Component description / functionalities
The Open Component Model (OCM) is an open-source, technology-agnostic model and toolset for secure software delivery. OCM provides a standard way to describe, sign, ship and deploy software components across any environment - including air-gapped and sovereign clouds - ensuring a tamper-proof, verifiable supply chain from build to deployment.
- One standard for every artifact: Any artifact — images, Helm charts, binaries, configs — is described as a single, versioned component with a cryptographic packing list.
- Sign once, trust everywhere: Using established algorithms like RSA and X.509 - and keyless signing via Sigstore. Location-independent signatures stay valid across registries, organizations, and air gaps, providing a verifiable Software Bill of Delivery.
- Deliver to any environment: Software ships across public cloud, on-prem, and fully disconnected sovereign environments without breaking integrity or traceability.
- Fits any stack: An extensible plugin model integrates with existing registries, signing services, and GitOps tooling - and OCM components serve as a shared anchor for downstream compliance tooling like Open Delivery Gear.