include" "/lib" "/share" ];
-  extraOutputsToInstall = [ "dev" ];
+  extraOutputsToInstall = [ "out" "dev" ];
 
   postBuild = ''
     rm "$out/bin/qmake"
diff --git a/nixpkgs/pkgs/development/libraries/qt-5/qtModule.nix b/nixpkgs/pkgs/development/libraries/qt-5/qtModule.nix
index 0481f000c6ce..930ed9d67baa 100644
--- a/nixpkgs/pkgs/development/libraries/qt-5/qtModule.nix
+++ b/nixpkgs/pkgs/development/libraries/qt-5/qtModule.nix
@@ -34,6 +34,8 @@ mkDerivation (args // {
     fixQtBuiltinPaths . '*.pr?'
   '';
 
+  dontWrapQtApps = args.dontWrapQtApps or true;
+
   postFixup = ''
     if [ -d "''${!outputDev}/lib/pkgconfig" ]; then
         find "''${!outputDev}/lib/pkgconfig" -name '*.pc' | while read pc; do