An excellent idea implemented by @curved-television-6568 to improve hermeticity + cache hits: after we find the particular binaries like

/usr/bin/zip

, create a shim that symlinks to the specific binaries so we can set

PATH=/path/to/shim

rather than

PATH=/usr/bin

(leaking everything in there). Thank you! https://github.com/pantsbuild/pants/pull/14374