I've been investigating the vendorized dependencies in runc and below you can find my notes so far:

# RunC - vendorized dependencies

## Summary:

- Total of 17 vendorized deps
    + None of them has a correspondent package in main
- 1 vendorized deps without correspondent package in the archive
- 5 vendorized deps match version with packages in universe
- 3 vendorized deps with version greater than the correspondent package in
  universe
    + Those packages might need update
- 8 vendorized deps with version lower than the correspondent package in
  universe

## Build information about Go executables

The runc package (1.0.0~rc8+git20190923.3e425f80) was rebuilt (go build -tags
"seccomp") with Go 1.13 and the command bellow was executed to get information
about embedded modules of each executable:

~/go/src/github.com/opencontainers/runc$ go version -m ./runc
./runc: go1.13.4
	path	github.com/opencontainers/runc
	mod	github.com/opencontainers/runc	(devel)	
	dep	github.com/checkpoint-restore/go-criu	v0.0.0-20181120144056-17b0214f6c48	h1:AQMF0Xixllgf29MKlx/TGEhRk7bEDX5kxz8Ui8lOvEs=
	dep	github.com/containerd/console	v0.0.0-20181022165439-0650fd9eeb50	h1:WMpHmC6AxwWb9hMqhudkqG7A/p14KiMnl6d3r1iUMjU=
	dep	github.com/coreos/go-systemd	v0.0.0-20190321100706-95778dfbb74e	h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
	dep	github.com/cyphar/filepath-securejoin	v0.2.2	h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg=
	dep	github.com/docker/go-units	v0.3.3	h1:Xk8S3Xj5sLGlG5g67hJmYMmUgXv5N4PhkjJHHqrwnTk=
	dep	github.com/godbus/dbus	v0.0.0-20181101234600-2ff6f7ffd60f	h1:zlOR3rOlPAVvtfuxGKoghCmop5B0TRyu/ZieziZuGiM=
	dep	github.com/golang/protobuf	v1.0.0	h1:lsek0oXi8iFE9L+EXARyHIjU5rlWIhhTkjDz3vHhWWQ=
	dep	github.com/mrunalp/fileutils	v0.0.0-20171103030105-7d4729fb3618	h1:7InQ7/zrOh6SlFjaXFubv0xX0HsuC9qJsdqm7bNQpYM=
	dep	github.com/opencontainers/runtime-spec	v1.0.2-0.20190207185410-29686dbc5559	h1:Cef96rKLuXxeGzERI/0ve9yAzIeTpx0qz9JKFDZALYw=
	dep	github.com/opencontainers/selinux	v1.2.2	h1:Kx9J6eDG5/24A6DtUquGSpJQ+m2MUTahn4FtGEe8bFg=
	dep	github.com/pkg/errors	v0.8.1	h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
	dep	github.com/seccomp/libseccomp-golang	v0.9.1	h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo=
	dep	github.com/sirupsen/logrus	v1.4.1	h1:GL2rEmy6nsikmW0r8opw9JIRScdMF5hA8cOYLH7In1k=
	dep	github.com/syndtr/gocapability	v0.0.0-20180916011248-d98352740cb2	h1:b6uOv7YOFK0TYG7HtkIgExQo+2RdLuwRft63jn2HWj8=
	dep	github.com/urfave/cli	v1.20.0	h1:fDqGv3UG/4jbVl/QkFwEdddtEDjh/5Ov6X+0B/3bPaw=
	dep	github.com/vishvananda/netlink	v0.0.0-20150820014904-1e2e08e8a2dc	h1:0HAHLwEY4k1VqaO1SzBi4XxT0KA06Cv+QW2LXknBk9g=
	dep	golang.org/x/sys	v0.0.0-20190812073006-9eafafc0a87e	h1:TsjK5I7fXk8f2FQrgu6NS7i5Qih3knl2FL1htyguLRE=


