Software Supply Chain (SBOM, Signing, Open Source Security)

Where this market publishes its structure

• OpenSSF Landscape members (github.com/ossf/ossf-landscape landscape.yml @0c50858516) machine-readable, 113 members (Premier 14, General 75, Associate 24); 20 linked; 30 held out-of-market (AWS, Google, Microsoft, Apple, banks, Honda...)
• Sigstore landscape (same file: Integrations, Language Clients, Projects) machine-readable, 57 entries; 8 linked; 17 users (Signed With, Case Studies) held
• CycloneDX Tool Center (cyclonedx.org/tool-center, server-rendered tool cards) machine-readable, 316 tools / 227 publishers; 29 linked
• SPDX Tools (spdx.dev/use/spdx-tools, server-rendered vendor cards) machine-readable, 73 tools; 4 linked (mostly open-source projects on github.com)
• OpenChain Community of Conformance (openchainproject.org/community-of-conformance) machine-readable, 195 entries (5230: 164, 18974: 31), self-declared; 3 linked; 38 held out-of-market
• openssf.org/about/members not machine-readable: client-rendered; read through the OpenSSF landscape instead
• SLSA adopters / conformance not machine-readable: no register exists (slsa-framework/slsa holds nav data only)
• Sigstore public-good instance users (Rekor) not machine-readable: a transparency log of signatures, not a register of organisations
• OWASP DefectDojo parsers (dojo/tools, 369) not machine-readable: tool names only, no publisher or domain; a parser reads a tool's output format (compatible, report-only); not linked

Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.

Taxonomy how this market maps onto apis.io

Derived 2026-10-18 from the 50 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.

share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py

Leaders by position (provisional)

Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.

builds-on 14 · publishes apps on other platforms' stores

standard 26 · listed by a voluntary standard's own directory

long-tail 2 · reached only through iPaaS bridges

distribution 2 · only sells through cloud marketplaces

undeclared 6 · declares nothing we can read: no number