Based on what I've read of the California law (AFAIK, the Colorado bill is nearly identical), Microsoft, Google, Apple, and vendors of other closed-source commercial software would be considered OS providers. However, vendors of FOSS OSes cannot control what changes the local administrator chooses to make to the OS. The "OS Provider" is the responsible party under these bills; for FOSS software, that person is the end user installing the OS, and not an upstream vendor.