Broadcom promises curated open-source code for Spring and RabbitMQ

Broadcom is taking responsibility for a defined part of the open-source supply chain around its Tanzu software business. It will provide curated, security-focused artifacts for Spring, RabbitMQ and other dependencies used by Java, Python and Node.js applications.

The offering, called TrueSource by Broadcom, was announced on August 31, 2026, ahead of VMware’s annual Explore conference. Its initial focus is the Spring Java application framework and RabbitMQ messaging system, which Broadcom’s VMware business treats as core components of Tanzu’s platform tooling.

TrueSource is not intended to replace upstream open-source projects. Broadcom says it will identify the libraries that Spring users depend on, build and scan those components, and provide artifacts that conform to a reference architecture and can be supported by the relevant maintainers.

“The idea is to provide a set of solutions focused on providing clean and secure artefacts.”

Padmanabhan said the company chooses and builds Spring libraries, databases and other Java components. The same process is intended to extend beyond the Spring project to the wider Java ecosystem, as well as Python and Node.js packages.

What TrueSource is promising

Broadcom’s description combines three activities that software teams often handle separately: selecting dependencies, checking them for security issues and producing supported builds. The company says thousands of engineers across its software divisions already scan, fix, contribute to and consume the open-source components involved.

That approach is aimed at organizations that do not want every application team to decide independently which package version, build source or patch set to trust. TrueSource is designed to give Tanzu customers a defined artifact supply chain rather than asking them to assemble one from public package repositories and upstream releases.

The announced scope breaks down as follows:

TrueSource is not a claim that Broadcom will take over every dependency in a customer’s stack. For projects it does not maintain, the company says it will work with the existing maintainers and treat them as the authoritative source for the software.

“Broadcom’s curation process ensures that the libraries conform to a reference architecture and are supportable by the maintainers of record. Thousands of engineers across Broadcom’s software divisions scan, fix, contribute to, and consume them every day.”

Upstream ownership stays part of the model

Broadcom distinguishes between a vendor-curated artifact and an upstream project. A VMware spokesperson said the business unit would support maintainers and contribute fixes upstream for active projects. For Spring and RabbitMQ, however, Broadcom says, “we are the maintainers.”

“With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth.”

That arrangement could help enterprises that need a single accountable vendor for a large dependency set while preserving the existing governance model for projects outside Broadcom’s control. The announcement does not specify which individual libraries will be included, how artifacts will be versioned, how quickly fixes will follow upstream disclosures, or whether the service will be available outside Tanzu products.

A new layer around an old open-source model

Spring’s commercial history helps explain why Broadcom is positioning the announcement around stewardship rather than ownership. Australian developer Rod Johnson created the precursor to Spring in 2002. He later helped establish SpringSource, a company built around support and services for open-source software. VMware acquired SpringSource, and the technology became part of the broader Tanzu portfolio after Pivotal Software’s development work joined VMware’s software business.

That lineage ties Spring to the cloud-native and microservices practices that Pivotal helped popularize, while RabbitMQ remains a key messaging component in deployments built around those systems. Tanzu contributes to the open-source components used by its platform, but customers still have to manage the security and provenance of the wider dependency graph.

TrueSource is Broadcom’s proposed answer to that problem. The announcement establishes the curation and maintenance promise, but not the commercial terms, service tiers, supported package inventory or availability date. Until those details are published, customers cannot determine whether TrueSource changes their software bill, replaces an existing repository process or adds another supported artifact channel around Tanzu.