Software supply chain, security and compliance tools all depend on accurate information about the packages they analyze, but that data is often fragmented across multiple sources and can be difficult to access or use consistently. A new European Union-funded initiative called CodeSupply, coordinated by the NLnet Foundation, is making €400,000 in grants available for open source R&D projects aimed at improving the availability, quality and interoperability of software package data.
For the current call, projects can request between €5,000 and €50,000, with proposals due Nov. 3. The funding is available for small to medium-sized research and development projects that contribute to CodeSupply’s goals around software supply chain security, software metadata, cybersecurity, open source license compliance and the reliability of the open internet.
Which Projects Are Eligible?
The call covers new and existing technologies with demonstrated real-world impact. Eligible activities range from scientific research and software engineering to security audits, formal security proofs, technical validation, documentation and standardization. The program can also support open source hardware development, usability improvements, participation in technical events, project management and essential infrastructure costs. Projects focused on open source license compliance may also qualify, including tools that help identify, document or manage licensing requirements.
CodeSupply lists publishing current, correct and comprehensive software metadata as one of its three main objectives. The initiative says more complete metadata can help with understanding and managing software components, dependencies, licensing information and security-related information. The call does not describe a specific type of metadata project, but says relevant work could include research, software development and other technical solutions, as well as mechanisms for making essential datasets more widely accessible across the open source and internet ecosystem.
Applicants are expected to show how their proposed work contributes to open source development and connects directly to CodeSupply’s objectives. Proposals should define the problem being addressed, describe the proposed technical work and explain its expected impact. To qualify, proposals must be written in English, align with CodeSupply’s goals, make research and development their primary objective and have a clear European dimension. Projects that pass that initial screening are evaluated on technical feasibility, relevance and potential impact, and value for money.
What is CodeSupply?
CodeSupply is part of the European Commission’s Open Internet Stack initiative, which aims to develop open, secure and reusable technologies that can serve as building blocks for digital infrastructure. The initiative builds on the EU’s earlier Next Generation Internet programs and is intended to give public agencies, businesses and individual users more control over essential technologies.
CodeSupply is a collaboration among four organizations. NLnet Foundation, a Dutch public benefit organization that leads the NGI Zero initiative, is coordinating the project. Other participants include AboutCode, a Belgian nonprofit focused on software package origin, licensing, provenance and software supply chain security; the Edsger Institute, a Dutch nonprofit specializing in reproducible hosting stacks and software composition analysis; and Universidad Rey Juan Carlos, a public research university in Spain. Funding for CodeSupply comes from the European Commission’s Directorate-General for Communications Networks, Content and Technology through Horizon Europe. Read more about CodeSupply here.