diff --git a/build/toolchain/musl-host-gcc/sysroot_repository.bzl b/build/toolchain/musl-host-gcc/sysroot_repository.bzl
new file mode 100644
index 0000000..253abbf
--- /dev/null
+++ b/build/toolchain/musl-host-gcc/sysroot_repository.bzl
@@ -0,0 +1,42 @@
+#  Copyright 2020 The Monogon Project Authors.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+"""
+A generic workspace rule that extracts some subpaths from a tarball.
+
+TODO(q3k): This should maybe be moved to //build/utils and called differently.
+"""
+
+def _musl_sysroot_rule_impl(rctx):
+    rctx.extract(rctx.attr.snapshot)
+    rctx.file("BUILD.bazel", """
+filegroup(
+    name = "all",
+    srcs = glob(["include/**", "lib/**"]),
+    visibility = ["//visibility:public"],
+)
+""")
+
+
+musl_sysroot_rule = repository_rule(
+    implementation = _musl_sysroot_rule_impl,
+    attrs = {
+        "snapshot": attr.label(
+            default = Label("//build/toolchain/musl-host-gcc:sysroot.tar.xz"),
+            allow_single_file = True,
+        ),
+    },
+)