Change default PREFIX to /opt/local

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -19,6 +19,13 @@ Use environment variables to select the container engine or override image names
 CONTAINER_ENGINE=podman IMAGE_NAME=my-build-env ./rocky9/build.sh
 ```
 
+The Debian 13 and Rocky Linux 9 images install every library under `/opt/local` by default. Set `PREFIX` to install them elsewhere; the build environment variables (`PATH`, `PKG_CONFIG_PATH`, `CMAKE_PREFIX_PATH`, `CMAKE_INSTALL_PREFIX`, and so on) follow it. Rust is a build tool rather than a library, so it always lives under `/usr/local` and is not affected by `PREFIX`. The Alpine image does not support `PREFIX`.
+
+```sh
+PREFIX=/opt/stack ./debian13/build.sh
+PREFIX=/opt/stack ./rocky9/build.sh
+```
+
 ## Run
 
 ```sh

debian13/Dockerfile

@@ -23,11 +23,11 @@ RUN sed -i 's|deb.debian.org|mirrors.ustc.edu.cn|g' /etc/apt/sources.list.d/debi
 
 # Install prefix of every dependency, and the Debian multiarch directory name (`gcc -dumpmachine`)
 # its libraries are installed under; build.sh derives the latter from `uname -m`.
-ARG PREFIX=/usr/local
+ARG PREFIX=/opt/local
 ARG MULTIARCH=x86_64-linux-gnu
 
 # Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
-# than the default /usr/local. CMake (>= 3.29) takes its default install prefix from the environment.
+# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
 ENV PATH=${PREFIX}/bin:${PATH} \
     C_INCLUDE_PATH=${PREFIX}/include \
     CPLUS_INCLUDE_PATH=${PREFIX}/include \
@@ -38,10 +38,11 @@ ENV PATH=${PREFIX}/bin:${PATH} \
 
 RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
 
+# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
 RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
     && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
-    && rust-src/install.sh --prefix=${PREFIX} --without=rust-docs \
+    && rust-src/install.sh --prefix=/usr/local --without=rust-docs \
     && rm -rf rust-src
 
 RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost.tar.bz2 \
@@ -823,13 +824,3 @@ RUN mkdir -p ${PREFIX}/share/source-stack \
     && sed "s|@MULTIARCH@|$(gcc -dumpmachine)|" /tmp/source-stack.cmake.in \
         > ${PREFIX}/share/source-stack/source-stack.cmake \
     && rm /tmp/source-stack.cmake.in
-
-RUN useradd --create-home develop
-USER develop
-
-# ENV CLAUDE_CONFIG_DIR="/root/my-claude"
-ENV DISABLE_AUTOUPDATER="1"
-RUN bash -c 'curl -fsSL https://claude.ai/install.sh | bash'
-
-ARG CLAUDE_CODE_OAUTH_TOKEN
-ENV CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN}

debian13/build.sh

@@ -1,38 +1,10 @@
 #!/bin/sh
-# Usage:
-#   ./build.sh            build the image, asking for the password that unlocks the token
-#   ./build.sh --encrypt  encrypt a token and print the value to paste into ENCRYPTED_TOKEN
 
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-debian13-source-stack}"
-PREFIX="${PREFIX:-/usr/local}"
+PREFIX="${PREFIX:-/opt/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-
-# CLAUDE_CODE_OAUTH_TOKEN encrypted with AES-256-CBC (PBKDF2, base64). Generate with --encrypt.
-ENCRYPTED_TOKEN='U2FsdGVkX1/BCTASs0tR40hsT+sngp46zANCbGZnklLN1M0wSJs/DxbQ6JDg593G09A+cVtVius4hJHRzB6caOO2KwBV0/+i7yUjr/PfreZksrdkz1DnFc7oorxXfvB7azuNEkQfAE2fZg8cnYL5jy3/LKRdAm11SUm83fU8ke8='
-
-OPENSSL_ARGS="enc -aes-256-cbc -pbkdf2 -iter 600000 -a -A"
-
-if ! command -v openssl >/dev/null 2>&1; then
-    echo "Error: OpenSSL is required." >&2
-    exit 1
-fi
-
-# read_secret PROMPT VARNAME: read the input with echo on, so it stays visible while typing.
-read_secret() {
-    printf '%s' "$1" >&2
-    IFS= read -r "$2"
-}
-
-if [ "${1:-}" = "--encrypt" ]; then
-    read_secret "OAuth token: " token
-    read_secret "Password: " BUILD_PASSWORD
-    export BUILD_PASSWORD
-    printf '%s' "$token" | openssl $OPENSSL_ARGS -pass env:BUILD_PASSWORD
-    echo
-    exit 0
-fi
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
 
