#35068 depends: fix cmake package discovery for depends-built packages

• Ensure CMake packages built in depends find depends dependencies instead of host system libraries
• Prevents host library pollution when developers have matching packages installed on their host system

Replaces the ineffective CMAKE_MODULE_PATH environment variable in depends/funcs.mk with CMAKE_PREFIX_PATH. This ensures CMake-based packages built within the depends system locate their dependencies in the depends prefix rather than falling back to host system libraries.

Problem: CMake does not read CMAKE_MODULE_PATH from the environment and ignores it in config-mode package searches, causing packages like native_libmultiprocess to find host libraries rather than depends-built libraries when host packages are present.

P3 · bug fix

• P3 because it fixes dependency search paths that erroneously pick up host libraries
• Impact is narrow, primarily affecting developers building depends on hosts with matching packages

Fixes a broken search path in depends that caused CMake to ignore depends-built packages and pick up host versions when present, notably for native_libmultiprocess. The issue is real but primarily affects developers building depends on hosts that have matching libraries installed.

Membership: Modifies depends/funcs.mk, which configures the depends build environment.

Factors: security/stability 1, bug 1, performance 0, user value 0, leverage 1

• Author has not responded to open review suggestions since April 2026

The author has not updated the pull request or replied to the open review suggestions since April 2026.

Author status: silent since 2026-04-15

Open concerns:

• Reviewers questioned whether preserving and appending the external CMAKE_PREFIX_PATH undermines the isolation of the depends system (hebasto, purpleKarrot).
• purpleKarrot suggested overwriting CMAKE_PREFIX_PATH without appending external paths.

Resolved concerns:

• Clarified why CMAKE_INSTALL_PREFIX does not resolve dependency lookup under supported CMake versions without passing CMake arguments directly (ryanofsky, purpleKarrot).

• General agreement on fixing the variable used for package discovery
• Unaddressed objection: appending external paths risks depends isolation, no reply (hebasto, purpleKarrot)
• Suggested setting a clean override without inheriting host paths (purpleKarrot)

Direction accepted, but reviewers prefer not inheriting host CMAKE_PREFIX_PATH; unaddressed by author.

Both hebasto and purpleKarrot agreed that CMAKE_PREFIX_PATH is the correct variable to set, but both cautioned that appending the host's existing CMAKE_PREFIX_PATH risks depends isolation. purpleKarrot proposed a clean override that the author has not adopted.

• hebasto asked whether keeping external CMAKE_PREFIX_PATH undermines the purpose of depends
• purpleKarrot proposed setting CMAKE_PREFIX_PATH without appending $(CMAKE_PREFIX_PATH)
• sedited pinged for status regarding unaddressed review

Review verdicts (DrahtBot): 0

0 lines under test/bench/ci.

• depends/funcs.mk +1/-1

This PR fixes a bug in depends/funcs.mk where CMAKE_MODULE_PATH was set in the environment to locate depends packages, but CMake ignores that variable in the environment and in config-mode searches. Setting CMAKE_PREFIX_PATH instead resolves build failures where host libraries (such as Cap'n Proto) were mistakenly found over depends-built versions. Reviewers agree with using CMAKE_PREFIX_PATH but objected to preserving host CMAKE_PREFIX_PATH values rather than strictly isolating the depends environment. The PR is currently stale with no response from the author to the proposed clean override.