third_party/nix: introduce toolchain bundle

This introduces a nix derivation that builds a musl amd64/aarch64
toolchain sysroot.

Change-Id: Iba082edb8fd1f2ab580020bb1c7339a76487f3c8
Reviewed-on: https://review.monogon.dev/c/monogon/+/4006
Reviewed-by: Lorenz Brun <lorenz@monogon.tech>
Tested-by: Jenkins CI
diff --git a/third_party/nix/pkgs/bazel/BUILD.bazel b/third_party/nix/pkgs/bazel/BUILD.bazel
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/nix/pkgs/bazel/BUILD.bazel
diff --git a/third_party/nix/pkgs/bazel/bazel-inner.sh b/third_party/nix/pkgs/bazel/bazel-inner.sh
new file mode 100755
index 0000000..7b978bc
--- /dev/null
+++ b/third_party/nix/pkgs/bazel/bazel-inner.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/bash
+function get_workspace_root() {
+  workspace_dir="${PWD}"
+  while [[ "${workspace_dir}" != / ]]; do
+    if [[ -e "${workspace_dir}/WORKSPACE" || -e "${workspace_dir}/WORKSPACE.bazel" || -e "${workspace_dir}/MODULE.bazel" ]]; then
+      readonly workspace_dir
+      return
+    fi
+    workspace_dir="$(dirname "${workspace_dir}")"
+  done
+  readonly workspace_dir=""
+}
+
+get_workspace_root
+readonly wrapper="${workspace_dir}/tools/bazel"
+if [ -f "${wrapper}" ]; then
+  exec -a "$0" "${wrapper}" "$@"
+fi
+exec -a "$0" "${BAZEL_REAL}" "$@"
diff --git a/third_party/nix/pkgs/bazel/default.nix b/third_party/nix/pkgs/bazel/default.nix
new file mode 100644
index 0000000..0b6ba7e
--- /dev/null
+++ b/third_party/nix/pkgs/bazel/default.nix
@@ -0,0 +1,24 @@
+{ pkgs }: with pkgs;
+stdenv.mkDerivation {
+  name = "bazel";
+  src = builtins.fetchurl {
+    url = "https://github.com/bazelbuild/bazel/releases/download/8.1.0/bazel-8.1.0-linux-x86_64";
+    sha256 = "19dwgh631d6c1m4ds1b1b3pbz18zm5i0x8bggjgsc04fyljfbfml";
+  };
+  unpackPhase = ''
+    true
+  '';
+  nativeBuildInputs = [ makeWrapper ];
+  buildPhase = ''
+    mkdir -p $out/bin
+    cp $src $out/bin/.bazel-inner
+    chmod +x $out/bin/.bazel-inner
+
+    cp ${./bazel-inner.sh} $out/bin/bazel
+    chmod +x $out/bin/bazel
+
+    # Use wrapProgram to set the actual bazel path
+    wrapProgram $out/bin/bazel --set BAZEL_REAL $out/bin/.bazel-inner
+  '';
+  dontStrip = true;
+}