RELEASES: define the release process by stevvooe · Pull Request #1310 · containerd/containerd

stevvooe · 2017-08-08T23:10:30Z

Define the release process for containerd and outline the components
that are and are not covered by versioning guarantees. Please read the
document for details.

Signed-off-by: Stephen J Day [email protected]

codecov-io · 2017-08-08T23:39:40Z

Codecov Report

Merging #1310 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1310   +/-   ##
=======================================
  Coverage   35.56%   35.56%           
=======================================
  Files          23       23           
  Lines        2874     2874           
=======================================
  Hits         1022     1022           
  Misses       1627     1627           
  Partials      225      225

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 56d499e...9827b4c. Read the comment docs.

samuelkarp

Thank you for sending this out! It's great to see these policies emerge.

samuelkarp · 2017-08-09T02:16:20Z

Can we add a section defining exactly what is meant by "backwards compatibility" here? It looks like this paragraph is meant to allow some sort of deprecation policy, and it'd be good to understand what kinds of things might change.

Would this make more sense without the work "backwards" here?

Give the new wording a try.

samuelkarp · 2017-08-09T02:17:36Z

Is the 1 year support period a hard limit or just a minimum?

I would say a minimum. If we actually get help from the community backporting patches then it makes support much easier. That hasn't been the case in the past and things are left up to the maintainers for support, new features, reviews, and backports. If everyone carries the load it makes it much easier to support long term.

Adding at least here.

samuelkarp · 2017-08-09T02:20:26Z

I assume this means "next minor or major"?

samuelkarp · 2017-08-09T02:23:12Z

There should be an explicit contact mechanism for security issues rather than just asking the reporter to be discreet.

We will have to setup a security mailing list for these things.

It would also be desirable to have a documented GPG key (or multiple keys, if for individuals) with which sensitive issues can be protected. Some details about how security issues will be handled will also help. (e.g. how quickly will somebody acknowledge receipt of a report? Will non-public information be shared with other distributors prior to publication? etc) ISC has a rather comprehensive example of a security policy, split across two pages. I wouldn't necessarily suggest going that far, but it's worth reading.

samuelkarp · 2017-08-09T02:41:25Z

I think it's worth calling out somewhere that because the GRPC API is covered by the stability guarantee, applications built against the 1.0 Go API will continue to work with the same versions that the stable GRPC API will, as the Go API leverages the GRPC API.

Added a note about this in the "Go API" section.

samuelkarp · 2017-08-09T02:45:36Z

What else can be added in a minor release? Would a minor release also allow the addition of service calls, parameters, and return elements?

samuelkarp · 2017-08-09T02:48:56Z

Is this about microformats or really just about opaque fields?

Opaque fields.

samuelkarp · 2017-08-09T02:49:15Z

It would be valuable to a client if there were a list of explicitly opaque fields.

Right now, all fields should be treated opaquely.

Also, we should defer to the service proto for these considerations.

samuelkarp · 2017-08-09T02:52:31Z

I think you mean non-exhaustive? Or it might be easier to phrase it as: This explicitly pertains to, but is not limited to, the list of components below.

AkihiroSuda · 2017-08-09T03:21:07Z

currently recommended -> recommended ?

Even after API stabilization, vendoring would be preferred in Go world.

AkihiroSuda · 2017-08-09T03:22:36Z

What does it stand for? Layout of /var/lib/containerd and /run/containerd?

AkihiroSuda · 2017-08-09T03:24:19Z

Migration is done automatically for upgrade from single previous minor release, right?

AkihiroSuda · 2017-08-09T08:17:48Z

I guess this section is mainly about the client library.
Does it apply for plugins as well?

AkihiroSuda · 2017-08-09T08:18:18Z

Binary compatibility of plugin DLLs?

This does not exist at the moment

Agreed.
So, I meant it would be good to add plugin ABI to this "Not Covered" list.

@AkihiroSuda The plugin ABI is not part of the project, since we are supporting them for now.

ijc · 2017-08-09T09:28:39Z

It would be good to reference the fingerprint of the signing key(s) here (and more generally to get it into the WoT or at least widely distributed).

Right now, we don't really want to make a single signing key. I'll use https://keybase.io/stevvooe.

ijc · 2017-08-09T09:29:20Z

"within" is one word in this context I think,

ijc · 2017-08-09T09:33:10Z

The phrase "from two minor releases" is difficult to grok I think perhaps "upgrades spanning multiple minor releases"?.

Also I think it's either "There are no compatibility guarantees" or "There is no compatibility guarantee" rather than "There is no compatibility guarantees".

ijc · 2017-08-09T09:34:53Z

By my reading of the preceding paragraphs EOL for 1.0 is actually max(TBD+1 year, release of 1.1.0)?