~/go/src/github.com/opencontainers/runc/contrib/cmd/recvtty$ go version -m ./recvtty
./recvtty: go1.13.4
	path	github.com/opencontainers/runc/contrib/cmd/recvtty
	mod	github.com/opencontainers/runc	(devel)	
	dep	github.com/containerd/console	v0.0.0-20181022165439-0650fd9eeb50	h1:WMpHmC6AxwWb9hMqhudkqG7A/p14KiMnl6d3r1iUMjU=
	dep	github.com/urfave/cli	v1.20.0	h1:fDqGv3UG/4jbVl/QkFwEdddtEDjh/5Ov6X+0B/3bPaw=
	dep	golang.org/x/sys	v0.0.0-20190812073006-9eafafc0a87e	h1:TsjK5I7fXk8f2FQrgu6NS7i5Qih3knl2FL1htyguLRE=


~/go/src/github.com/opencontainers/runc$ go mod graph
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
github.com/opencontainers/runc <email address hidden>
<email address hidden> <email address hidden>
<email address hidden> <email address hidden>
<email address hidden> <email address hidden>
<email address hidden> <email address hidden>
<email address hidden> <email address hidden>
<email address hidden> <email address hidden>


## Details per dependency

Each of these dependencies were obtained from upstream vendor.conf file in runc
source package version 1.0.0~rc8+git20190923.3e425f80-0ubuntu1:

* github.com/opencontainers/runtime-spec  29686dbc5559d93fb1ef402eeda3e35c38d75af4 # v1.0.1-59-g29686db
    -> package version in the archive is newer
    -> diff: https://github.com/opencontainers/runtime-spec/compare/29686d..a1b50f6

	golang-github-opencontainers-specs | 1.0.1+git20190408.a1b50f6-1 | focal/universe  | source

* github.com/checkpoint-restore/go-criu   17b0214f6c48980c45dc47ecb0cfd6d9e02df723 # v3.11
    -> missing package
    -> it is available in Debian experimental

* github.com/mrunalp/fileutils            7d4729fb36185a7c1719923406c9d40e54fb93c7
    -> package needs update
    -> diff: https://github.com/mrunalp/fileutils/compare/4ee1cc9...7d4729f

	golang-github-mrunalp-fileutils-dev | 0.0~git20160930.0.4ee1cc9-1 | focal/universe  | all

* github.com/opencontainers/selinux       3a1f366feb7aecbf7a0e71ac4cea88b31597de9e # v1.2.2
    -> package version in the archive is newer
    -> diff: https://github.com/opencontainers/selinux/compare/v1.2.2...v1.3.0

	golang-github-opencontainers-selinux-dev | 1.3.0-2                           | focal/universe  | all

* github.com/seccomp/libseccomp-golang    689e3c1541a84461afc49c1c87352a6cedf72e9c # v0.9.1
    -> versions match

	golang-github-seccomp-libseccomp-golang-dev | 0.9.1-1                     | focal/universe  | all

* github.com/sirupsen/logrus              8bdbc7bcc01dcbb8ec23dc8a28e332258d25251f # v1.4.1
    -> package version in the archive is newer (proposed)
    -> diff: https://github.com/sirupsen/logrus/compare/v1.4.1...v1.4.2

	golang-github-sirupsen-logrus-dev | 1.3.0-1 | focal/universe  | all
	golang-github-sirupsen-logrus-dev | 1.4.2-1 | focal-proposed/universe | all

* github.com/syndtr/gocapability          d98352740cb2c55f81556b63d4a1ec64c5a319c2
    -> versions match

	golang-gocapability-dev | 0.0+git20180916.d983527-1                   | focal/universe          | source, all

* github.com/vishvananda/netlink          1e2e08e8a2dcdacaae3f14ac44c5cfa31361f270 # v1.0.0
    -> package version in the archive is newer
    -> diff: https://github.com/vishvananda/netlink/compare/1e2e08e...023a6da

	golang-github-vishvananda-netlink-dev | 1.0.0+git20181030.023a6da-1 | focal/universe  | all

