Open Component Model

The Open Component Model (OCM) is an open standard to describe software bills of delivery (SBOD). OCM is a technology-agnostic and machine-readable format focused on the software artifacts that must be delivered for software products.

Check out the the main OCM project web page to find out what OCM offers you for implementing a secure software supply chain.

Impact

Core Development (OCM CLI & Libraries)
- Built next-generation OCM CLI v2, including commands for component version management, resource download, transfer, and verification.
- Implemented support for HELM, file, dir, and utf8 input methods.
- Added configurable retries, recursive options, and enhanced error handling in transfer and resolver logic.
- Bootstrapped descriptor, runtime, credential, and plugin systems.
Features & Enhancements
- Introduced BlobTransformer plugins, OCI/CTF bindings, and resource download handlers.
- Added support for signing, verification, and SBOM generation.
- Enabled self-updating CLI and advanced governance-related features (SIGs, ADRs, initiatives).
Reliability and Bug Fixes
- Corrected issues in provenance files, artifact download, helm downloader behavior, and git access methods.
- Fixed compatibility problems in recursive transfers, caching, OCI artifacts, and build tags.
- Improved CI reliability with workflow fixes for artifacts, Black Duck scans, and integration tests.
CI/CD and Dependency Management
- Maintained GitHub Actions pipelines (lint, build, release, security scans).
- Automated dependency updates (Go toolchain, Helm, Docker, Nix, golangci-lint, etc.).
- Introduced SHA pinning and improved action permissions for security.
Governance and Community
- Led initiatives on OCM Spec 2026.1, runtime SIG proposal, and governance processes for SIGs.
- Authored ADRs on CLI, plugin, and downloader architecture.
- Drove community calls, website content, and documentation improvements.

