Not just what shipped. Why it was trusted.
An open foundation for recording software release decisions.
Open Release Record is an initiative to make software release decisions understandable, portable and independently verifiable.
We’re developing a shared specification for preserving what was released, why it was accepted, and the evidence and responsibility behind that decision.
A release is a moment. Accountability lasts.
Those questions matter long after a pipeline has finished. The answers should remain accessible when teams change, tools are replaced, or someone outside the organisation needs to understand a decision.
Our ambition is simple: a lasting record, not a reconstruction.
- released
- payments-api 4.2.0 sha256:3b7e…a09c
- checked
- testssha256:91ac…verified dependenciessha256:5e02…verified build originsha256:c4d7…verified pen testsha256:0f3b…asserted
- accepted
- releaserelease managersignature risk VULN-0142security lead, until 2026-11-30signature both over record sha256:9f2c…e41a
- preserved
- recordsha256:d81e…07f3 timestamp2026-10-20 14:02 UTCRFC 3161 kept asevidence recordRFC 4998
Small by design.
The specification is still a draft. These are the rules it is being written to.
- One new thing.
- Formats for SBOMs, provenance and test results already exist. A record points to them and adds the decision.
- People decide, and sign.
- Each approval is signed by the person who gave it, over this exact release. A pipeline can prepare a record. It cannot approve one.
- Same evidence, same answer.
- Anyone can recompute the outcome from the record, its evidence and the release policy. If the answer differs, the record does not verify.
- Accepted risks expire.
- Every accepted risk names an owner, a reason and an end date. There is no permanent exception.
- No approval is no approval.
- A missing signature is reported as missing, never read as consent.
- Proof that outlasts the tools.
- A preserved record can be checked years later, without our servers or anyone else’s.
Start small.
- releasedchecked Record what you released and what you knew.
- accepted Decide with signed approvals and accepted risks.
- preserved Preserve it so anyone can verify it later.
Open by design. Useful beyond any one platform.
Release records should belong to the organisations that depend on them.
We believe a shared, open specification can help engineering, security and assurance work from the same evidence, without requiring everyone to use the same tools.
Open Release Record is intended to complement existing delivery systems and evidence formats, providing a common way to carry the decision forward.
For long-term preservation, we intend to follow the German Federal Office for Information Security’s technical guideline BSI TR-03125 (TR-ESOR), including the evidence records it builds on.
Help shape what comes next.
The project is at an early stage. We’re inviting partners from software delivery, security, assurance and tooling to help shape it around real-world needs.
- Software delivery
- Security
- Assurance
- Tooling
Bring a release process, a difficult audit question, or a tool that could benefit from a shared record. Help define what a useful release record must explain, preserve and prove.