Broadcom launches TrueSource for open source security

Broadcom has launched TrueSource, a new enterprise portfolio designed to enhance the security and support of open source software. The platform aims to provide organizations with verified software builds, security patches, and engineering oversight to mitigate risks associated with open source dependencies.

The TrueSource portfolio includes several key components: Spring Enterprise, which provides human-reviewed security fixes; Trusted Artifacts, which offers hardened, clean-room-built components across Java, Python, and Node.js ecosystems; and Data Services, which brings verified support to technologies such as PostgreSQL, MySQL, RabbitMQ, and Valkey.

Broadcom’s approach emphasizes human validation to prevent the production-breaking changes that can occur with unverified, AI-generated patches. The service includes scanning customer repositories to assess the impact of releases and recommending low-risk remediation paths. Additionally, the Trusted Artifacts service provides access to approximately 5,000 dependencies required by the Spring framework and extends to the Bitnami Secure Images catalog for hardened container images.