Broadcom pledges to lock down open source Python, Java libraries

Broadcom has pledged to secure the security of key open-source software libraries, including Spring Java and RabbitMQ. Rod Johnson, an Australian developer, created the original Spring framework in 2002 and later co-founded SpringSource, which was acquired by VMware. The latter integrated SpringSource into its Pivotal Software joint venture, which played a pivotal role in shaping software development practices such as microservices and cloud-native computing.

Many of the software components developed by Pivotal have since become part of VMware's Tanzu brand. Broadcom operates a Tanzu division that supports VMware's Tanzu Platform, a suite that includes platform-as-a-service tools and a Spring implementation. By pledging to secure these open-source libraries, Broadcom aims to provide clean and secure artifacts to Spring users.

This includes not only Spring libraries, databases, and other Java components but also the wider Java ecosystem, Python, and Node.js. Broadcom's curation process ensures that these libraries align with a reference architecture and are supportable by maintainers. The company plans to collaborate with and support maintainers of open-source software, working together to provide fixes for active projects.

Broadcom recognizes the importance of maintaining the community maintainers as the source of truth. This move by Broadcom reflects the value that vendors extract from software and the necessity for them to contribute to keep FOSS-based products viable.