CodeSupply open call (2026-11Y) - Open source, federated, and digitally sovereign database of software package metadata to strengthen software supply chain security.
European Commission · Horizon Europe Framework Programme (HORIZON) · cascade funding under HORIZON-CL4-2025-03-HUMAN-16
Posted 3 Sept 2026 · 33 days left
In plain terms
The European Commission funds development of CodeSupply, an open-source federated database of software package metadata to improve software supply chain security and open-source compliance. This cascade-funding call invites consortia of organisations in EU member states and associated countries to contribute to this effort, with a total budget of 400,000 euros and applications due by 3 November 2026.
A generated summary of the donor's text; the original wording is below.
Summary
Open data about software packages is critical for the automation and scale necessary to resolve software supply chain management and address security and regulatory and open source compliance challenges. CodeSupply aggregates and curates comprehensive software metadata, including origin and licensing information, security vulnerabilities, and quality metrics from distributed, authoritative data sources across programming ecosystems and software types. This metadata is assembled in reference data sets, federated in a unified data catalog for digital sovereignty and independence, and distributed as open data, freely available to all, using an open source data license.
The CodeSupply project pursues three interconnected objectives that directly address data challenges in cybersecurity, software supply chain management, and regulatory and open source license compliance:
Publish current, correct, and comprehensive software metadata
Establish a scalable and sustainable mechanism to provide democratic access to data sets
Create a foundational framework for future iterations, enhancements, and new data sets
CodeSupply will deliver an ambitious development effort, but this is a vast domain…
Excerpt from the donor's page. The full text, annexes and forms are on the original call.
Eligible regions
- eu_only
Who can apply
- ngo_cso
- academia_research
- private_company
- government
- consortium_required