@@ -41,22 +13,6 @@ if ! command -v podman >/dev/null 2>&1; then
     exit 1
 fi
 
-if [ -z "$ENCRYPTED_TOKEN" ]; then
-    echo "Error: ENCRYPTED_TOKEN is empty; run './build.sh --encrypt' and paste the output into build.sh." >&2
-    exit 1
-fi
-
-read_secret "Password for CLAUDE_CODE_OAUTH_TOKEN: " BUILD_PASSWORD
-export BUILD_PASSWORD
-if ! CLAUDE_CODE_OAUTH_TOKEN=$(printf '%s' "$ENCRYPTED_TOKEN" | openssl $OPENSSL_ARGS -d -pass env:BUILD_PASSWORD 2>/dev/null); then
-    echo "Error: wrong password or corrupted token." >&2
-    exit 1
-fi
-unset BUILD_PASSWORD
-
-# Exported so podman reads the value from the environment and it never appears in the command line.
-export CLAUDE_CODE_OAUTH_TOKEN
-
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
 # macOS reports arm64 where Linux (and Debian multiarch) call it aarch64.
@@ -64,8 +20,6 @@ ARCH=$(uname -m)
 [ "$ARCH" = arm64 ] && ARCH=aarch64
 
 echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
-exec podman build \
-    --build-arg CLAUDE_CODE_OAUTH_TOKEN \
-    --build-context sources="$SOURCES_DIR" \
+exec podman build --build-context sources="$SOURCES_DIR" \
     --build-arg PREFIX="$PREFIX" --build-arg MULTIARCH="$ARCH-linux-gnu" \
     --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/Dockerfile

@@ -37,6 +37,22 @@ RUN dnf install --assumeyes --enablerepo=crb \
 
 RUN git config --global url."https://wangguofang.net/github.com/".insteadOf "https://github.com/"
 
