Open Delivery Gear

Open Delivery Gear (ODG) is an open-source compliance automation platform that continuously scans OCM component versions for security and compliance issues. ODG tracks findings against configurable SLAs and provides a Delivery Dashboard for platform operators and application teams - enabling trust-but-verify assurance across public and sovereign cloud environments.

• Aggregated Component View: Provides an aggregated view of component versions and metadata from multiple sources, including vulnerabilities and licenses.
• Technology-Agnostic Rescoring: Tooling- and technology-agnostic (semi-automated) rescoring of compliance findings across different software supply chain tools.
• Compliance Issue Tracking: Compliance issue tracking with a fine-granular "rolling due-date barrier" for managing remediation timelines.
• Extensible via ODG Extension Model: Extensible through the ODG Extension Model, allowing organizations to add custom compliance checks and integrations.
• Correlated to Component IDs: All findings are correlated to OCM Component IDs, facilitating alignment of different processes and tools across software lifecycle stages.