Open Delivery Gear

Compliance is not living next to software. Instead, it is an integral part of it.

Open Delivery Gear (ODG) integrates compliance into the software lifecycle through automated scanning, tracking, and reporting of security findings, vulnerabilities, and compliance issues for your OCM components.

What is ODG?

Open Delivery Gear is a comprehensive compliance automation platform that:

• Scans OCM components for vulnerabilities, license compliance, and security issues

• Tracks findings throughout the component lifecycle with configurable processing times

• Replicates issues to GitHub for visibility and workflow integration

• Generates SBOMs (Software Bill of Materials) for transparency and compliance

• Manages responsibles by automatically assigning findings to the right teams

Key Features

🔍 Automated Scanning

Continuous scanning of OCI images, source code, and runtime artefacts using industry-standard tools like BDBA, ClamAV, and Syft.

📊 Compliance Dashboard

Centralized view of all findings with filtering, sorting, and drill-down capabilities to understand your security posture.

🔄 Issue Lifecycle Management

Automatic creation, updating, and closing of GitHub issues based on finding state and processing times.

🎯 Responsible Assignment

Intelligent assignment of findings to component owners and teams based on configurable rules and strategies.

---

Getting Started

Note

New to ODG? Start here to understand the fundamentals and how to run and extend it.

Guided learning journey starting with OCM fundamentals all the way to running and extending ODG

Getting Started

• 🚀 From Zero to Hero

Concepts

Deep-dive into ODG architecture, data models, and how extensions work

Concepts

• ODG’s System Architecture
• Correlating metadata to OCM
• Reacting upon OCM events
• Lifecycling GitHub Issues
• Overwriting OCM component responsibles
• Generating Software Bill of Materials

How-to Guides

Step-by-step instructions for common tasks and workflows

How-to Guides

• Setting up a hybrid dev setup
• Deploying the Open Delivery Gear Locally
• Use the ODG Python Package to resolve an OCM component
• Get all vulnerabilities for a Component
• Send Diki findings to ODG-API
• Download SBOM Documents
• Diagnose Failed SBOM Generation

Tutorials

Guided lessons to learn ODG by doing

Tutorials

• Contribute a new Extension

References

Technical specifications, API documentation, and configuration references

References

• Artefact Metadata Search
  • Request format
  • Criteria
  • Severity comparisons
  • Data types
  • Querying rescorings
  • Sorting
  • Pagination
  • Examples
• Core Configuration
  • Artefact Enumerator
  • Backlog Controller
  • Cache Manager
  • Delivery Database Backup
  • Responsibles
• Extension Configuration
  • Software Bill of Material Generator
  • Vulnerability Scanner
  • Malware Scanner
  • Operating System Scanner
  • Issue Replicator
  • License and Intellectual Property Scanner
  • Cryptographic Asset Scanner
  • Findings Report Generator
  • GitHub Secret Scanner
  • Static Application Security Testing Attestor

---

Additional Resources

💻 GitHub Repository

Source code, issues, and contributions

https://github.com/open-component-model/open-delivery-gear

🏗️ ODG Core

Core service implementation

https://github.com/open-component-model/odg-core

📦 Open Component Model

Learn about OCM

https://ocm.software

Note

This documentation is organised using the Diataxis framework:

• Getting Started: Introduction and orientation for new users

• Tutorials: Learning-oriented lessons

• How-to Guides: Problem-oriented, goal-focused instructions

• Concepts: Understanding-oriented explanations

• References: Information-oriented technical descriptions