+# Install prefix of every dependency. Libraries are installed under ${PREFIX}/lib64.
+ARG PREFIX=/opt/local
+
+# Make the compiler, CMake, pkg-config and the shell find earlier dependencies under a prefix other
+# than the default /opt/local. CMake (>= 3.29) takes its default install prefix from the environment.
+ENV PATH=${PREFIX}/bin:${PATH} \
+    C_INCLUDE_PATH=${PREFIX}/include \
+    CPLUS_INCLUDE_PATH=${PREFIX}/include \
+    LIBRARY_PATH=${PREFIX}/lib64:${PREFIX}/lib \
+    PKG_CONFIG_PATH=${PREFIX}/lib64/pkgconfig:${PREFIX}/lib/pkgconfig:${PREFIX}/share/pkgconfig \
+    CMAKE_PREFIX_PATH=${PREFIX} \
+    CMAKE_INSTALL_PREFIX=${PREFIX}
+
+RUN test "$(cmake --version | sed -n '1s/[^0-9]*//p' | cut -d. -f2)" -ge 29
+
+# Rust is a build tool, not a library, so it is installed under /usr/local regardless of ${PREFIX}.
 RUN --mount=type=bind,from=sources,source=rust,target=/tmp/rust \
     mkdir rust-src \
     && tar -xJf "/tmp/rust/rust-1.99.1-$(uname -m)-unknown-linux-gnu.tar.xz" -C rust-src --strip-components=1 \
@@ -47,7 +63,7 @@ RUN --mount=type=bind,from=sources,source=boost_1_83_0.tar.bz2,target=/tmp/boost
     mkdir src \
     && tar --extract --bzip2 --file=/tmp/boost.tar.bz2 --directory=src --strip-components=1 \
     && cd src \
-    && ./bootstrap.sh --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && ./bootstrap.sh --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
     && ./b2 --jobs="$(nproc)" \
         --with-atomic \
         --with-chrono \
@@ -73,7 +89,7 @@ RUN --mount=type=bind,from=sources,source=openssl-openssl-3.0.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/openssl.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && ./Configure --prefix=/usr/local no-shared no-tests -fPIC \
+    && ./Configure --prefix=${PREFIX} no-shared no-tests -fPIC \
     && make --jobs="$(nproc)" \
     && make install_sw \
     && cd .. \
@@ -111,7 +127,7 @@ RUN --mount=type=bind,from=sources,source=zlib-v1.3.1.tar.gz,target=/tmp/zlib.ta
     mkdir src \
     && tar --extract --gzip --file=/tmp/zlib.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -204,7 +220,7 @@ RUN --mount=type=bind,from=sources,source=gflags-v2.3.1.tar.gz,target=/tmp/gflag
         -DINSTALL_HEADERS=ON \
         -DINSTALL_SHARED_LIBS=OFF \
         -DINSTALL_STATIC_LIBS=ON \
-        -DLIBRARY_INSTALL_DIR=/usr/local/lib64 \
+        -DLIBRARY_INSTALL_DIR=${PREFIX}/lib64 \
         -DREGISTER_INSTALL_PREFIX=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src
@@ -227,7 +243,7 @@ RUN --mount=type=bind,from=sources,source=liburing-liburing-2.15.tar.gz,target=/
     mkdir src \
     && tar --extract --gzip --file=/tmp/liburing.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --libdevdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --libdevdir=${PREFIX}/lib64 \
     && make --jobs="$(nproc)" ENABLE_SHARED=0 library \
     && make ENABLE_SHARED=0 install \
     && cd .. \
@@ -237,7 +253,7 @@ RUN --mount=type=bind,from=sources,source=libaio_0.3.113.orig.tar.gz,target=/tmp
     mkdir src \
     && tar --extract --gzip --file=/tmp/libaio.tar.gz --directory=src --strip-components=1 \
     && make --directory=src --jobs="$(nproc)" ENABLE_SHARED=0 \
-    && make --directory=src ENABLE_SHARED=0 prefix=/usr/local libdir=/usr/local/lib64 install \
+    && make --directory=src ENABLE_SHARED=0 prefix=${PREFIX} libdir=${PREFIX}/lib64 install \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=libdwarf-code-v2.3.2.tar.gz,target=/tmp/libdwarf-code.tar.gz \
@@ -260,7 +276,7 @@ RUN --mount=type=bind,from=sources,source=libsodium-1.0.20-RELEASE.tar.gz,target
     && tar --extract --gzip --file=/tmp/libsodium.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static --with-pic \
+    && ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --with-pic \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -294,7 +310,7 @@ RUN --mount=type=bind,from=sources,source=numactl-v2.0.19.tar.gz,target=/tmp/num
     && tar --extract --gzip --file=/tmp/numactl.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -397,7 +413,7 @@ RUN --mount=type=bind,from=sources,source=util-linux-2.42.2.tar.xz,target=/tmp/u
     mkdir src \
     && tar --extract --xz --file=/tmp/util-linux.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-all-programs \
         --disable-bash-completion \
         --disable-makeinstall-chown \
@@ -497,7 +513,7 @@ RUN --mount=type=bind,from=sources,source=rapidjson-v1.1.0.tar.gz,target=/tmp/ra
     && tar --extract --gzip --file=/tmp/rapidjson.tar.gz --directory=src --strip-components=1 \
     && git -C src apply /tmp/rapidjson-generic-string-ref-assignment.patch \
     && cmake -G Ninja -S src -B build -DCMAKE_BUILD_TYPE=Release \
-        -DLIB_INSTALL_DIR=/usr/local/lib64 \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
         -DRAPIDJSON_BUILD_DOC=OFF \
         -DRAPIDJSON_BUILD_EXAMPLES=OFF \
         -DRAPIDJSON_BUILD_TESTS=OFF \
@@ -548,7 +564,7 @@ RUN --mount=type=bind,from=sources,source=gmp-6.3.0.tar.xz,target=/tmp/gmp.tar.x
     mkdir src \
     && tar --extract --xz --file=/tmp/gmp.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static --enable-fat \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static --enable-fat \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -558,7 +574,7 @@ RUN --mount=type=bind,from=sources,source=nettle-3.10.2.tar.gz,target=/tmp/nettl
     mkdir src \
     && tar --extract --gzip --file=/tmp/nettle.tar.gz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-documentation \
         --disable-shared \
         --enable-static \
@@ -571,7 +587,7 @@ RUN --mount=type=bind,from=sources,source=gnutls-3.8.13.tar.xz,target=/tmp/gnutl
     mkdir src \
     && tar --extract --xz --file=/tmp/gnutls.tar.xz --directory=src --strip-components=1 \
     && cd src \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --with-included-libtasn1 \
         --with-included-unistring \
         --disable-cxx \
@@ -610,7 +626,7 @@ RUN --mount=type=bind,from=sources,source=libyaml-0.2.5.tar.gz,target=/tmp/libya
     && tar --extract --gzip --file=/tmp/libyaml.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./bootstrap \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 --disable-shared --enable-static \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 --disable-shared --enable-static \
     && make --jobs="$(nproc)" \
     && make install \
     && cd .. \
@@ -648,7 +664,7 @@ RUN --mount=type=bind,from=sources,source=libunwind-v1.8.3.tar.gz,target=/tmp/li
     && tar --extract --gzip --file=/tmp/libunwind.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && autoreconf --install \
-    && CFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-shared \
         --enable-static \
         --disable-tests \
@@ -665,7 +681,7 @@ RUN --mount=type=bind,from=sources,source=jemalloc-5.3.1.tar.gz,target=/tmp/jema
     && tar --extract --gzip --file=/tmp/jemalloc.tar.gz --directory=src --strip-components=1 \
     && cd src \
     && ./autogen.sh \
-    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=/usr/local --libdir=/usr/local/lib64 \
+    && CFLAGS=-fPIC CXXFLAGS=-fPIC ./configure --prefix=${PREFIX} --libdir=${PREFIX}/lib64 \
         --disable-doc \
         --disable-shared \
         --enable-static \
@@ -680,8 +696,8 @@ RUN --mount=type=bind,from=sources,source=libproxyprotocol-v1.3.3.tar.gz,target=
     mkdir src \
     && tar --extract --gzip --file=/tmp/libproxyprotocol.tar.gz --directory=src --strip-components=1 \
     && gcc -fPIC -c -o src/src/proxy_protocol.o src/src/proxy_protocol.c \
-    && ar rcs /usr/local/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
-    && cp src/src/proxy_protocol.h /usr/local/include/ \
+    && ar rcs ${PREFIX}/lib64/libproxyprotocol.a src/src/proxy_protocol.o \
+    && cp src/src/proxy_protocol.h ${PREFIX}/include/ \
     && rm -rf src
 
