The Open Component Model (OCM) is an open standard for describing software bills of delivery (SBoD) — a technology-agnostic, machine-readable format for the artifacts that must be delivered, with globally unique component identities, signing, and a storage layer for transporting them between repositories such as OCI registries. The specification is published under the Community Specification License 1.0; the toolset is Apache 2.0.
Open Component Model
The Open Component Model (OCM) describes what gets delivered, not how it is built: a component version lists its resources, sources and references with globally unique identities, so the whole set can be signed, transported between repositories and verified on the other side — end-to-end integrity and provenance across air gaps and registries. It is part of NeoNephos, a Linux Foundation Europe project.
- A specification and a toolset - The ocm-spec repository holds the model, processing, persistence, extension and guideline chapters under the Community Specification License 1.0; the Go toolset and CLI live in open-component-model (v0.19.1, October 2026).
- Software bill of delivery - Complements SBOM formats such as SPDX and CycloneDX: an SBOM says what is inside an artifact, an SBoD says which artifacts ship together.
- Storage-agnostic, OCI-first - Components are stored and transported through repository types, with OCI registries the common case.
- Spec releases are rare - ocm-spec has a single tagged release, v0.1.0 from July 2023; the work moves in the toolset.
