Broadcom Launches TrueSource, Betting on Human-Verified Patches for Open Source Libraries

Broadcom is betting that enterprises will pay for open source libraries a human has actually checked. At VMware Explore in Las Vegas on Aug. 31, the company announced TrueSource, a portfolio of commercially supported, verifiably built open source software. It extends Broadcom’s stewardship of the Spring Java framework to the wider Java ecosystem, Python, Node.js and several popular data engines.

Broadcom points to AI as the reason. AI tools are finding vulnerabilities faster, and attackers can weaponize them within hours. Fully automated AI patching is the obvious response, but Broadcom argues it isn’t safe yet. It cites new testing by 1Password’s Off-by-1 Labs, which found that only 26% of 6,000 AI-generated patches fixed the vulnerability without breaking the application.

“As AI accelerates both innovation and exploitation, that trust cannot rest on unverified, machine-generated patches. It has to rest on accountable engineering,” said Ram Velaga, president of Broadcom’s Infrastructure Software Group.

Three pieces

• Spring Enterprise provides curated Spring releases from the team that maintains the framework. Broadcom engineers scan Spring and its dependency tree with frontier models and verify every patch by hand. The company says they’ve spent more than 12 billion tokens on that work in the past five months. Coverage reaches beyond Spring to managed dependencies such as Apache Tomcat and Kotlin, which adds up to more than 5,000 Java libraries built and signed at the versions each supported Spring Boot line pins. Every supported release line is patched before a CVE is published, and customers can take CVE-only patches instead of full point releases.
• TrueSource Trusted Artifacts offers clean-room SLSA Build Level 3 builds of Java, Python and Node.js libraries. It also folds in the Bitnami Secure Images catalog of hardened container images.
• TrueSource Data Services provides validated distributions of PostgreSQL, RabbitMQ, MySQL and Valkey, including extensions, Operators and Helm charts, along with deployment automation and posture visibility.

Licensed customers can also bring vulnerabilities that aren’t public yet to Broadcom for early remediation. There’s a separate program for critical infrastructure operators. Tooling scans customer repositories and opens pull requests that apply the lowest-risk fix.

Upstream, not forks

Broadcom says it will send fixes upstream rather than maintain private forks. “With Spring and RabbitMQ, we are the maintainers. For other open source software, we will work with the maintainers. We believe that the community maintainers must remain the source of truth,” a VMware spokesperson told The Register.

TrueSource builds on a June effort in which Broadcom’s Spring team responded to a more than 1,700% surge in monthly security advisories reported by the Spring community. That work produced the largest set of security patches in Spring’s 23-year history. All three offerings are sold through tiered site licenses.

For security teams that pull straight from Maven Central, PyPI or npm, TrueSource is a paid alternative to treating scanner output as a to-do list. It will matter most to shops that run Spring at scale in regulated environments, where early patches and attested builds justify the cost of a commercial relationship.