 RUN --mount=type=bind,from=sources,source=xsimd-14.2.0.tar.gz,target=/tmp/xsimd.tar.gz \
@@ -701,10 +717,10 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DBUILD_SHARED_LIBS=OFF \
         -DBUILD_TESTING=OFF \
         -DBUILD_TUTORIALS=OFF \
-        -DCMAKE_INSTALL_DIR=/usr/local/lib64/cmake \
+        -DCMAKE_INSTALL_DIR=${PREFIX}/lib64/cmake \
         -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
-        -DLIB_INSTALL_DIR=/usr/local/lib64 \
-        -DPKGCONFIG_INSTALL_DIR=/usr/local/lib64/pkgconfig \
+        -DLIB_INSTALL_DIR=${PREFIX}/lib64 \
+        -DPKGCONFIG_INSTALL_DIR=${PREFIX}/lib64/pkgconfig \
         -DWITH_AS3=OFF \
         -DWITH_C_GLIB=OFF \
         -DWITH_CPP=ON \
@@ -718,7 +734,7 @@ RUN --mount=type=bind,from=sources,source=thrift-v0.22.0.tar.gz,target=/tmp/thri
         -DWITH_ZLIB=OFF \
     && cmake --build build --parallel "$(nproc)" --target install \
     && sed -i 's|^libdir=.*|libdir=${prefix}/lib64|' \
-        /usr/local/lib64/pkgconfig/thrift.pc \
+        ${PREFIX}/lib64/pkgconfig/thrift.pc \
     && rm -rf build src
 
 RUN --mount=type=bind,from=sources,source=snappy-1.2.2.tar.gz,target=/tmp/snappy.tar.gz \
@@ -798,4 +814,6 @@ RUN --mount=type=bind,from=sources,source=duckdb-v1.5.6.tar.gz,target=/tmp/duckd
     && cmake --build build --parallel "$(nproc)" --target install \
     && rm -rf build src ui-src
 
