Open Component Model

The Open Component Model (OCM) is an open-source, technology-agnostic model and toolset for secure software delivery. OCM provides a standard way to describe, sign, ship and deploy software components across any environment - including air-gapped and sovereign clouds - ensuring a tamper-proof, verifiable supply chain from build to deployment.

• One standard for every artifact: Any artifact — images, Helm charts, binaries, configs — is described as a single, versioned component with a cryptographic packing list.
• Sign once, trust everywhere: Using established algorithms like RSA and X.509 - and keyless signing via Sigstore. Location-independent signatures stay valid across registries, organizations, and air gaps, providing a verifiable Software Bill of Delivery.
• Deliver to any environment: Software ships across public cloud, on-prem, and fully disconnected sovereign environments without breaking integrity or traceability.
• Fits any stack: An extensible plugin model integrates with existing registries, signing services, and GitOps tooling - and OCM components serve as a shared anchor for downstream compliance tooling like Open Delivery Gear.