Contributions

Contributed to: 479 PRs: 253 Issues: 226

#	Title	Author
607	table formatting for tree output Issue Updated 2025-08-25 area/ipcei kind/feature	fabianburth
606	ocm-k8s-toolkit: Add support for "one-shot" verification modes for resources and components Issue Updated 2025-08-25 area/ipcei kind/task	jakobmoellerdev
1595	fix(ci): correct artifact download path in release workflow to ensure proper recognition PR Updated 2025-08-25 kind/bugfix component/github-actions size/xs	jakobmoellerdev
1594	fix(ci): correct artifact download path in release workflow to ensure proper recognition PR Updated 2025-08-25 kind/bugfix component/github-actions size/xs	jakobmoellerdev
1593	chore: update Nix installer package to version 2.31.0 in flake_vendorhash workflow PR Updated 2025-08-25 component/github-actions size/xs kind/chore	jakobmoellerdev
605	Sprint Responsible: `45` Issue Updated 2025-08-25 area/ipcei kind/task	jakobmoellerdev
1591	chore: update minimal build version to go 1.25 PR Updated 2025-08-25 size/xs kind/dependency kind/chore	jakobmoellerdev
1590	chore: update 'flake.nix' PR Updated 2025-08-25 size/xs kind/skip-release-notes kind/chore	ocmbot[bot]
1589	chore(deps): bump the go group with 10 updates PR Updated 2025-08-24 size/m kind/dependency kind/chore	dependabot[bot]
1588	chore: update Go version to 1.25 and update some modules PR Updated 2025-08-25 size/l kind/dependency kind/chore	hilmarf
1586	chore: update Go version to 1.25 and revise option handling to replace deprecated utility usage PR Updated 2025-08-22 size/m size/l kind/skip-release-notes kind/chore	jakobmoellerdev
604	Bump legacy OCM stack to go1.25 Issue Updated 2025-08-25 area/ipcei kind/task	jakobmoellerdev
1584	chore(deps): bump github/codeql-action from 3.29.9 to 3.29.10 in the ci group PR Updated 2025-08-20 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
603	Allow `ociArtifact` Accesses to have URL schemes defined on top of OCI reference strings Issue Updated 2025-08-21 area/ipcei kind/bugfix	jakobmoellerdev
602	Custom path matching for URL Identity Attributes in runtime Issue Updated 2025-08-19 area/ipcei kind/task	jakobmoellerdev
601	HELM Input Method: Remote Repository Support Issue Updated 2025-08-19 area/ipcei kind/task	jakobmoellerdev
1582	chore(deps): bump the go group with 12 updates PR Updated 2025-08-17 size/m kind/dependency kind/chore	dependabot[bot]
1580	chore(deps): bump the ci group across 1 directory with 3 updates PR Updated 2025-08-14 size/s component/github-actions kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
1578	chore(deps): bump helm.sh/helm/v3 from 3.18.4 to 3.18.5 in the go_modules group PR Updated 2025-08-14 size/s kind/dependency kind/chore	dependabot[bot]
594	Slow Reconciliation Times for Component and Resource Controller Issue Updated 2025-08-25 area/ipcei kind/task	jakobmoellerdev
593	`ocm get cv` does not show a reason for skipping an invalid version Issue Updated 2025-08-25 area/ipcei kind/task	morri-son
1577	chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 in the ci group PR Updated 2025-08-14 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
1576	chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 in the ci group PR Updated 2025-08-12 size/s component/github-actions kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
588	EPIC: Create an OCM v2 CLI Release Issue Updated 2025-08-12 area/ipcei kind/epic	jakobmoellerdev
1575	chore: bump VERSION to 0.28.1-dev PR Updated 2025-08-12 size/xs kind/chore	ocmbot[bot]
586	Propose SIG Runtime Issue Updated 2025-08-19 area/ipcei kind/task needs/refinement	jakobmoellerdev
585	Create Governance Model and Submission Process for OCM SIGs Issue Updated 2025-08-19 area/ipcei kind/task needs/refinement	jakobmoellerdev
1570	fix: tag //go:build integration PR Updated 2025-08-12 kind/bugfix size/s component/ocm-cli size/xs	vasu1124
1567	OCM Integration Test Failing Issue Updated 2025-08-10 kind/bugfix area/ipcei	jakobmoellerdev
1566	fix: tag //go:build integration PR Updated 2025-08-09 kind/bugfix component/ocm-cli size/xs kind/skip-release-notes	vasu1124
580	Replace inmemory blob with direct blob in input methods Issue Updated 2025-08-25 area/ipcei kind/task	ikhandamirov
579	Create ADR for OCM Signing/Verification Handler Plugins Issue Updated 2025-08-19 area/ipcei kind/task	jakobmoellerdev
1563	chore(deps): bump [email protected] PR Updated 2025-08-22 size/m component/ocm-cli component/github-actions kind/dependency kind/chore	hilmarf
