CodeSupply open call (2026-11Y)
OpenDescription
Open data about software packages is critical for the automation and scale necessary to resolve software supply chain management and address security and regulatory and open source compliance challenges. CodeSupply aggregates and curates comprehensive software metadata, including origin and licensing information, security vulnerabilities, and quality metrics from distributed, authoritative data sources across programming ecosystems and software types. This metadata is assembled in reference data sets, federated in a unified data catalog for digital sovereignty and independence, and distributed as open data, freely available to all, using an open source data license. The CodeSupply project pursues three interconnected objectives that directly address data challenges in cybersecurity, software supply chain management, and regulatory and open source license compliance: Publish current, correct, and comprehensive software metadata Establish a scalable and sustainable mechanism to provide democratic access to data sets Create a foundational framework for future iterations, enhancements, and new data sets CodeSupply will deliver an ambitious development effort, but this is a vast domain with many more challenges than what any preconceived effort could tackle by itself. This is why we invite your contribution to help us reshape the state of play, and together create an open, trustworthy and reliable internet for all. This is your opportunity to make a real difference. You tell us how your project can help CodeSupply go harder, better, faster, stronger. In order to enable you to make such contributions, we will award small to medium-size R&D grants towards solutions that bring the next generation of mobile solutions closer. We are seeking project proposals between 5.000 and 50.000 euro's — which should get you on your way. If the project works out well you can subsequently scale up in other programmes funded by NLnet such as Restack. Noteworthy fact: several projects within CodeSupply were themselves bootstrapped on precisely such a grant from NLnet, and now it is your turn.
Beneficiary & submission
Projects can be submitted through https://NLnet.nl/propose, please check this page as well as the guide for applicants for this programme before you start writing a proposal - this might save you a lot of work.
Anyone can apply, including private individuals and organisations of any type. Project proposals should be in line with the topic of the programme and should have research and development as their primary objective. Proposals should be complete and concise (no longer than the equivalent of two pages for the main application, see the submission form). Proposals should have a clear European dimension.
Projects are scored on a 7 point scale on three criteria: technical merit (30% weight), strategic relevance to the Open Internet Stack and expected contribution to the goals of CodeSupply (40% weight) and overall value for money (30% weight). The key objective is to deliver potential break-through contributions to the objectives of CodeSupply and publish reliable metadata about software provenance, improve software supply chain management, and support regulatory and open source license compliance. Projects will need a total weighted score above 5.0 (out of 7) in order to be selected.
The following types of activities qualify for financial support, provided they are cost effective and have a clear link to the topics directly relevant to CodeSupply and the objectives set out in the call:
- scientific research
- design and development of open source software and open hardware
- validation or constructive inquiry into existing or novel technical solutions
- software engineering aimed at adapting to new usage areas or improving software quality
- formal security proofs, security audits, setup and design of software testing and continuous integration
- documentation for researchers, developers and end users, including educational materials
- standardisation activities, including membership fees of standards bodies
- understanding user requirements and improving usability/inclusive design
- necessary measures in support of (broad)er deployability, e.g. packaging
- participation in technical, developer and community events like hackathons, IETF, W3C, RIPE meetings, FOSDEM, etc. (admission fee, travel and subsistence costs)
- other activities that are relevant to adhering to robust software development and deployment practices
- project management
- out-of-pocket costs for infrastructure essential to achieving the above
All scientific outcomes must be published as open access, and any novel software and hardware created is to be be published under a recognised free and open source license in its entirety.
Please note that there is a strict policy on the use of AI. In principle, AI generated proposals are not welcome. Any submission involving AI involves providing a full prompt log. All generated content should be marked as such, even if subsequently edited.
Further information
A more complete overview of the call text, proposal guidelines and an FAQ can be found on the main call page: https://NLnet.nl/codesupply