···11+diff --git a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
22+index 6fff2af..7e2877e 100644
33+--- a/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
44++++ b/src/main/java/com/google/devtools/build/lib/exec/local/PosixLocalEnvProvider.java
55+@@ -47,6 +47,16 @@ public final class PosixLocalEnvProvider implements LocalEnvProvider {
66+ Map<String, String> env, BinTools binTools, String fallbackTmpDir) {
77+ ImmutableMap.Builder<String, String> result = ImmutableMap.builder();
88+ result.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
99++
1010++ // In case we are running on NixOS.
1111++ // If bash is called with an unset PATH on this platform,
1212++ // it will set it to /no-such-path and default tools will be missings.
1313++ // See, https://github.com/NixOS/nixpkgs/issues/94222
1414++ // So we ensure that minimal dependencies are present.
1515++ if (!env.containsKey("PATH")){
1616++ result.put("PATH", "@actionsPathPatch@");
1717++ }
1818++
1919+ String p = clientEnv.get("TMPDIR");
2020+ if (Strings.isNullOrEmpty(p)) {
2121+ // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
2222+index 95642767c6..39d3c62461 100644
2323+--- a/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
2424++++ b/src/main/java/com/google/devtools/build/lib/exec/local/XcodeLocalEnvProvider.java
2525+@@ -74,6 +74,16 @@ public final class XcodeLocalEnvProvider implements LocalEnvProvider {
2626+2727+ ImmutableMap.Builder<String, String> newEnvBuilder = ImmutableMap.builder();
2828+ newEnvBuilder.putAll(Maps.filterKeys(env, k -> !k.equals("TMPDIR")));
2929++
3030++ // In case we are running on NixOS.
3131++ // If bash is called with an unset PATH on this platform,
3232++ // it will set it to /no-such-path and default tools will be missings.
3333++ // See, https://github.com/NixOS/nixpkgs/issues/94222
3434++ // So we ensure that minimal dependencies are present.
3535++ if (!env.containsKey("PATH")){
3636++ newEnvBuilder.put("PATH", "@actionsPathPatch@");
3737++ }
3838++
3939+ String p = clientEnv.get("TMPDIR");
4040+ if (Strings.isNullOrEmpty(p)) {
4141+ // Do not use `fallbackTmpDir`, use `/tmp` instead. This way if the user didn't export TMPDIR
···11+#!/usr/bin/env python3
22+import sys
33+import json
44+55+if len(sys.argv) != 2:
66+ print("usage: ./this-script src-deps.json < WORKSPACE", file=sys.stderr)
77+ print("Takes the bazel WORKSPACE file and reads all archives into a json dict (by evaling it as python code)", file=sys.stderr)
88+ print("Hail Eris.", file=sys.stderr)
99+ sys.exit(1)
1010+1111+http_archives = []
1212+1313+# just the kw args are the dict { name, sha256, urls … }
1414+def http_archive(**kw):
1515+ http_archives.append(kw)
1616+# like http_file
1717+def http_file(**kw):
1818+ http_archives.append(kw)
1919+2020+# this is inverted from http_archive/http_file and bundles multiple archives
2121+def _distdir_tar(**kw):
2222+ for archive_name in kw['archives']:
2323+ http_archives.append({
2424+ "name": archive_name,
2525+ "sha256": kw['sha256'][archive_name],
2626+ "urls": kw['urls'][archive_name]
2727+ })
2828+2929+# TODO?
3030+def git_repository(**kw):
3131+ print(json.dumps(kw, sort_keys=True, indent=4), file=sys.stderr)
3232+ sys.exit(1)
3333+3434+# execute the WORKSPACE like it was python code in this module,
3535+# using all the function stubs from above.
3636+exec(sys.stdin.read())
3737+3838+# transform to a dict with the names as keys
3939+d = { el['name']: el for el in http_archives }
4040+4141+def has_urls(el):
4242+ return ('url' in el and el['url']) or ('urls' in el and el['urls'])
4343+def has_sha256(el):
4444+ return 'sha256' in el and el['sha256']
4545+bad_archives = list(filter(lambda el: not has_urls(el) or not has_sha256(el), d.values()))
4646+if bad_archives:
4747+ print('Following bazel dependencies are missing url or sha256', file=sys.stderr)
4848+ print('Check bazel sources for master or non-checksummed dependencies', file=sys.stderr)
4949+ for el in bad_archives:
5050+ print(json.dumps(el, sort_keys=True, indent=4), file=sys.stderr)
5151+ sys.exit(1)
5252+5353+with open(sys.argv[1], "w") as f:
5454+ print(json.dumps(d, sort_keys=True, indent=4), file=f)