Random-Liu · 2017-08-10T05:50:27Z

What about metrics?

Random-Liu · 2017-08-10T06:11:09Z

This is Cool! LGTM overall.

crosbymichael · 2017-08-10T14:44:27Z

LGTM

mlaventure · 2017-08-10T15:00:16Z

Can we have a section listing the state of "stableness" for the plugins? For instance, if we were to release today, the linux plugin could be considered stable in behavior, not so for windows. This would allow us to also include "experimental" plugins for testing

stevvooe · 2017-08-10T22:02:38Z

@mlaventure Do you mind if we do this in a follow up?

mlaventure · 2017-08-10T23:03:30Z

Follow SGTM.

LGTM

nmeyerhans · 2017-08-10T23:25:48Z

typo: I think you're missing a word between "a" and "minor"

nmeyerhans · 2017-08-10T23:31:27Z

You may want to consider some (brief) period of overlap in support in case issues arise in the upgrade path between minor versions that are best addressed with patches to the previous (otherwise unsupported) release. Or maybe just call out the possibility that exceptions can be made in situations that interfere with a clean upgrade.

Would it be fine if we made this table the source of truth, over the policy?

nmeyerhans · 2017-08-10T23:40:00Z

It would also be desirable to have a documented GPG key (or multiple keys, if for individuals) with which sensitive issues can be protected. Some details about how security issues will be handled will also help. (e.g. how quickly will somebody acknowledge receipt of a report? Will non-public information be shared with other distributors prior to publication? etc) ISC has a rather comprehensive example of a security policy, split across two pages. I wouldn't necessarily suggest going that far, but it's worth reading.

nmeyerhans · 2017-08-10T23:41:15Z

typo: another missing word, between "overview" and "the".

stevvooe · 2017-08-11T01:24:27Z

@nmeyerhans The security reporting issue and GPG issues have already been discussed. I've filed #1337 to cover the security escalation process, which is blocking on a proper mailing list and embargo list. My key is in github. Releases can be verified against the account. There are no plans to have a central key.

Define the release process for containerd and outline the components that are and are not covered by versioning guarantees. Please read the document for details. Signed-off-by: Stephen J Day <[email protected]>

crosbymichael · 2017-08-11T14:28:34Z

LGTM

stevvooe requested a review from crosbymichael August 8, 2017 23:10

stevvooe force-pushed the releases branch from a7daf37 to 0d41870 Compare August 8, 2017 23:15

stevvooe added this to the containerd beta milestone Aug 8, 2017

stevvooe force-pushed the releases branch from 0d41870 to 019abe6 Compare August 8, 2017 23:32

samuelkarp reviewed Aug 9, 2017

View reviewed changes

AkihiroSuda reviewed Aug 9, 2017

View reviewed changes

Comment thread RELEASES.md Outdated

Copy link
Copy Markdown

Member

AkihiroSuda Aug 9, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does it stand for? Layout of /var/lib/containerd and /run/containerd?

AkihiroSuda reviewed Aug 9, 2017

View reviewed changes

ijc reviewed Aug 9, 2017

View reviewed changes

Comment thread RELEASES.md Outdated

Copy link
Copy Markdown

Contributor

ijc Aug 9, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"within" is one word in this context I think,

stevvooe reacted with thumbs up emoji

ijc reviewed Aug 9, 2017

View reviewed changes

stevvooe force-pushed the releases branch 4 times, most recently from 1f76331 to 92eb624 Compare August 9, 2017 21:15

Random-Liu reviewed Aug 10, 2017

View reviewed changes

stevvooe force-pushed the releases branch from 92eb624 to b25a0d3 Compare August 10, 2017 22:03

This was referenced Aug 10, 2017

RELEASES: add plugin stability guarantees #1336

Closed

define security escalation process #1337

Closed

nmeyerhans reviewed Aug 10, 2017

View reviewed changes

RELEASES: define the release process

9827b4c

Define the release process for containerd and outline the components that are and are not covered by versioning guarantees. Please read the document for details. Signed-off-by: Stephen J Day <[email protected]>

stevvooe force-pushed the releases branch from b25a0d3 to 9827b4c Compare August 11, 2017 01:27

crosbymichael merged commit c7f04ce into containerd:master Aug 11, 2017

stevvooe deleted the releases branch August 11, 2017 22:43

Conversation

stevvooe commented Aug 8, 2017

Uh oh!

codecov-io commented Aug 8, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

samuelkarp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stevvooe Aug 9, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ijc Aug 9, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-io commented Aug 8, 2017 •

edited

Loading

stevvooe Aug 9, 2017 •

edited

Loading

ijc Aug 9, 2017 •

edited

Loading