Index: Mk/Scripts/do-depends.sh
===================================================================
--- Mk/Scripts/do-depends.sh
+++ Mk/Scripts/do-depends.sh
@@ -92,6 +92,31 @@
 	echo " - found (${libfile})"
 }
 
+dep_err()
+{
+    echo "Error: $1" >&2
+    echo "Culprit is: $2" >&2
+}
+
+
+
+# Find an applicable NORUNTIME file
+noruntime_file=
+noruntime_patterns_file=
+for overlay in ${dp_OVERLAYS} ${PORTSDIR}; do
+    noruntime_file="${overlay}/NORUNTIME"
+    if [ -f "${noruntime_file}" ]; then
+        break
+    fi
+done
+if [ -n "${noruntime_file}" ]; then
+    # Precompute grep patterns
+    noruntime_patterns_file="$(mktemp -t NORUNTIME_PATTERNS)"
+    [ $? -eq 0 ] || exit 1
+    trap "rm -f ${noruntime_patterns_file}" EXIT QUIT TERM
+    sed -n -E 's%^([^#].*)\|[^|]+\|[^|]+$%\1$%p' ${noruntime_file} > ${noruntime_patterns_file}
+fi
+
 anynotfound=0
 err=0
 for _line in ${dp_RAWDEPENDS} ; do
@@ -113,13 +138,13 @@
 	last=${3:-}
 
 	if [ -z "${pattern}" ]; then
-		echo "Error: there is an empty port dependency in ${dp_DEPTYPE}" >&2
+		dep_err "Empty port dependency in ${dp_DEPTYPE}" ${_line}
 		err=1
 		continue
 	fi
 
 	if [ -z "${origin}" ]; then
-		echo "Error: a dependency has an empty origin in ${dp_DEPTYPE}" >&2
+		dep_err "Dependency with empty origin in ${dp_DEPTYPE}" ${_line}
 		err=1
 		continue
 	fi
@@ -132,6 +157,19 @@
 		;;
 	esac
 
+	# Enforce runtime dependencies restrictions
+	case ${dp_DEPTYPE} in
+	    LIB_DEPENDS|RUN_DEPENDS)
+		if [ -n "${noruntime_patterns_file}" ]; then
+		    if echo "${origin}" | grep -E -q -f "${noruntime_patterns_file}"; then
+			dep_err "Dependency forbidden at runtime in ${dp_DEPTYPE}" ${_line}
+			err=1
+			continue
+		    fi
+		fi
+		;;
+	esac
+
 	case "${origin}" in
 	/*) ;;
 	*)
@@ -170,7 +208,7 @@
 	    case ${pattern} in
 	      lib*.so*)      fct=find_lib ;;
 	      *)
-		echo "Error: pattern ${pattern} in LIB_DEPENDS is not valid"
+		dep_err "Pattern ${pattern} in LIB_DEPENDS is not valid" ${_line}
 		err=1
 		continue
 		;;
@@ -189,7 +227,7 @@
 	[ ${pattern} = "/nonexistent" ] || anynotfound=1
 
 	if [ ! -f "${origin}/Makefile" ]; then
-		echo "Error a dependency refers to a non existing origin: ${origin} in ${dp_DEPTYPE}" >&2
+		dep_err "Dependency refers to a nonexistant origin in ${dp_DEPTYPE}" ${_line}
 		err=1
 		continue
 	fi
Index: NORUNTIME
===================================================================
--- /dev/null
+++ NORUNTIME
@@ -0,0 +1,25 @@
+#
+# NORUNTIME -- A list of ports that cannot be used as run-time dependencies
+#
+# $FreeBSD$
+#
+# Each entry consists of a single line containing the following three fields in
+# the order named, separated with the pipe (`|') character:
+#
+#     Port: The port that can't be used at runtime
+#     Date: When the port was added here (YYYY-MM-DD, in PST/PDT)
+#     Why:  The reason for restricting dependencies on it
+#
+# Port is a grep(1) extended RE (see re_format(7)) anchored at end and matched
+# against port origins. It is recommended to avoid using `|' in such regular
+# expressions and provide multiple lines instead.
+#
+# Keep this list sorted in the chronological order.  New entries must be added
+# at the tail.  Reason for the restriction should start with a capital letter
+# and not end with the dot.
+#
+# If the restriction is lifted, make sure to delete the relevant
+# line.
+#
+# Port|Date|Why
+lang/python2[^/]*|2021-02-26|EOL upstream