Ensure /usr/bin is in PATH for macOS

This is an alternative fix to what was included in #105.

README.md

@@ -178,7 +178,8 @@ the / read-only mount. Note that this will make your builds non-hermetic.
 
 #### Compatibility
 
-The toolchain is tested to work with `rules_go` and `rules_foreign_cc`.
+The toolchain is tested to work with `rules_go`, `rules_rust`, and
+`rules_foreign_cc`.
 
 #### Accessing tools
 

toolchain/internal/repo.bzl

@@ -35,7 +35,7 @@ def llvm_repo_impl(rctx):
 
     _download_llvm_preconfigured(rctx)
 
-    # darwin may use local 'ld' so symlink it to bin directory to help
-    # other programs locate it when called directly (e.g. rustc)
-    if os == "darwin":
-        rctx.symlink("/usr/bin/ld", "bin/ld")
+    # We try to avoid patches to the downloaded repo so that it is easier for
+    # users to bring their own LLVM distribution through `http_archive`. If we
+    # do want to make changes, then we should do it through a patch file, and
+    # document it for users of toolchain_roots attribute.

toolchain/osx_cc_wrapper.sh.tpl

@@ -62,6 +62,18 @@ for i in "$@"; do
     fi
 done
 
+# On macOS, we use ld as the linker for single-platform builds. Some
+# applications may remove /usr/bin from PATH before calling this script, which
+# would make /usr/bin/ld unreachable.
+# For example, rules_rust sets PATH to be /bin.
+# https://github.com/rust-lang/rust/blob/308dffd25cb55bbb4a1fbee9822cf82c6a5d012d/compiler/rustc_session/src/session.rs#L804-L813
+# Let's restore /usr/bin to PATH in such cases. Note that /usr/bin is not a
+# writeable directory on macOS even with sudo privileges, so it should be safe
+# to add it to PATH even when the application wants to use a very strict PATH.
+if [[ ":${PATH}:" != *":/usr/bin:"* ]]; then
+  PATH="${PATH}:/usr/bin"
+fi
+
 # Call the C++ compiler.
 if [[ -f %{toolchain_path_prefix}bin/clang ]]; then
   %{toolchain_path_prefix}bin/clang "$@"