What happened?

With a custom --repo_env=PATH=... in the bazelrc, rules_aws will fail to find pkgutil and thus failed to install the CLI.

Version

rules_aws 0.4.0 with bzlmod enabled

How to reproduce

1. Add rules_aws to MODULE.bazel
2. Build a rule that uses rules_aws with `--repo_env=PATH=/bin:/usr/bin`
3. See failure to invoke pkgutil.

Any other information?

Since pkgutil is under system integrity protection and is guaranteed to be located in /usr/sbin, the repo rule should directly invoke pkgutil in that location instead of relying on PATH available to repo env.