Tooling like cosign and infrastructure like OCI registries have proven track records in securing runtime artifact integrity with modern tooling. The only problem? The descriptions, attestations and metadata to ship these artifacts is usually not integrated and there is little support in the Cloud Native Ecosystem for unified Air Gapped delivery of large artifact lists and organizing releases.

Open Component Model solves this by providing an integrated specification together with tooling at build and deploy time for packing components that group artifacts, signing them, transporting them into a DMZ or through an Air-Gap, and deploying them completely location-agnostic into any cloud. vendor-neutral, open source by default.
Open Component Model is a secure delivery model for sovereign clouds from the NeoNephos Foundation, part of Linux Foundation Europe.