* github.com/coreos/go-systemd            95778dfbb74eb7e4dbaf43bf7d71809650ef8076 # v19
    -> package version in the archive is newer (proposed)
    -> diff: https://github.com/coreos/go-systemd/compare/v19...v22.0.0

	golang-github-coreos-go-systemd-dev | 22.0.0-1 | focal/universe  | all

* github.com/godbus/dbus                  2ff6f7ffd60f0f2410b3105864bdd12c7894f844 # v5.0.1
    -> package version in the archive is newer (proposed)
    -> diff: https://github.com/godbus/dbus/compare/v5.0.1...v5.0.3

	golang-dbus-dev | 5.0.3-1             | focal/universe          | all

* github.com/golang/protobuf              925541529c1fa6821df4e44ce2723319eb2be768 # v1.0.0
    -> package version in the archive is newer
    -> diff: https://github.com/golang/protobuf/compare/v1.0.0...v1.3.2

	golang-goprotobuf-dev | 1.3.2-2                     | focal/universe  | amd64, arm64, armhf, i386, ppc64el, s390x

* github.com/cyphar/filepath-securejoin   a261ee33d7a517f054effbf451841abaafe3e0fd # v0.2.2
    -> versions match

	golang-github-cyphar-filepath-securejoin-dev | 0.2.2-1 | focal/universe | all

* github.com/docker/go-units              47565b4f722fb6ceae66b95f853feed578a4a51c # v0.3.3
    -> package version in the archive is newer
    -> diff: https://github.com/docker/go-units/compare/v0.3.3...v0.4.0

	golang-github-docker-go-units-dev | 0.4.0-1                        | focal/universe  | all

* github.com/urfave/cli                   cfb38830724cc34fedffe9a2a29fb54fa9169cd1 # v1.20.0
    -> versions match

	golang-github-urfave-cli-dev | 1.20.0-1 | focal/universe  | all

* golang.org/x/sys                        9eafafc0a87e0fd0aeeba439a4573537970c44c7 https://github.com/golang/sys
    -> package needs update
    -> diff: https://github.com/golang/sys/compare/fc99dfb...9eafafc

	golang-golang-x-sys-dev | 0.0~git20190726.fc99dfb-1ubuntu2 | focal/universe  | all

* github.com/containerd/console           0650fd9eeb50bab4fc99dceb9f2e14cf58f36e7f
    -> package needs update
    -> diff: https://github.com/containerd/console/compare/84eeaae...0650fd9

	golang-github-containerd-console-dev | 0.0~git20170925.84eeaae-1 | focal/universe | all

* github.com/pkg/errors                   ba968bfe8b2f7e042a574c888954fccecfa385b4 # v0.8.1
    -> versions match

	golang-github-pkg-errors-dev | 0.8.1-1                       | focal/universe  | all


## De-vendorized package version

The only vendorized dep in this package is go-criu:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/focal-runc-devendorized

The DEP-8 tests are also successfully passing with this package version:

autopkgtest [00:22:34]: @@@@@@@@@@@@@@@@@@@@ summary
basic-smoke          PASS
dh-golang-autopkgtest PASS

You can also find a branch containing this de-vendorized version here:

https://code.launchpad.net/~lucaskanashiro/ubuntu/+source/runc/+git/runc/+ref/devendorize-deps


## go-criu - Missing package

* It is a Go binding for CRIU (Checkpoint/Restore In Userspace)
    - https://github.com/checkpoint-restore/go-criu
    - https://github.com/checkpoint-restore/criu
    - https://criu.org/Main_Page
* CRIU is available only in Debian experimental
    - https://tracker.debian.org/pkg/criu
    - Maintainer argues that the project moves fast and it is not ready for a
      stable release, and also needs more work on the packaging
        + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796536
        + Pinged the maintainer and he said that nowadays releases are more
          stable and he needs to think again if it is suitable for a stable
          release. Also offered some help if he needs it.
* The go-criu binding is called in libcontainer/container_linux.go quite some times