Responsibilities:

Release Responsible: Responsible for the ocm library release and for setting up corresponding issues to track the releases (and patches). You can find the release process documentation here. @jakobmoellerdev will support you!

Scrum Master: Responsible for moderating, taking meeting notes and follow up tasks for our regular scrum meetings! 📝

Support Coordinator: Responsible for monitoring our slack support channels #sap-tech-ocm #sap-ext-ocm-project and github issues!

Security Responsible: Responsible for monitoring and triaging security issues as described in the OCM Security Compliance / Triage Guidelines!

Dependabot Updates: Responsible for taking care of the dependabot updates for the main repositories! ⏫

Done Criteria

• Security Triage Efforts

• Merged / Handled Dependabot updates for org (checked / triaged)
• Clone this issue for the next Sprint and plan a handover for the next assignee in the rotation (assign the issue to the next person on rotation)
  • Sprint Responsible: 54 #811
• Update and unignore github.com/sigstore/sigstore in open-component-model/ocm #780
  • In general cosign v3, sigstore, fulcio

Follow ups

• Hanging dependency bumps
  • https://github.com/open-component-model/open-component-model
    • Blocked because the dep is to young:
      • chore(deps): update golang:1.25 docker digest to 36b4f45 open-component-model#1348
      • chore(deps): update gcr.io/distroless/static:nonroot docker digest to 2b7c93f open-component-model#1346
      • chore(deps): update actions/setup-node digest to 395ad32 open-component-model#1287
    • Blocked because they introduce breaking changes that might be not relevant any more after the migration of controller
      • chore(deps): update module github.com/buildkite/agent/v3 to v3.114.0 open-component-model#1365
      • chore(deps): update module github.com/containerd/stargz-snapshotter/estargz to v0.18.1 - autoclosed open-component-model#1360
      • fix(deps): update module helm.sh/helm/v3 to v4 open-component-model#1375
        • Will be resolved by Update module helm.sh/helm/v3 to v4 #789
    • Blocked because fix is already in work in ocm lib v1
      • chore(deps): update module github.com/sigstore/fulcio to v1.8.3 [security] open-component-model#1354
      • chore(deps): Bump github.com/sigstore/fulcio from 1.7.1 to 1.8.3 in /kubernetes/controller open-component-model#1352

Releases

• Digest of blobs changes after transfer #797 forced us to create a patch release for v0.34 because we introduced a breaking change in v0.33. The patch release was created to have an official release with the retracted version v0.33.0 and v0.34.1 which is needed to make go-modules aware of the retraction.
• We analysed Digest of blobs changes after transfer #797 again and came to the conclusion that the version bump of github.com/klauspost/compress will likely not pose a problem for users. This is why we issued the version bump again (by removing the replace statement). We did not backport it to v0.34 as the branch still works fine with github.com/klauspost/compress v1.18.0. We backport it to v0.35 and created another release candidate.
• We cherry-picked chore(deps): bump golang from 1.25.4-alpine3.22 to 1.25.5-alpine3.22 ocm#1718 and chore: bump sigstore/fulcio ocm#1757 to address security issues into release branch v0.34 and v0.35. We published v0.34.3 and v0.35.0-rc3
• We plan to promote 0.35.0 on 19th of January

Previous #783