578	make `ocm add cv --repository` to support OCI registries Issue Updated 2025-08-25 area/ipcei kind/task	ikhandamirov
577	Initiative: OCM Spec 2026.1 Issue Updated 2025-08-04 area/ipcei	jakobmoellerdev
576	EPIC: Self-Updating OCM CLI Issue Updated 2025-08-04 area/ipcei kind/epic needs/refinement	jakobmoellerdev
1559	chore(deps): bump the go group with 9 updates PR Updated 2025-08-04 size/m kind/dependency kind/chore	dependabot[bot]
572	Hierarchical SBOM Merging from OCM Resources and Component References Issue Updated 2025-08-21 area/ipcei kind/task	jakobmoellerdev
571	ocm-k8s-toolkit: Support `multi-document` YAML in `Deployer` Issue Updated 2025-08-13 area/ipcei component/ocm-controllers kind/feature	sk31337
1558	chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 in the ci group PR Updated 2025-07-31 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
569	introduce central configuration package Issue Updated 2025-07-30 area/ipcei kind/task	fabianburth
1553	chore(deps): bump the go group with 5 updates PR Updated 2025-07-27 size/s kind/dependency kind/chore	dependabot[bot]
1552	ocm on linux not compiling when built via `nix` Issue Updated 2025-08-12 area/ipcei kind/task	vasu1124
568	EPIC: Allow the use of a TSA for all signing mechanisms Issue Updated 2025-08-18 area/ipcei kind/epic needs/refinement	morri-son
567	OCM Controller to evaluate signature with multiple public keys Issue Updated 2025-07-31 area/ipcei kind/feature dev/help-wanted	dee0sap
566	bug: cannot create CVs with compressed `file` and ` dir` inputs Issue Updated 2025-08-07 area/ipcei kind/task	ikhandamirov
565	make `file` and `dir` inputs support relative paths Issue Updated 2025-08-25 area/ipcei kind/task	ikhandamirov
1550	feat: add ref to github access spec PR Updated 2025-07-23 kind/feature size/xs	fabianburth
564	support for `--recursive` in `add componentversion` command Issue Updated 2025-07-24 area/ipcei kind/task	fabianburth
563	support for `--recursive` in `get component version` command Issue Updated 2025-07-25 area/ipcei kind/task	fabianburth
560	defer error is ignored Issue Updated 2025-07-25 area/ipcei kind/bugfix	fabianburth
1548	fix: double slash in `imageReference` PR Updated 2025-07-24 kind/bugfix size/s size/m	ikhandamirov
1544	Support Signing with passphrase protected GPG Keys Issue Updated 2025-08-19 kind/feature area/ipcei	voigt
556	EPIC: Implement Cosign (correctly) Issue Updated 2025-08-18 kind/epic needs/refinement	morri-son
555	Status quo of Cosign Implementation Issue Updated 2025-08-14 area/ipcei kind/task	morri-son
553	Implement OCI Blob Transformers for directly extracting Single Layer Artifacts (i.e. HELM Charts) Issue Updated 2025-08-21 area/ipcei kind/task	jakobmoellerdev
552	Create `BlobTransformer` Plugin infrastructure and interfaces Issue Updated 2025-07-17	jakobmoellerdev
551	Create `ocm download resource` command Issue Updated 2025-07-15 area/ipcei kind/task	jakobmoellerdev
1538	chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 in the go_modules group PR Updated 2025-07-09 size/s kind/dependency kind/chore	dependabot[bot]
1536	chore(deps): bump the go group with 5 updates PR Updated 2025-07-07 size/s kind/dependency kind/chore	dependabot[bot]
550	Adopt licensing information in all README.md and REUSE.toml files in all repos Issue Updated 2025-08-11 area/ipcei kind/task	morri-son
1535	Keyless signing flow uses public key instead of Fulcio certificate in publicKey.content Issue Updated 2025-07-24 area/ipcei kind/task	namewasntfound
1534	chore(deps): bump DeterminateSystems/nix-installer-action from 17 to 18 in the ci group PR Updated 2025-07-14 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
546	EPIC: Threat Model Workshop `ocm-k8s-toolkit` Issue Updated 2025-07-07 area/ipcei kind/epic needs/refinement	fabianburth
545	Create ADR for OCM Resource Download Handlers Issue Updated 2025-07-11 area/ipcei kind/task	jakobmoellerdev
544	EPIC: Argument Interpreter for generated OCM Typed Specifications Issue Updated 2025-08-11 area/ipcei kind/epic	jakobmoellerdev
542	EPIC: Migrate Kyma Module CTL to OCM Lib v2 Issue Updated 2025-06-30 area/ipcei kind/epic	jakobmoellerdev
1528	chore(deps): bump the ci group with 2 updates PR Updated 2025-06-30 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
