rust wrappers are non-deterministic

[finn-ball]

$ bazel clean
$ bazel build //tools/upstream_wrapper:cargo
$ shasum bazel-bin/tools/upstream_wrapper/cargo
d1d010e014b926b0ba8ed90b4776fbff34805a9f  bazel-bin/tools/upstream_wrapper/cargo

$ bazel clean
$ bazel build //tools/upstream_wrapper:cargo
$ shasum bazel-bin/tools/upstream_wrapper/cargo
7b74eedb103f95c518de237607e66e14ea4fa18c  bazel-bin/tools/upstream_wrapper/cargo

I can see the sandbox path being used inside the binary:

$ strings bazel-bin/tools/upstream_wrapper/cargo | grep "sandbox/"
/sandbox/linux-sandbox/16/execroot/_main/

# run bazel clean and build again

$ strings bazel-bin/tools/upstream_wrapper/cargo | grep "sandbox/"
/sandbox/linux-sandbox/20/execroot/_main/

This is the cause:

rules_rust/tools/upstream_wrapper/BUILD.bazel

Line 24 in f197ab8

"WRAPPED_TOOL_EXECPATH": "$(execpath {})".format(target),

I can confirm this by printing out the path inside the wrapper:

[upstream_wrapper] WRAPPED_TOOL_EXECPATH: /home/finn/.cache/bazel/_bazel_finn/6ec03a67d155658aee9b57f8ad0b7723/sandbox/linux-sandbox/27/execroot/_main/bazel-out/k8-fastbuild/bin/external/+rust+rust_linux_x86_64__x86_64-unknown-linux-gnu__stable_tools/rust_toolchain/bin/cargo

And if you check the command, this is why:

WRAPPED_TOOL_EXECPATH='${pwd}/bazel-out/k8-fastbuild/bin/external/+rust+rust_linux_x86_64__x86_64-unknown-linux-gnu__stable_tools/rust_toolchain/bin/cargo' \