Fix bootstrapping in Docker images.

Turns out, we couldn't run jarjar because the Java launcher script looks for the .jars in the runfiles and build-runfiles is stubbed out during bootstrapping.

The only reason why this worked at all is that sandboxing *also* doesn't work during bootstrapping but it causes the creation of symlinks that happened to be just in the right place for the Java launcher to find the .jars .

The fix is:

  - Explicitly disable sandboxing during bootstrapping so that coincidences like this don't happen again
  - Pass a --javabase and --host_javabase option during the bootstrap build so that we don't need any symlinks to access to JVM
  - Invoke jarjar using its deploy jar instead of the launcher script.

That was fun.

--
PiperOrigin-RevId: 145083357
MOS_MIGRATED_REVID=145083357
diff --git a/scripts/bootstrap/bootstrap.sh b/scripts/bootstrap/bootstrap.sh
index 697410b..ee754f7 100755
--- a/scripts/bootstrap/bootstrap.sh
+++ b/scripts/bootstrap/bootstrap.sh
@@ -33,6 +33,9 @@
 if [ "${JAVA_VERSION}" = "1.7" ]; then
   : ${BAZEL_ARGS:=--java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain_jdk7 \
         --host_java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain_jdk7 \
+        --javabase=$JAVA_HOME \
+        --host_javabase=$JAVA_HOME \
+        --spawn_strategy=standalone \
         --nojava_header_compilation \
         --define JAVA_VERSION=1.7 --ignore_unsupported_sandboxing \
         --compilation_mode=opt \
@@ -40,6 +43,9 @@
 else
   : ${BAZEL_ARGS:=--java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain \
         --host_java_toolchain=//src/java_tools/buildjar:bootstrap_toolchain \
+        --javabase=$JAVA_HOME \
+        --host_javabase=$JAVA_HOME \
+        --spawn_strategy=standalone \
         --nojava_header_compilation \
         --strategy=Javac=worker --worker_quit_after_build --ignore_unsupported_sandboxing \
         --compilation_mode=opt \
diff --git a/src/java_tools/junitrunner/java/com/google/testing/coverage/BUILD b/src/java_tools/junitrunner/java/com/google/testing/coverage/BUILD
index 4e4b135..c43814b 100644
--- a/src/java_tools/junitrunner/java/com/google/testing/coverage/BUILD
+++ b/src/java_tools/junitrunner/java/com/google/testing/coverage/BUILD
@@ -96,11 +96,20 @@
         # freebsd; so disable there as well until a fixed version is in there as
         # well.
         # TODO(aehlig): fix and remove once a version with the fix is out.
+        #
+        # We don't invoke jarjar_bin directly because this command is invoked
+        # during bootstrapping when we don't have build-runfiles, thus no
+        # runfiles trees. The Java launcher script looks in the runfiles tree
+        # for the jars (and rightfully so), thus, invoking the binary directly
+        # won't work.
         "if [[ $$(uname -a) =~ MSYS ]] || [[ $$(uname -a) =~ freebsd ]]; then",
         "  cp \"$(location :JacocoCoverage_deploy.jar)\" \"$@\";",
         "else",
-        "  \"$(location //third_party/java/jarjar:jarjar_bin)\" process \"$(location :JacocoCoverage.jarjar)\" \"$(location :JacocoCoverage_deploy.jar)\" \"$@\"",
+        "  \"$(JAVA)\" -jar \"$(location //third_party/java/jarjar:jarjar_bin_deploy.jar)\" process \"$(location :JacocoCoverage.jarjar)\" \"$(location :JacocoCoverage_deploy.jar)\" \"$@\"",
         "fi",
     ]),
-    tools = ["//third_party/java/jarjar:jarjar_bin"],
+    tools = [
+        "//third_party/java/jarjar:jarjar_bin_deploy.jar",
+        "//tools/defaults:jdk",
+    ],
 )