Remove runc submodule

.gitmodules

@@ -46,10 +46,6 @@
 	path = src/gopath/src/code.cloudfoundry.org/archiver
 	url = https://github.com/cloudfoundry/archiver
 	branch = master
-[submodule "src/gopath/src/github.com/opencontainers/runc"]
-	path = src/gopath/src/github.com/opencontainers/runc
-	url = https://github.com/opencontainers/runc
-	branch = master
 [submodule "src/idmapper"]
 	path = src/idmapper
 	url = https://github.com/cloudfoundry/idmapper

ci/helpers/build-binaries.bash

@@ -3,7 +3,7 @@ function build_runc() {
   local target="$2"
 
   (
-    cd "${release}/src/gopath/src/github.com/opencontainers/runc" || exit
+    cd "${release}/src/guardian/vendor/github.com/opencontainers/runc" || exit
 
     make BUILDTAGS='seccomp apparmor' static
     mv runc "${target}"

packages/containerd/spec

@@ -502,6 +502,7 @@ files:
   - guardian/vendor/golang.org/x/sys/internal/unsafeheader/*.go # gosub
   - guardian/vendor/golang.org/x/sys/unix/*.go # gosub
   - guardian/vendor/golang.org/x/sys/unix/*.s # gosub
+  - guardian/vendor/golang.org/x/sys/unix/*.c # gosub
   - guardian/vendor/golang.org/x/sys/windows/*.go # gosub
   - guardian/vendor/golang.org/x/sys/windows/*.s # gosub
   - guardian/vendor/golang.org/x/sys/windows/registry/*.go # gosub

packages/gats/spec

@@ -131,6 +131,7 @@ files:
   - garden-integration-tests/vendor/golang.org/x/sys/internal/unsafeheader/*.go # gosub
   - garden-integration-tests/vendor/golang.org/x/sys/unix/*.go # gosub
   - garden-integration-tests/vendor/golang.org/x/sys/unix/*.s # gosub
+  - garden-integration-tests/vendor/golang.org/x/sys/unix/*.c # gosub
   - garden-integration-tests/vendor/golang.org/x/sys/windows/*.go # gosub
   - garden-integration-tests/vendor/golang.org/x/sys/windows/*.s # gosub
   - garden-integration-tests/vendor/golang.org/x/text/encoding/*.go # gosub

packages/gpats/spec

@@ -75,6 +75,7 @@ files:
   - garden-performance-acceptance-tests/vendor/golang.org/x/sys/internal/unsafeheader/*.go # gosub
   - garden-performance-acceptance-tests/vendor/golang.org/x/sys/unix/*.go # gosub
   - garden-performance-acceptance-tests/vendor/golang.org/x/sys/unix/*.s # gosub
+  - garden-performance-acceptance-tests/vendor/golang.org/x/sys/unix/*.c # gosub
   - garden-performance-acceptance-tests/vendor/golang.org/x/text/encoding/*.go # gosub
   - garden-performance-acceptance-tests/vendor/golang.org/x/text/encoding/charmap/*.go # gosub
   - garden-performance-acceptance-tests/vendor/golang.org/x/text/encoding/htmlindex/*.go # gosub

packages/runc/packaging

@@ -7,15 +7,15 @@ export PKG_CONFIG_PATH=/var/vcap/packages/libseccomp/lib/pkgconfig
 export PATH=/var/vcap/packages/pkg-config/bin/:$PATH
 
 mkdir -p "${BOSH_INSTALL_TARGET}/src"
-mv gopath/src/* "${BOSH_INSTALL_TARGET}/src"
-mv "${BOSH_INSTALL_TARGET}/src" .
+mv * ${BOSH_INSTALL_TARGET}/src
+mv ${BOSH_INSTALL_TARGET}/src .
 
 source /var/vcap/packages/golang-*-linux/bosh/compile.env
 
 mkdir -p "${BOSH_INSTALL_TARGET}/bin"
 export GOBIN="${BOSH_INSTALL_TARGET}/bin"
 
-pushd src/github.com/opencontainers/runc
+pushd src/guardian/vendor/github.com/opencontainers/runc
   make BUILDTAGS='seccomp apparmor' static
   cp runc "${GOBIN}/runc"
 popd

