setup-user: use github.com/moby/sys/user

[neersighted]

• Closes fix: update runc dependency 5 patch versions to remediate vulnerabilities #131
• Closes gosu binary Vuln with thirdparty github.com/opencontainers/runc (CVE-2023-27561) #130

Use the new github.com/moby/sys/user module (and clean up the dependency tree) to remove the runc dependency and reduce the possibility of future conflicts resulting from dependencies.

[tianon]

Looks good, thank you!

I'd love to get pedantic and make sure golang.org/x/sys is at the absolute lowest version it can reasonably be, but that feels like an unreasonable amount of digging to accomplish, so I think I'll just leave it alone for now. 😅

One thing I'd like to clarify though (I wish I could comment on the commit message itself 😂):

Since Go 1.16, [Go issue 1435][1] is solved, and the stdlib syscall implementations work on Linux. While they are a bit more flexible/heavier-weight than the implementations that were copied to libcontainer/system (working across all threads), we compile with Cgo, and using the libc wrappers should be just as suitable.

When you say "we compile with cgo", did you mean "if we compile with cgo" ? (We actually go out of our way to compile without cgo everywhere we build, so it'll only be distro builds like the ones in Debian that might use cgo. 😅)

[neersighted]

Oh, shoot, I kept that commit message from runc. That should be dropped here.

[tianon]

Ah, that makes more sense 😄

Would you like to update, or should I instead just squash and merge? (I have no strong preference either way)

[eshafaq1]

TY @neersighted