One Module, One Release: CLI and Controller Join the Bindings

Mon, 07 Sep 2026 08:00:00 +0200

The OCM CLI and the OCM Kubernetes controller have moved into the monolithic Go module at ocm.software/open-component-model/bindings/go. This completes the consolidation that we started with the monolithic bindings.

Shipping SBOMs with Your Components

Tue, 28 Jul 2026 10:00:00 +0200

The Problem

OCM already tells you which artifacts a component delivers: its Software Bill of Delivery. But that does not answer the question a security team actually has: “which dependencies are bundled inside those artifacts, and am I affected by this vulnerability?” Knowing a component ships an OCI image and a CLI binary as a resource does not tell anything about the packages and libraries buried inside that resource.

Cli on Open Component Model

One Module, One Release: CLI and Controller Join the Bindings

Shipping SBOMs with Your Components

The Problem