packages/runc/spec

@@ -7,4 +7,107 @@ dependencies:
   - pkg-config
 
 files:
-  - gopath/src/github.com/opencontainers/runc/**/*
+  - guardian/go.mod
+  - guardian/go.sum
+  - guardian/vendor/modules.txt
+  - guardian/vendor/github.com/bits-and-blooms/bitset/*.go # gosub
+  - guardian/vendor/github.com/bits-and-blooms/bitset/*.s # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/*.go # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/Makefile # gosub
+  - guardian/vendor/github.com/cilium/ebpf/asm/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/internal/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/internal/btf/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/internal/unix/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/link/*.go # gosub
+  - guardian/vendor/github.com/containerd/console/*.go # gosub
+  - guardian/vendor/github.com/coreos/go-systemd/v22/activation/*.go # gosub
+  - guardian/vendor/github.com/coreos/go-systemd/v22/dbus/*.go # gosub
+  - guardian/vendor/github.com/cpuguy83/go-md2man/v2/md2man/*.go # gosub
+  - guardian/vendor/github.com/cyphar/filepath-securejoin/*.go # gosub
+  - guardian/vendor/github.com/docker/go-units/*.go # gosub
+  - guardian/vendor/github.com/godbus/dbus/v5/*.go # gosub
+  - guardian/vendor/github.com/moby/sys/mountinfo/*.go # gosub
+  - guardian/vendor/github.com/mrunalp/fileutils/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/Makefile # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/apparmor/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/capabilities/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/devices/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/devicefilter/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/manager/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/systemd/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/configs/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/devices/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/keys/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/logs/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/nsenter/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/nsenter/*.h # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/nsenter/*.c # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/seccomp/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/specconv/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/system/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/user/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/userns/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/utils/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/types/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/types/features/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runtime-spec/specs-go/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/selinux/go-selinux/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/selinux/go-selinux/label/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/selinux/pkg/pwalk/*.go # gosub
+  - guardian/vendor/github.com/pkg/errors/*.go # gosub
+  - guardian/vendor/github.com/pkg/errors/Makefile # gosub
+  - guardian/vendor/github.com/russross/blackfriday/v2/*.go # gosub
+  - guardian/vendor/github.com/seccomp/libseccomp-golang/*.go # gosub
+  - guardian/vendor/github.com/seccomp/libseccomp-golang/Makefile # gosub
+  - guardian/vendor/github.com/sirupsen/logrus/*.go # gosub
+  - guardian/vendor/github.com/syndtr/gocapability/capability/*.go # gosub
+  - guardian/vendor/github.com/urfave/cli/*.go # gosub
+  - guardian/vendor/github.com/vishvananda/netlink/*.go # gosub
+  - guardian/vendor/github.com/vishvananda/netlink/Makefile # gosub
+  - guardian/vendor/github.com/vishvananda/netlink/nl/*.go # gosub
+  - guardian/vendor/github.com/vishvananda/netns/*.go # gosub
+  - guardian/vendor/golang.org/x/net/bpf/*.go # gosub
+  - guardian/vendor/golang.org/x/sys/internal/unsafeheader/*.go # gosub
+  - guardian/vendor/golang.org/x/sys/unix/*.go # gosub
+  - guardian/vendor/golang.org/x/sys/unix/*.s # gosub
+  - guardian/vendor/golang.org/x/sys/unix/*.c # gosub
+  - guardian/vendor/golang.org/x/sys/windows/*.go # gosub
+  - guardian/vendor/golang.org/x/sys/windows/*.s # gosub
+  - guardian/vendor/google.golang.org/protobuf/encoding/prototext/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/encoding/protowire/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/descfmt/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/descopts/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/detrand/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/encoding/defval/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/encoding/messageset/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/encoding/tag/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/encoding/text/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/errors/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/filedesc/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/filetype/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/flags/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/genid/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/impl/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/order/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/pragma/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/set/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/strs/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/internal/version/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/proto/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/reflect/protoreflect/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/reflect/protoregistry/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/runtime/protoiface/*.go # gosub
+  - guardian/vendor/google.golang.org/protobuf/runtime/protoimpl/*.go # gosub

scripts/sync-package-specs

@@ -38,6 +38,9 @@ function sync_package() {
         if ls ../../src/${package}/*.h >/dev/null 2>&1; then
           echo ${package} | sed -e 's/\(.*\)/  - \1\/*.h # gosub/g'
         fi
+        if ls ../../src/${package}/*.c >/dev/null 2>&1; then
+          echo ${package} | sed -e 's/\(.*\)/  - \1\/*.c # gosub/g'
+        fi
         if ls ../../src/${package}/Makefile >/dev/null 2>&1; then
           echo ${package} | sed -e 's/\(.*\)/  - \1\/Makefile # gosub/g'
         fi
@@ -55,6 +58,9 @@ BUILD_FLAGS="--tags cgo,no_btrfs" sync_package containerd guardian \
   -app github.com/containerd/containerd/cmd/containerd-shim-runc-v1 \
   -app github.com/containerd/containerd/cmd/containerd-shim-runc-v2 &
 
+BUILD_FLAGS="--tags cgo,seccomp,apparmor" sync_package runc guardian \
+  -app github.com/opencontainers/runc &
+
 sync_package gats garden-integration-tests -app github.com/onsi/ginkgo/ginkgo \
   -test code.cloudfoundry.org/garden-integration-tests/... &