go_download_sdk: work around Bazel .tar.gz extraction bug (#2836)

Use 'tar' installed on the system to extract .tar.gz archives instead
of Bazel's download_and_extract. Go has at least one test with an
invalid unicode file name, and on some configurations (macOS + Docker
+ some particular file system binding?), this causes an error.

Fixes #2771

go/private/sdk.bzl

@@ -177,11 +177,30 @@ def _remote_sdk(ctx, urls, strip_prefix, sha256):
     if len(urls) == 0:
         fail("no urls specified")
     ctx.report_progress("Downloading and extracting Go toolchain")
-    ctx.download_and_extract(
-        url = urls,
-        stripPrefix = strip_prefix,
-        sha256 = sha256,
-    )
+    if urls[0].endswith(".tar.gz"):
+        # BUG(#2771): Use a system tool to extract the archive instead of
+        # Bazel's implementation. With some configurations (macOS + Docker +
+        # some particular file system binding), Bazel's implementation rejects
+        # files with invalid unicode names. Go has at least one test case with a
+        # file like this, but we haven't been able to reproduce the failure, so
+        # instead, we use this workaround.
+        if strip_prefix != "go":
+            fail("strip_prefix not supported")
+        ctx.download(
+            url = urls,
+            sha256 = sha256,
+            output = "go_sdk.tar.gz",
+        )
+        res = ctx.execute(["tar", "-xf", "go_sdk.tar.gz", "--strip-components=1"])
+        if res.return_code:
+            fail("error extracting Go SDK:\n" + res.stdout + res.stderr)
+        ctx.delete("go_sdk.tar.gz")
+    else:
+        ctx.download_and_extract(
+            url = urls,
+            stripPrefix = strip_prefix,
+            sha256 = sha256,
+        )
 
 def _local_sdk(ctx, path):
     for entry in ["src", "pkg", "bin"]: