From d5e028a441ddcac16b380436c98439b769e35355 Mon Sep 17 00:00:00 2001
From: Jacek Galowicz <jacek@galowicz.de>
Date: Thu, 9 Dec 2021 15:48:46 +0000
Subject: [PATCH] make-binary-wrapper: Make CC substitution safer

---
 .../build-support/setup-hooks/make-binary-wrapper.sh |  2 +-
 pkgs/top-level/all-packages.nix                      | 12 +++++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
index e9910b2e99b8..abc929cb89db 100644
--- a/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-binary-wrapper.sh
@@ -35,7 +35,7 @@ assertExecutable() {
 makeWrapper() {
     assertExecutable "$1"
     makeDocumentedCWrapper "$1" "${@:3}" | \
-      cc \
+      @CC@ \
         -Wall -Werror -Wpedantic \
         -Os \
         -x c \
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 80e9275f98ed..1f291fd6c5b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -606,11 +606,13 @@ in
   makeWrapper = makeSetupHook { deps = [ dieHook ]; substitutions = { shell = targetPackages.runtimeShell; }; }
                               ../build-support/setup-hooks/make-wrapper.sh;
 
-  makeBinaryWrapper = makeSetupHook {
-    deps = [ dieHook ];
-  } (runCommand "make-binary-wrapper.sh" {} ''
-      substitute ${../build-support/setup-hooks/make-binary-wrapper.sh} $out --replace " cc " " ${gcc}/bin/cc "
-  '');
+  makeBinaryWrapper = let
+    script = runCommand "make-binary-wrapper.sh" {} ''
+      substitute ${../build-support/setup-hooks/make-binary-wrapper.sh} $out \
+        --replace " @CC@ " " ${gcc}/bin/cc "
+    '';
+  in
+    makeSetupHook { deps = [ dieHook ]; } script;
 
   makeModulesClosure = { kernel, firmware, rootModules, allowMissing ? false }:
     callPackage ../build-support/kernel/modules-closure.nix {