Broadcom has decided to take responsibility for the security of some important open-source software, namely the Spring Java application framework and RabbitMQ. Australian developer Rod Johnson created the precursor to Spring in 2002, then found collaborators to tread the well-worn path towards monetizing open source software by starting a company called SpringSource to offer support and services for their creation. VMware acquired SpringSource and made it part of its Pivotal Software joint venture with EMC. Pivotal went on to pioneer the approaches to software development that became microservices and cloud-native computing. Much of the software Pivotal created later became part of VMware’s Tanzu brand. The Tanzu Kubernetes Grid lives on as the vSphere Kubernetes Service that adds support for containerized apps to VMware’s flagship Cloud Foundation suite. Broadcom also runs a Tanzu division which sells the VMware Tanzu Platform, a bundle that includes platform-as-a-service tools and a Spring implementation. Because Spring is FOSS, the Tanzu division contributes heavily to the many open-source components that comprise it, and to other FOSS projects often used in Spring implementations. The new TrueSource by Broadcom offering, announced today ahead of VMware’s annual Explore conference, will see the company identify key components that Spring users rely on and work to ensure that they are secure. “The idea is to provide a set of solutions focused on providing clean and secure artefacts,” Purnima Padmanabhan, vice president of Broadcom’s Tanzu Division, told The Register. “We choose and build every Spring library, databases, other Java components,” she said. Padmanabhan said that promise means VMware will also provide “TrueSource trusted artifacts” for code that is not part of Spring, including the wider Java ecosystem, Python, and Node.js. “Broadcom’s curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record,” according to a company statement. “Thousands of engineers across Broadcom’s software divisions scan, fix, contribute to, and consume them every day.” A VMware spokesperson told The Register the Broadcom business unit “will work with and support maintainers on open source software and we will provide fixes to open source upstream for any active projects.” “With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth,” the spokesperson said. This is just the sort of contribution that the open-source community wants vendors to do to reflect the value they extract from software they did not create alone. It’s also the sort of thing vendors sometimes conclude they need to do to keep products based on FOSS viable. ®