From: "Anthony J. Bentley" <bentley@openbsd.org>
Subject: Re: Poison ccache and sccache
To: Klemens Nanni <kn@openbsd.org>, ports@openbsd.org
Date: Fri, 11 Sep 2026 05:33:43 -0600

Stuart Henderson writes:
> I think I'd probably say "was called directly".
>
> Not sure if I'd allow the "present in BUILD_DEPENDS" carve-out; having
> ccache in BUILD_DEPENDS won't be enough to make it work (at least with
> PORTS_PRIVSEP), as at least CCACHE_DIR still needs to be set. Maybe
> go without that at first and revisit if we end up finding something that
> really does need it to be present?


--- infrastructure/mk/bsd.port.mk
+++ infrastructure/mk/bsd.port.mk
@@ -452,7 +452,8 @@ CCACHE_DIR ?= ${WRKOBJDIR_${PKGPATH}}/.ccache
 MAKE_ENV += CCACHE_DIR=${CCACHE_DIR} ${CCACHE_ENV}
 CONFIGURE_ENV += CCACHE_DIR=${CCACHE_DIR}
 # scons cleans the environment when calling the compiler
-COMPILER_WRAPPER += env CCACHE_DIR=${CCACHE_DIR} ${CCACHE_ENV} ccache
+COMPILER_WRAPPER += env CCACHE_DIR=${CCACHE_DIR} ${CCACHE_ENV} \
+	${LOCALBASE}/bin/ccache
 .  if !exists(${LOCALBASE}/bin/ccache)
 ERRORS += "Fatal: USE_CCACHE is set, but ccache is not installed."
 .  endif
@@ -2783,6 +2784,14 @@ ${_WRKDIR_COOKIE}:
 	@${_PBUILD} mkdir -p ${WRKDIR} ${WRKDIR}/bin
 	@${_wrap_install_commands}
 # poison some common binaries unless the relevant BUILD_DEPENDS is used
+	@printf '#!/bin/sh\n\
+		echo "*** $$0 was called directly ***" >&2\n\
+		exit 1\n' ${_PREDIR} ${WRKDIR}/bin/ccache
+	@${_PBUILD} chmod 555 ${WRKDIR}/bin/ccache
+	@printf '#!/bin/sh\n\
+		echo "*** $$0 was called directly ***" >&2\n\
+		exit 1\n' ${_PREDIR} ${WRKDIR}/bin/sccache
+	@${_PBUILD} chmod 555 ${WRKDIR}/bin/sccache
 .if empty(_BUILD_DEP:Mdevel/gettext,-tools) && \
 		empty(_BUILD_DEP:Mtextproc/intltool)
 	@printf '#!/bin/sh\n\