541	EPIC: Migrate Kyma Lifecycle Manager to OCM Next Gen Issue Updated 2025-06-30 area/ipcei kind/epic needs/refinement	jakobmoellerdev
1525	chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in the go_modules group PR Updated 2025-06-29 size/xs kind/dependency kind/chore	dependabot[bot]
540	Adopt Community section on website and add info about Open Source Community Calls Issue Updated 2025-07-02 kind/task component/ocm-website	morri-son
529	Write a Version Command for OCM CLI v2 Issue Updated 2025-07-07 area/ipcei kind/feature	ikhandamirov
528	ocm v2: GetComponentVersion from CTF wrong media type defaulting Issue Updated 2025-06-30 area/ipcei kind/bugfix	fabianburth
527	EPIC: Write a Transfer Component Version Command Issue Updated 2025-07-07 area/ipcei kind/epic needs/refinement	ikhandamirov
524	Adjust Deployer ADR for Generic Deployer Concept Issue Updated 2025-08-11 area/ipcei kind/task	fabianburth
523	EPIC: Implement `ocm download resource` and generic resource downloader binding Issue Updated 2025-08-03 area/ipcei kind/epic needs/refinement	jakobmoellerdev
1505	`ocm get resources ./ocm/cft/ --latest -r` fails for `componentReferences:` -> likely bug at resolver usage for references in the download resource command Issue Updated 2025-06-30 area/ipcei kind/task	sk31337
1504	chore!: migrate to native cobra library PR Updated 2025-06-12 size/xs kind/dependency kind/chore !BREAKING-CHANGE!	Skarlso
1500	Different transfer behaviour when using `ocm transfer ctf/component/?` (with options) Issue Updated 2025-06-26 area/ipcei kind/task	frewilhelm
1497	chore: fix correct filename for provenance file (#1492) PR Updated 2025-06-03 size/s kind/chore	jakobmoellerdev
1496	chore: fix correct filename for provenance file (#1492) PR Updated 2025-06-03 size/s kind/chore	jakobmoellerdev
1495	fix: correct filename for provenance file (#1492) PR Updated 2025-06-03 kind/bugfix size/s kind/chore	jakobmoellerdev
1494	fix: git access tar methods (#1454) PR Updated 2025-06-03 kind/bugfix size/m	frewilhelm
517	Define process to support creating new versions of content Issue Updated 2025-08-11 area/ipcei component/ocm-website	morri-son
513	Support Resolvers in OCM Configuration through `ocm.config.ocm.software` Issue Updated 2025-08-01 kind/task	jakobmoellerdev
512	EPIC: Process, Guide and tooling to create and version content for the OCM website Issue Updated 2025-08-11 kind/epic component/ocm-website	morri-son
1492	chore: fix correct filename for provenance file PR Updated 2025-05-28 kind/bugfix size/s kind/chore	frewilhelm
1491	chore(deps): bump docker/build-push-action from 6.17.0 to 6.18.0 in the ci group PR Updated 2025-05-28 component/github-actions size/xs kind/skip-release-notes kind/dependency kind/chore	dependabot[bot]
1490	chore: use ternary operator to avoid "skipped" integration test job PR Updated 2025-05-27 size/s component/github-actions kind/chore	jakobmoellerdev
1485	fix: make sure that helm downloader does not overwrite chart with provenance data (#1481) PR Updated 2025-05-23 kind/bugfix size/m	jakobmoellerdev
1484	fix: make sure that helm downloader does not overwrite chart with provenance data (#1481) PR Updated 2025-05-23 kind/bugfix size/m	jakobmoellerdev
1483	fix: make sure that helm downloader does not overwrite chart with provenance data (#1481) PR Updated 2025-05-23 kind/bugfix size/m	jakobmoellerdev
1482	docs: ecrplugin readme PR Updated 2025-06-03 area/documentation size/s kind/chore	ikhandamirov
1481	fix: make sure that helm downloader does not overwrite chart with provenance data PR Updated 2025-05-23 kind/bugfix size/m	jakobmoellerdev
509	When I click on a link to the website I don't end up at the top of the page but rather in the middle Issue Updated 2025-07-31 kind/task	frewilhelm
508	Design navigation and UX for the new "OCM CLI" section Issue Updated 2025-07-02 area/ipcei component/ocm-website	morri-son
507	Design new Documentation landing page with sections for every top level item (see Kubernetes.io) Issue Updated 2025-07-11 area/ipcei component/ocm-website kind/chore	morri-son
1479	fix: allow pre-v3.7.0 HELM Charts in HELM OCI Artifact downloader (#1476) PR Updated 2025-05-21 kind/bugfix size/s	jakobmoellerdev
1478	fix: allow pre-v3.7.0 HELM Charts in HELM OCI Artifact downloader (#1476) PR Updated 2025-05-21 kind/bugfix size/s	jakobmoellerdev
1477	fix: allow pre-v3.7.0 HELM Charts in HELM OCI Artifact downloader (#1476) PR Updated 2025-05-21 kind/bugfix size/s	jakobmoellerdev