Release 1.3.5

[kolyshkin]

I'd like to release 1.3.5, mostly for the fix for the cannot start a container that has stopped error (#5151).

Copy-paste from the CHANGELOG (yes I still need a quote).

[1.3.5] - 2026-03-17

Lo viejo funciona!

Fixed

• Recursive atime-related mount flags (rrelatime et al.) are now applied
  properly. ([1.3] libct/specconv: fix partial clear of atime mount flags #5115, libct/specconv: always clear entire MOUNT_ATTR__ATIME field when updating atime mode #5098)
• PR Preventing containers from being unable to be deleted #4757 caused a regression that resulted in spurious
  cannot start a container that has stopped errors when
  running runc create and has thus been reverted. ([1.3] Revert "Preventing containers from being unable to be deleted" #5158,
  Revert "Preventing containers from being unable to be deleted" #5153, "cannot start a container that has stopped" in F-43 #5151, Add creating status to ensure state.json exists when runc kill. #4645, Preventing containers from being unable to be deleted #4757)

Changed

• Updated builds to Go 1.25, libseccomp v2.6.0. ([1.3] misc backports + Go 1.24->1.25 #5111, Various version bumps (mostly CI) #5053)
• Minor signing keyring updates. ([1.3] keyring fixes #5146, keyring: remove asarai@suse.de key #5139, keyring: validate: allow maintainers to have no keys #5144, keyring: update AkihiroSuda's key #5148)

[kolyshkin]

@opencontainers/runc-maintainers PTAL (and please help with the quote).

[kolyshkin]

Hmm, I think we need Go 1.26 fix, too.

[kolyshkin]

Hmm, I think we need Go 1.26 fix, too.

No, we don't (this was only needed because we're running exec twice due to CLONE_INTO_CGROUP, which we're not doing in 1.3.x). Yet it makes sense to add Go 1.26 into CI. Opened #5181

[cyphar]

LGTM, feel free to include the 1.26 CI PR or not.

[thaJeztah]

Probably would be good to verify; packagers may be building with latest go version, so having some early warning in CI to see if anything fails never hurts?

[rata]

LGTM, thanks!

[thaJeztah]

LGTM