+COPY source-stack.cmake ${PREFIX}/share/source-stack/source-stack.cmake
+
 CMD ["/bin/bash"]

rocky9/build.sh

@@ -3,6 +3,7 @@
 set -eu
 
 IMAGE_NAME="${IMAGE_NAME:-rocky9-source-stack}"
+PREFIX="${PREFIX:-/opt/local}"
 SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 SOURCES_DIR="${SOURCES_DIR:-$SCRIPT_DIR/../sources}"
 FETCH_SCRIPT="$SCRIPT_DIR/../fetch-sources.sh"
@@ -14,5 +15,6 @@ fi
 
 SOURCES_DIR="$SOURCES_DIR" "$FETCH_SCRIPT"
 
-echo "Building image $IMAGE_NAME with podman ..."
-exec podman build --build-context sources="$SOURCES_DIR" --tag "$IMAGE_NAME" "$SCRIPT_DIR"
+echo "Building image $IMAGE_NAME with podman (prefix $PREFIX) ..."
+exec podman build --build-context sources="$SOURCES_DIR" \
+    --build-arg PREFIX="$PREFIX" --tag "$IMAGE_NAME" "$SCRIPT_DIR"

rocky9/source-stack.cmake

@@ -0,0 +1,50 @@
+# Installed into the image at ${PREFIX}/share/source-stack/source-stack.cmake.
+#
+# Points CMake at the dependencies installed by this image. It mirrors the
+# Dockerfile's ENV block (PATH, PKG_CONFIG_PATH, CMAKE_PREFIX_PATH,
+# C_INCLUDE_PATH/CPLUS_INCLUDE_PATH, LIBRARY_PATH) for CMake's own lookups.
+# The prefix is derived from this file's location, so it also works when the
+# prefix is moved. Include it after project(), before the first find_package().
+#
+#   GW_SOURCE_STACK_ONLY  resolve libraries and packages only below the prefix
+
+option(GW_SOURCE_STACK_ONLY
+    "Resolve libraries and packages only below the source-stack prefix" OFF)
+
+get_filename_component(_ss_p "${CMAKE_CURRENT_LIST_DIR}/../.." ABSOLUTE)
+
+list(PREPEND CMAKE_PREFIX_PATH "${_ss_p}")
+list(PREPEND CMAKE_PROGRAM_PATH "${_ss_p}/bin")
+list(PREPEND CMAKE_INCLUDE_PATH "${_ss_p}/include")
+list(PREPEND CMAKE_LIBRARY_PATH "${_ss_p}/lib64" "${_ss_p}/lib")
+
+# pkg_check_modules() reads PKG_CONFIG_PATH at call time.
+set(_ss_pc "${_ss_p}/lib64/pkgconfig:${_ss_p}/lib/pkgconfig:${_ss_p}/share/pkgconfig")
+if(GW_SOURCE_STACK_ONLY)
+    # PKG_CONFIG_LIBDIR replaces the default search path, so system .pc files are ignored.
+    set(ENV{PKG_CONFIG_LIBDIR} "${_ss_pc}")
+    set(ENV{PKG_CONFIG_PATH} "")
+    # Build tools come from the system; look them up before system paths are switched off.
+    find_program(PKG_CONFIG_EXECUTABLE NAMES pkg-config pkgconf)
+    set(CMAKE_FIND_USE_CMAKE_SYSTEM_PATH OFF)
+    set(CMAKE_FIND_USE_SYSTEM_ENVIRONMENT_PATH OFF)
+    set(CMAKE_FIND_ROOT_PATH "${_ss_p}")
+    set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+    set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+else()
+    if(NOT "$ENV{PKG_CONFIG_PATH}" STREQUAL "")
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}:$ENV{PKG_CONFIG_PATH}")
+    else()
+        set(ENV{PKG_CONFIG_PATH} "${_ss_pc}")
+    endif()
+endif()
+
+# protoc installed next to the libraries, unless the caller chose one.
+if(NOT Protobuf_PROTOC_EXECUTABLE AND EXISTS "${_ss_p}/bin/protoc")
+    set(Protobuf_PROTOC_EXECUTABLE "${_ss_p}/bin/protoc" CACHE FILEPATH "protoc")
+endif()
+
+message(STATUS "source-stack: ${_ss_p}")
+unset(_ss_p)
+unset(_ss_pc)