cc_configure: use the wrapper only if on Darwin and ship the environment only if in homebrew

This will fix the sandboxing issues for rules_rust and rules_go while still allowing to build inside homebrew.

Should unblock #1238

Fixes bazelbuild/rules_go#20.
Fixes bazelbuild/rules_rust#4.

Tested under homebrew + classic tests.

--
MOS_MIGRATED_REVID=121834186

tools/cpp/BUILD.tpl

diff --git a/tools/cpp/BUILD.tpl b/tools/cpp/BUILD.tpl
index b7f5dd0..921e93a 100644
--- a/tools/cpp/BUILD.tpl
+++ b/tools/cpp/BUILD.tpl
@@ -31,12 +31,12 @@
 
 cc_toolchain(
     name = "cc-compiler-%{name}",
-    all_files = ":cc_wrapper",
-    compiler_files = ":cc_wrapper",
+    all_files = "%{cc_compiler_deps}",
+    compiler_files = "%{cc_compiler_deps}",
     cpu = "local",
     dwp_files = ":empty",
     dynamic_runtime_libs = [":empty"],
-    linker_files = ":cc_wrapper",
+    linker_files = "%{cc_compiler_deps}",
     objcopy_files = ":empty",
     static_runtime_libs = [":empty"],
     strip_files = ":empty",

tools/cpp/cc_configure.bzl

diff --git a/tools/cpp/cc_configure.bzl b/tools/cpp/cc_configure.bzl
index 18b8130..7f33475 100644
--- a/tools/cpp/cc_configure.bzl
+++ b/tools/cpp/cc_configure.bzl
@@ -50,7 +50,7 @@
   return default if result == None else str(result)
 
 
-def _get_tool_paths(repository_ctx, darwin):
+def _get_tool_paths(repository_ctx, darwin, cc):
   """Compute the path to the various tools."""
   return {k: _which(repository_ctx, k, "/usr/bin/" + k)
           for k in [
@@ -63,7 +63,7 @@
               "objdump",
               "strip",
           ]} + {
-              "gcc": "cc_wrapper.sh",
+              "gcc": cc,
               "ar": "/usr/bin/libtool"
                     if darwin else _which(repository_ctx, "ar", "/usr/bin/ar")
           }
@@ -299,13 +299,16 @@
 
 
 def _get_env(repository_ctx):
-  """Convert the environment in a list of export."""
+  """Convert the environment in a list of export if in Homebrew."""
   env = repository_ctx.os.environ
-  return "\n".join([
-      "export %s='%s'" % (k, env[k].replace("'", "'\\''"))
-      for k in env
-      if k != "_" and k.find(".") == -1
-  ])
+  if "HOMEBREW_RUBY_PATH" in env:
+    return "\n".join([
+        "export %s='%s'" % (k, env[k].replace("'", "'\\''"))
+        for k in env
+        if k != "_" and k.find(".") == -1
+    ])
+  else:
+    return ""
 
 def _impl(repository_ctx):
   repository_ctx.file("tools/cpp/empty.cc")
@@ -322,14 +325,15 @@
   else:
     darwin = cpu_value == "darwin"
     cc = _find_cc(repository_ctx)
-    darwin = cpu_value == "darwin"
-    tool_paths = _get_tool_paths(repository_ctx, darwin)
+    tool_paths = _get_tool_paths(repository_ctx, darwin,
+                                 "cc_wrapper.sh" if darwin else str(cc))
     crosstool_content = _crosstool_content(repository_ctx, cc, cpu_value, darwin)
     opt_content = _opt_content(darwin)
     dbg_content = _dbg_content()
     _tpl(repository_ctx, "BUILD", {
         "%{name}": cpu_value,
-        "%{supports_param_files}": "0" if darwin else "1"
+        "%{supports_param_files}": "0" if darwin else "1",
+        "%{cc_compiler_deps}": ":cc_wrapper" if darwin else ":empty",
     })
     _tpl(repository_ctx,
         "osx_cc_wrapper.sh" if darwin else "linux_cc_wrapper.sh",