Broadcom has announced a new initiative, TrueSource by Broadcom, aimed at securing key open-source libraries for Java, Python, and Node.js, starting with the Spring framework and RabbitMQ, ahead of VMware's annual Explore conference.
The company said it will identify key components that Spring users rely on and work to ensure they are secure. “The idea is to provide a set of solutions focused on providing clean and secure artefacts,” Purnima Padmanabhan, vice president of Broadcom’s Tanzu Division, told The Register. “We choose and build every Spring library, databases, other Java components.”
Padmanabhan said the promise means Broadcom will also provide “TrueSource trusted artifacts” for code outside Spring, including the wider Java ecosystem, Python, and Node.js. According to a company statement, “Broadcom’s curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record.”
A VMware spokesperson said the business unit “will work with and support maintainers on open source software and we will provide fixes to open source upstream for any active projects,” adding, “With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth.”
The announcement comes after years of Broadcom’s involvement with the Spring ecosystem, which originated from an open-source framework created by Australian developer Rod Johnson in 2002, later commercialized by SpringSource and acquired by VMware. The Spring framework and related projects, including RabbitMQ, are now part of Broadcom’s Tanzu portfolio.