BROADCOM has introduced the TrueSource project during VMware Explore 2026, providing verified and traceable open-source software builds with commercial support. The initiative aims to combat supply chain attacks by delivering secure, patched packages based on original upstream source code, without compensating upstream maintainers. TrueSource will utilize AI to scan over 5,000 dependency libraries for vulnerabilities, with human experts validating and merging fixes into software packages.
This helps enterprise customers avoid the complexities of verifying dependency trees. Broadcom commits to collaborating with open-source maintainers by submitting security fixes, although they may not support inactive projects. TrueSource packages will ensure ongoing security for enterprise clients who subscribe.