use sh_toolchain to get a truer path to bash

go/config/BUILD.bazel

@@ -39,6 +39,12 @@ bool_flag(
     visibility = ["//visibility:public"],
 )
 
+bool_flag(
+    name = "experimental_use_sh_toolchain",
+    build_setting_default = False,
+    visibility = ["//visibility:public"],
+)
+
 string_flag(
     name = "linkmode",
     build_setting_default = LINKMODE_NORMAL,

go/private/rules/BUILD.bazel

@@ -5,7 +5,10 @@ load(
     "TRANSITIONED_GO_SETTING_KEYS",
 )
 
-exports_files(["library.bzl"])
+exports_files([
+    "library.bzl",
+    "binary_wrapper.sh",
+])
 
 [
     string_setting(

go/private/rules/binary.bzl

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load(
     "//go/private:common.bzl",
     "GO_TOOLCHAIN",
@@ -574,26 +575,22 @@ exit /b %GO_EXIT_CODE%
         args.add(out)
         args.add_all(ctx.files.srcs)
 
-        # We do not use -a here as the cache drastically reduces the time spent
-        # on the second go build invocation (roughly 50% faster).
-        ctx.actions.run_shell(
-            # The value of GOCACHE/GOPATH are determined from HOME.
-            # We place them in the execroot to avoid dependency on `mktemp` and because we don't know
-            # a safe scratch space on all systems. Note that HOME must be an absolute path, otherwise the
-            # Go toolchain will write some outputs to the wrong place and the result will be uncacheable.
-            # We include an output path of this action to prevent collisions with anything else,
-            # including differently configured versions of the same target, under an unsandboxed strategy.
-            command = """
-set -eu
-export HOME="$PWD/_go_tool_binary-fake-home-${{1//\\//_}}"
-trap "{go} clean -cache" EXIT;
-{go} build -trimpath -ldflags='-buildid="" {ldflags}' -o "$1" cmd/pack
-shift
-{go} build -trimpath -ldflags='-buildid="" {ldflags}' -o "$@"
-""".format(
-                go = sdk.go.path,
-                ldflags = ctx.attr.ldflags,
-            ),
+        setting = ctx.attr._use_sh_toolchain_for_bootstrap_process_wrapper[BuildSettingInfo].value
+        sh_toolchain = ctx.toolchains["@bazel_tools//tools/sh:toolchain_type"]
+        binary_wrapper = ctx.file._binary_wrapper
+        if setting and sh_toolchain:
+            binary_wrapper = ctx.actions.declare_file(name + "_binary_wrapper.sh")
+            ctx.actions.expand_template(
+                template = ctx.file._binary_wrapper,
+                output = binary_wrapper,
+                is_executable = True,
+                substitutions = {
+                    "#!/usr/bin/env bash": "#!{}".format(sh_toolchain.path),
+                },
+            )
+
+        ctx.actions.run(
+            executable = binary_wrapper,
             arguments = [args],
             tools = [sdk.go],
             env = {
@@ -602,6 +599,8 @@ shift
                 "GO111MODULE": "off",
                 "GOTELEMETRY": "off",
                 "GOENV": "off",
+                "GO_BINARY": sdk.go.path,
+                "LD_FLAGS": ctx.attr.ldflags,
             },
             inputs = depset(
                 ctx.files.srcs,
@@ -634,6 +633,13 @@ go_tool_binary = rule(
             doc = "Raw value to pass to go build via -ldflags without tokenization",
         ),
         "out_pack": attr.output(),
+        "_binary_wrapper": attr.label(
+            allow_single_file = True,
+            default = "//go/private/rules:binary_wrapper.sh",
+        ),
+        "_use_sh_toolchain_for_bootstrap_process_wrapper": attr.label(
+            default = Label("//go/config:experimental_use_sh_toolchain"),
+        ),
     },
     executable = True,
     doc = """Used instead of go_binary for executables used in the toolchain.
@@ -648,6 +654,7 @@ rules_go as well as the `pack` tool provided by the Go SDK in source form
 only as of Go 1.25. Combining both builds into a single action drastically
 reduces the overall build time due to Go's own caching mechanism.
 """,
+    toolchains = [config_common.toolchain_type("@bazel_tools//tools/sh:toolchain_type", mandatory = False)],
 )
 
 def gc_linkopts(ctx):

go/private/rules/binary_wrapper.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -eu
+
+# The value of GOCACHE/GOPATH are determined from HOME.
+# We place them in the execroot to avoid dependency on `mktemp` and because we don't know
+# a safe scratch space on all systems. Note that HOME must be an absolute path, otherwise the
+# Go toolchain will write some outputs to the wrong place and the result will be uncacheable.
+# We include an output path of this action to prevent collisions with anything else,
+# including differently configured versions of the same target, under an unsandboxed strategy.
+
+export HOME="${PWD}/_go_tool_binary-fake-home-${1//\\//_}"
+trap "${GO_BINARY} clean -cache" EXIT
+
+# We do not use -a here as the cache drastically reduces the time spent
+# on the second go build invocation (roughly 50% faster).
+
+"${GO_BINARY}" build -trimpath -ldflags="-buildid=\"\" ${LD_FLAGS}" -o "$1" cmd/pack
+shift
+
+"${GO_BINARY}" build -trimpath -ldflags="-buildid=\"\" ${LD_FLAGS}" -o "$@"