Ensure /usr/bin is in PATH for macOS

This is an alternative fix to what was included in #105.

README.md

@@ -178,7 +178,8 @@ the / read-only mount. Note that this will make your builds non-hermetic.
 
 #### Compatibility
 
-The toolchain is tested to work with `rules_go` and `rules_foreign_cc`.
+The toolchain is tested to work with `rules_go`, `rules_rust`, and
+`rules_foreign_cc`.
 
 #### Accessing tools
 

toolchain/internal/repo.bzl

@@ -35,7 +35,7 @@ def llvm_repo_impl(rctx):
 
     _download_llvm_preconfigured(rctx)
 
-    # darwin may use local 'ld' so symlink it to bin directory to help
-    # other programs locate it when called directly (e.g. rustc)
-    if os == "darwin":
-        rctx.symlink("/usr/bin/ld", "bin/ld")
+    # We try to avoid patches to the downloaded repo so that it is easier for
+    # users to bring their own LLVM distribution through `http_archive`. If we
+    # do want to make changes, then we should do it through a patch file, and
+    # document it for users of toolchain_roots attribute.

toolchain/osx_cc_wrapper.sh.tpl

@@ -62,6 +62,23 @@ for i in "$@"; do
     fi
 done
 
+# On macOS, we use ld as the linker for single-platform builds (i.e., when not
+# cross-compiling). Some applications may remove /usr/bin from PATH before
+# calling this script, which would make /usr/bin/ld unreachable.  For example,
+# rules_rust does not set PATH (unless the user explicitly sets PATH in env
+# through attributes) [1] when calling rustc, and rustc explicitly sets PATH to
+# be the PATH from its environment and {sysroot}/{rust_lib}/bin ([2], [3]),
+# which results in CC being called with PATH={sysroot}/{rust_lib}/bin.
+# [1]: https://github.com/bazelbuild/rules_rust/blob/e589105b4e8181dd1d0d8ccaa0cf3267efb06e86/cargo/cargo_build_script.bzl#L66-L68
+# [2]: https://github.com/rust-lang/rust/blob/1c03f0d0ba4fee54b7aa458f4d3ad989d8bf7b34/compiler/rustc_session/src/session.rs#L804-L813
+# [3]: https://github.com/rust-lang/rust/blob/1c03f0d0ba4fee54b7aa458f4d3ad989d8bf7b34/compiler/rustc_codegen_ssa/src/back/link.rs#L640-L645
+# Let's restore /usr/bin to PATH in such cases. Note that /usr/bin is not a
+# writeable directory on macOS even with sudo privileges, so it should be safe
+# to add it to PATH even when the application wants to use a very strict PATH.
+if [[ ":${PATH}:" != *":/usr/bin:"* ]]; then
+  PATH="${PATH}:/usr/bin"
+fi
+
 # Call the C++ compiler.
 if [[ -f %{toolchain_path_prefix}bin/clang ]]; then
   %{toolchain_path_prefix}bin/clang "$@"