CodeSupply Open Call for open software package metadata and supply chain security

¿De qué trata esta convocatoria?

The call awards small research and development grants for projects that contribute to open, reliable software package metadata for supply chain security and licence compliance. Anyone can apply, including private individuals and organisations of any type.

¿Qué financia esta convocatoria?

Scope

CodeSupply aggregates and curates software metadata, such as origin and licensing information, security vulnerabilities and quality metrics, from authoritative sources across programming ecosystems. The data is assembled into reference data sets, federated in a unified catalogue and distributed as open data under an open-source data licence.

Objectives

• Publish current, correct and comprehensive software metadata.
• Establish a scalable and sustainable mechanism for open access to data sets.
• Create a foundational framework for future iterations, enhancements and new data sets.

Proposals are invited that help CodeSupply go further, with the key objective of breakthrough contributions to reliable software provenance metadata, better software supply chain management and support for regulatory and open-source licence compliance.

Support offered

Small to medium-sized R&D grants are awarded. Successful projects may later scale up in other programmes funded by NLnet, such as Restack.

Eligible activities

Activities qualify if they are cost-effective and clearly linked to the call objectives, for example:

• scientific research and the design and development of open-source software and open hardware;
• validation of existing or new technical solutions and software engineering to improve quality or adapt to new uses;
• formal security proofs, security audits, software testing and continuous integration;
• documentation and educational materials for researchers, developers and end users;
• standardisation work, including membership fees of standards bodies;
• user requirements, usability and inclusive design, and packaging for wider deployment;
• participation in technical and community events (admission, travel and subsistence), project management and essential infrastructure costs.

Conditions and evaluation

All scientific outcomes must be published as open access, and new software and hardware must be released in full under a recognised free and open-source licence. Proposals should focus on research and development, be concise (about two pages for the main application) and have a clear European dimension. They are scored on a 7-point scale for technical merit (30%), strategic relevance to the Open Internet Stack and CodeSupply (40%) and value for money (30%), and need a weighted score above 5.0. AI-generated proposals are in principle not welcome; any use of AI requires a full prompt log and marking of generated content.

¿Cuándo termina el plazo?

3 November 2026.