v1.3.0 planning

[AkihiroSuda]

Planning to release v1.3.0 after:

• updating containerd to v1.7 GA (ETA: this week)
• updating runc Release v1.1.5 (Fix CVE-2023-27561, CVE-2023-25809, CVE-2023-28642) opencontainers/runc#3789
• merging Add notation signing and verification #2035

cc @containerd/nerdctl-maintainers

[fahedouch]

LGTM, MAINTAINERS_GUIDE.md will be welcomed, to rotate next releases.

[manugupt1]

Thank you. SGTM

[djdongjin]

LGTM, MAINTAINERS_GUIDE.md will be welcomed, to rotate next releases.

If we plan to have such a doc and it will only have a RELEASE section in it in the near future, maybe we can start by having a RELEASE.md to document the process?

MAINTAINERS_GUIDE.md seems too maintainer-specific and I feel "release" can be for anyone who is interested in learning about the process, although only maintainers can do the actual release.

[AkihiroSuda]

If we plan to have such a doc and it will only have a RELEASE section in it in the near future, maybe we can start by having a RELEASE.md to document the process?

That doesn't seem to be consistent with https://github.com/containerd/containerd/blob/main/RELEASES.md .
We can have a link to MAINTAINERS_GUIDE.md from RELEASES.md though.

[AkihiroSuda]

• Add MAINTAINERS_GUIDE.md #2089

[AkihiroSuda]

@Zheaoli @fahedouch Do you want to make v1.3.0 release?
Feel free to release v1.3.0-beta.0 for an exercise, if you are interested in.

[fahedouch]

@Zheaoli I can make it if you LGTY

[Zheaoli]

@Zheaoli I can make it if you LGTY

You may be more suitable for this release. I would like to take handle the release process in v1.3.1 or v1.4.0

[AkihiroSuda]

@fahedouch Thanks for releasing v1.3.0-beta.0.
I think we can release v1.3.0 GA right after bumping up dependencies such as runc.

We may include #2136 too (not necessary)

[AkihiroSuda]

@fahedouch Do you want to open the PR for bumping up the deps?

[fahedouch]

@fahedouch Do you want to open the PR for bumping up the deps?

Sure I was waiting for dependabot to handle bumping up deps

[AkihiroSuda]

dependabot doesn't bump up the deps like ARG RUNC_VERSION=v1.1.4 in Dockerfile