Sandbox libxml2 and switch clang to zstd compression

When trying to execute clang on a very very fresh Debian image, it can't
find libxml2.  Sandbox that too.

While we are here, zstd images extract faster than xz.  Switch over.

Change-Id: Ia196ae49223b488f5eabe28b67e6f274b3072795
Signed-off-by: Austin Schuh <austin.linux@gmail.com>
diff --git a/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl b/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
index 6be2fbb..e575191 100644
--- a/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
+++ b/third_party/bazel-toolchain/toolchain/cc_wrapper.sh.tpl
@@ -32,6 +32,7 @@
 
 # Call the C++ compiler.
 if [[ -f %{toolchain_path_prefix}bin/clang ]]; then
+  export LD_LIBRARY_PATH=external/llvm_toolchain/llvm/lib/
   exec %{toolchain_path_prefix}bin/clang "$@"
 elif [[ "${BASH_SOURCE[0]}" == "/"* ]]; then
   # Some consumers of `CcToolchainConfigInfo` (e.g. `cmake` from rules_foreign_cc)
@@ -41,6 +42,7 @@
   # This script is at _execroot_/external/_repo_name_/bin/clang_wrapper.sh
   execroot_path="${BASH_SOURCE[0]%/*/*/*/*}"
   clang="${execroot_path}/%{toolchain_path_prefix}bin/clang"
+  export LD_LIBRARY_PATH="${execroot_path}/external/llvm_toolchain/llvm/lib/"
   exec "${clang}" "${@}"
 else
   >&2 echo "ERROR: could not find clang; PWD=\"$(pwd)\"; PATH=\"${PATH}\"."
diff --git a/third_party/bazel-toolchain/toolchain/internal/llvm_distributions.bzl b/third_party/bazel-toolchain/toolchain/internal/llvm_distributions.bzl
index a6b6f5c..57f8bf6 100644
--- a/third_party/bazel-toolchain/toolchain/internal/llvm_distributions.bzl
+++ b/third_party/bazel-toolchain/toolchain/internal/llvm_distributions.bzl
@@ -309,6 +309,7 @@
     "clang+llvm-17.0.2-sparc64-unknown-linux-gnu.tar.xz": "950d1ef440f17e29c4201450ad619d3b4a37a0bbf15f19ce03195e0b4da7d73f",
     "clang+llvm-17.0.2-sparcv9-sun-solaris2.11.tar.xz": "3702914668b5758817374271fa8a41fe67c77b2e86f17706c9d6906f250de6ae",
     "clang+llvm-17.0.2-x86_64-linux-gnu-ubuntu-22.04.tar.xz": "df297df804766f8fb18f10a188af78e55d82bb8881751408c2fa694ca19163a8",
+    "clang+llvm-17.0.2-x86_64-linux-gnu-ubuntu-22.04.tar.zst": "f2eec88faa0036ae2af03af26bd7cb5c6cb0223659b1d7d33739aa9008af5964",
 }
 
 # Note: Unlike the user-specified llvm_mirror attribute, the URL prefixes in
@@ -396,9 +397,14 @@
             urls.append(pattern.format(llvm_version = llvm_version, basename = basename))
     urls.append("{0}{1}".format(_llvm_distributions_base_url[llvm_version], url_suffix))
 
+    if basename.endswith(".tar.zst"):
+        stripPrefix = basename[:(len(basename) - len(".tar.zst"))]
+    else:
+        stripPrefix = basename[:(len(basename) - len(".tar.xz"))]
+
     rctx.download_and_extract(
         urls,
         sha256 = _llvm_distributions[basename],
-        stripPrefix = basename[:(len(basename) - len(".tar.xz"))],
+        stripPrefix = stripPrefix,
         auth = _get_auth(rctx, urls),
     )
diff --git a/third_party/bazel-toolchain/toolchain/internal/repo.bzl b/third_party/bazel-toolchain/toolchain/internal/repo.bzl
index bf23558..9a84922 100644
--- a/third_party/bazel-toolchain/toolchain/internal/repo.bzl
+++ b/third_party/bazel-toolchain/toolchain/internal/repo.bzl
@@ -41,9 +41,21 @@
     if os == "linux":
         if arch == "x86_64":
             rctx.symlink(
-                Label("@libtinfo5_amd64//lib/x86_64-linux-gnu:libtinfo.so.5.9"),
+              Label("@clang_amd64_deps//:lib/x86_64-linux-gnu/libtinfo.so.5.9"),
                 "lib/libtinfo.so.5.9",
             )
+            rctx.symlink(
+              Label("@clang_amd64_deps//:usr/lib/x86_64-linux-gnu/libxml2.so.2.9.14"),
+                "lib/libxml2.so.2.9.14",
+            )
+            rctx.symlink("lib/libxml2.so.2.9.14", "lib/libxml2.so.2")
+
+            for lib in ["libicudata", "libicuuc"]:
+                rctx.symlink(
+                  Label("@clang_amd64_deps//:usr/lib/x86_64-linux-gnu/" + lib + ".so.72.1"),
+                    "lib/" + lib + ".so.72.1",
+                )
+                rctx.symlink("lib/" + lib + ".so.72.1", "lib/" + lib + ".so.72")
         elif arch == "aarch64":
             rctx.symlink(
                 Label("@libtinfo5_arm64//lib/aarch64-linux-gnu:libtinfo.so.5.9"),