Bump nerdctl to v2.3.5

[sandaruwijewardhana]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Bumps the default nerdctl version from v2.3.0 to v2.3.5.

nerdctl_version is derived from the first key of nerdctl_archive_checksums[amd64] So adding the v2.3.5 checksums is what moves the default.

Release notes: https://github.com/containerd/nerdctl/releases/tag/v2.3.5

Which issue(s) this PR fixes:

Fixes #13433

Special notes for your reviewer:

Checksums are taken from the release SHA256SUMS file that update-hashes reads (components.py -> nerdctl_archive)

amd64 de3206aeb7cbd5f20f5fb1f55c1e3bf2db1be567812a8a3f5e65eba2488347ee
arm64 76ced9bd0d03f6140f9cf7b927958b654cb8d5ecd3c58af585d096c8bdf9d6c2
ppc64le 1263ac5fb8922d4a7b929ee3db3ae22481fa8807081c5fb8529d33128b166252

As a check on the method re-fetching the v2.3.0 sums from the same file reproduces the values already in checksums.yml exactly on all three architectures.

Two things worth noting

• The arm key is left at 2.2.2. It is on the 2.2 line rather than 2.3, and update-hashes only adds new patch versions relative to those already present, so it would not pick up 2.3.x there either. Happy to add arm 2.3.5 (linux-arm-v7 published) if you would prefer the lines aligned.
• No generated files changed: scripts/propagate_ansible_variables.yml runs clean and neither README.md nor the Dockerfiles reference nerdctl_version.

Does this PR introduce a user-facing change?:

Bump nerdctl to v2.3.5

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sandaruwijewardhana
Once this PR has been reviewed and has the lgtm label, please assign yankay for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubernetes-prow]

Hi @sandaruwijewardhana. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[yankay]

/ok-to-test

[VannTen]

That should be handled by the component_update workflow, I wonder if there is a problem with it currently ?

[VannTen]

Ah ok arm which happens to be the first arch only has 2.2 so the update-hashes script only check 2.2.*.

Just add
2.3.0: 0 in the arm arch and re run update-hashes nerdctl_archive, this should add the hash for all 2.3.* versions and re-enable the auto-update behavior.

(this is noted in update-hashes --help btw)

[sandaruwijewardhana]

Thanks for the pointer . Added 2.3.0: 0 under the arm arch and re ran update-hashes nerdctl_archive which filled in 2.3.0 through 2.3.5 for all four arches.

Confirmed the root cause is cur_v being derived from next(archs.values().iter()) (only the first arch block. Since
arm was capped at 2.2.2 the updater only looked for 2.2.x patches and never saw the 2.3 line. With arm on 2.3.x the auto update should track nerdctl again.