Bazel maintaining hermeticity building C++ with Clang on MacOS

Question

Will preface by saying I am a beginner in bazel. I am attempting to use the newer toolchain mechanism (with --platforms) instead of the older crosstool_top mechanism. It seems the documentation (https://bazel.build/docs/cc-toolchain-config-reference) is mostly referencing the new mechanism so I've been pretty much on my own in trying to configure cc_toolchain_config properly.

I did find a tutorial that does this with gcc for a reference however: https://interrupt.memfault.com/blog/bazel-build-system-for-embedded-projects

I setup my project in a similar way grabbing the clang compiler from https://github.com/llvm/llvm-project/releases/download/llvmorg-16.0.0/clang+llvm-16.0.0-arm64-apple-darwin22.0.tar.xz to have a hermetic build. Did my best to fill-out the tool_paths and compile_flags for the cc_toolchain_config.

When trying to compile, I ran into an error: ld: library not found for -lSystem. After scouring the internet a bit, I managed to find a fix (https://github.com/darlinghq/darling/issues/167) where I had to add a library path to the linker options to /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib. My concern here is that hermeticity is now broken since I am forced to use a local path. I could not find this libSystem in the clang package anywhere.

Tried to see if I could setup the MacOS SDK in a similar way using http_archive but the download is blocked behind an Apple account.

Here is the content of my defs.bzl file:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

def install_toolchain_clang():

    http_archive(
        name = "clang",
        urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-16.0.0/clang+llvm-16.0.0-arm64-apple-darwin22.0.tar.xz"],
        strip_prefix = "clang+llvm-16.0.0-arm64-apple-darwin22.0",
        sha256 = "2041587b90626a4a87f0de14a5842c14c6c3374f42c8ed12726ef017416409d9",
        build_file = "//toolchain_clang:clang.BUILD",
    )

    native.register_toolchains(
        "@clang//:clang_toolchain",
    )

Here is the content of my clang.BUILD file:

load("@bazel_tools//tools/cpp:unix_cc_toolchain_config.bzl", "cc_toolchain_config")

cc_toolchain_config(
    name = "clang_cc_toolchain_config",
    cpu = "darwin",
    compiler = "clang",
    toolchain_identifier = "clang_toolchain",
    host_system_name = "local",
    target_system_name = "local",
    target_libc = "unknown",
    abi_version = "unknown",
    abi_libc_version = "unknown",
    tool_paths = {
        "gcc": "bin/clang",
        "g++": "bin/clang++",
        "cpp": "bin/false",
        "ar": "bin/llvm-ar",
        "nm": "bin/llvm-nm",
        "ld": "bin/lld",
        "objcopy": "bin/llvm-objcopy",
        "objdump": "bin/llvm-objdump",
        "gcov": "bin/llvm-profdata",
        "strip": "bin/false",
        "llvm-cov": "/bin/llvm-cov",
    },
    compile_flags = [
        "-isystem", "external/clang/include/c++/v1",
    ],
    link_flags = [ 
        "-L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib",
     ]
)

toolchain(
    name = "clang_toolchain",
    exec_compatible_with = [
        "@platforms//os:macos",
        "@platforms//cpu:arm64",],
    target_compatible_with = [
        "@platforms//os:macos",
        "@platforms//cpu:arm64",
    ],
    toolchain_type = "@rules_cc//cc:toolchain_type",
    toolchain = ":clang_cc_toolchain",
)


filegroup(
    name = "all",
    srcs = glob(["**/*",]),
)

cc_toolchain(
    name = "clang_cc_toolchain",
    all_files = ":all",
    ar_files = ":all",
    as_files = ":all",
    compiler_files = ":all",
    dwp_files = ":all",
    linker_files = ":all",
    objcopy_files = ":all",
    strip_files = ":all",
    dynamic_runtime_lib = ":all",
    static_runtime_lib = ":all",
    toolchain_config = ":clang_cc_toolchain_config",
)

System info: M1 Mac on Ventura 13.3.1
Bazel Version: release 6.2.1

Any help would be appreciated or pointing to where I can find out more about the parameters in cc_toolchain_config. I am not sure how to make this build process hermetic, or if I am missing an different configuration that avoids needing this linker flag