Suppress goroot path in tool builds

The goroot is encoded in the output binary, but the goroot is different
in different workspaces. As a result tool binaries (such as builder) are
not reproducible. Bazel will have cache misses for build involving
builder even if the resulting output from the build is repoducible.

Similar go_binary builds, suppress the goroot path.

go/private/rules/binary.bzl

@@ -235,6 +235,7 @@ def _go_tool_binary_impl(ctx):
         arguments = [largs],
         inputs = sdk.libs + sdk.headers + sdk.tools + [cout],
         outputs = [out],
+        env = {"GOROOT_FINAL": "GOROOT"},  # Suppress go root paths to keep the output reproducible.
         mnemonic = "GoToolchainBinary",
     )
 

tests/integration/reproducibility/reproducibility_test.go

@@ -21,6 +21,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -215,6 +216,23 @@ func Test(t *testing.T) {
 	if err := compareHashes(dirHashes[0], dirHashes[2]); err == nil {
 		t.Fatalf("dir0 and dir2 are the same)", len(dirHashes[0]))
 	}
+
+	// Check that the go_sdk path doesn't appear in the builder binary. This path is different
+	// nominally different per workspace (but in these tests, the go_sdk paths are all set to the same
+	// path in WORKSPACE) -- so if this path is in the builder binary, then builds between workspaces
+	// would be partially non cacheable.
+	builder_file, err := os.Open(filepath.Join(dirs[0], "bazel-out", "host", "bin", "external", "go_sdk", "builder"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer builder_file.Close()
+	builder_data, err := ioutil.ReadAll(builder_file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Index(builder_data, []byte("go_sdk")) != -1 {
+		t.Fatalf("Found go_sdk path in builder binary, builder tool won't be reproducible")
+	}
 }
 
 func copyTree(dstRoot, srcRoot string) error {