Broadcom has decided to turn the security of popular open source into its own area of responsibility. The company has launched TrueSource, a commercial program that covers Spring, thousands of Java libraries, Python and Node.js ecosystems, container images and several commonly used databases.
The basis of the new program was TrueSource. Broadcom promises to independently select, collect and check the software components, and the found problems to correct together with accompanying open projects. For Spring and RabbitMQ, the company itself acts as an accompanying company, so it can directly control the issuance of corrections. In other projects, Broadcom intends to transfer changes to source code developers, saving upstream projects as the main source of proven versions.
TrueSource Trusted Artifacts extends this approach far beyond Spring. Broadcom will prepare isolated validation builds of Java, Python and Node.js libraries corresponding to the third level of SLSA. This approach helps to protect the supply chain of the software and confirm the origin of the finished component, and not just trust the package from an external repository.
In Java alone, Broadcom is going to support more than 5000 verified and signed libraries, including Apache Tomcat and Kotlin dependencies, which use supported versions of Spring Boot. The subscription also includes the Bitnami Secure Images directory with reinforced container images for hundreds of popular open packages.
A separate part of TrueSource is called Data Services. Broadcom included PostgreSQL, RabbitMQ, MySQL and Valkey along with the necessary extensions, operators Kubernetes and Helm Charts. The company will check such components, help with deployment and show customers the security status of the stack used.
Broadcom also automates the search for problems in client repositories. The system should assess the impact of new releases, suggest the least risky path of fixing, and automatically create a pull request. For vulnerabilities, the company will be able to issue separate fixes without the other changes to the new version, so that organizations do not have to carry out a full-fledged product update for the sake of closing one problem.
TrueSource customers will be able to transmit Broadcom information about undisclosed vulnerabilities in advance and receive corrections before public publication. Critical infrastructure organizations are promised separate access to information on fixes and recommendations to reduce risk.
For Broadcom, such a step simultaneously solves a technical and commercial task. Spring has long been part of the VMware Tanzu portfolio, and corporate applications depend on a huge number of third-party libraries, the quality of which the platform provider does not directly control. TrueSource expands the support boundaries from its own product to a large part of the surrounding open-source ecosystem and actually sells companies proven origin, maintenance and responsibility for the code that previously had to be taken "as is."
The basis of the new program was TrueSource. Broadcom promises to independently select, collect and check the software components, and the found problems to correct together with accompanying open projects. For Spring and RabbitMQ, the company itself acts as an accompanying company, so it can directly control the issuance of corrections. In other projects, Broadcom intends to transfer changes to source code developers, saving upstream projects as the main source of proven versions.
TrueSource Trusted Artifacts extends this approach far beyond Spring. Broadcom will prepare isolated validation builds of Java, Python and Node.js libraries corresponding to the third level of SLSA. This approach helps to protect the supply chain of the software and confirm the origin of the finished component, and not just trust the package from an external repository.
In Java alone, Broadcom is going to support more than 5000 verified and signed libraries, including Apache Tomcat and Kotlin dependencies, which use supported versions of Spring Boot. The subscription also includes the Bitnami Secure Images directory with reinforced container images for hundreds of popular open packages.
A separate part of TrueSource is called Data Services. Broadcom included PostgreSQL, RabbitMQ, MySQL and Valkey along with the necessary extensions, operators Kubernetes and Helm Charts. The company will check such components, help with deployment and show customers the security status of the stack used.
Broadcom also automates the search for problems in client repositories. The system should assess the impact of new releases, suggest the least risky path of fixing, and automatically create a pull request. For vulnerabilities, the company will be able to issue separate fixes without the other changes to the new version, so that organizations do not have to carry out a full-fledged product update for the sake of closing one problem.
TrueSource customers will be able to transmit Broadcom information about undisclosed vulnerabilities in advance and receive corrections before public publication. Critical infrastructure organizations are promised separate access to information on fixes and recommendations to reduce risk.
For Broadcom, such a step simultaneously solves a technical and commercial task. Spring has long been part of the VMware Tanzu portfolio, and corporate applications depend on a huge number of third-party libraries, the quality of which the platform provider does not directly control. TrueSource expands the support boundaries from its own product to a large part of the surrounding open-source ecosystem and actually sells companies proven origin, maintenance and responsibility for the code that previously had to be taken "as is."
