CodeSupply by NLnet: grants of EUR 5,000 to 50,000 for software supply chain security and open metadata

The CodeSupply open call is a grant initiative managed by the NLnet Foundation to support software supply chain security and open metadata management. Operating within the European Commission’s Open Internet Stack framework and funded via Horizon Europe under grant agreement No. 101298846, the programme provides cascading grants to advance strategic digital autonomy and trustworthy digital commons.

A total open call budget of EUR 400,000 has been allocated to fund small to medium-scale research and development projects. Individual awards range from EUR 5,000 to EUR 50,000 for work spanning between 1 and 12 months. The first call opened on September 3, 2026, and submissions are accepted until November 3, 2026, at 12:00 CET.

What is funded

The call finances practical contributions, auxiliary tools, and core technical solutions that advance software supply chain security, package metadata curation, and open source compliance. Eligible work includes publishing accurate software metadata, aggregating vulnerability and licensing information, and building reference data sets across diverse programming ecosystems.

Funding also covers integrations into free and open source software (FOSS) applications, implementation of open standards, improvements to key underlying infrastructure components, and user experience enhancements. Both entirely new concepts and efforts to scale existing, future-proof technologies to achieve practical, real-world impact are eligible.

Practical tip. Align your proposal explicitly with open standards and interoperability. NLnet places heavy emphasis on building reusable, federated building blocks that integrate into the wider Open Internet Stack rather than isolated, proprietary-leaning utilities.

Who can apply

The funding opportunity is accessible to individual developers, independent researchers, small and medium enterprises (SMEs), non-governmental organizations (NGOs), higher education institutions, and research institutes. Applicants can participate as independent contributors or established legal entities.

Applicants and their proposed projects must demonstrate a clear European dimension. The call encourages participation from both specialized technical researchers and broader open-source communities that can tangibly improve software supply chain resilience.

Conditions and requirements

Project results must be published and distributed under a recognized free and open source license, and any reference metadata produced must be made accessible under an open source data license. This mandatory condition ensures public accessibility and democratic access to datasets across the software ecosystem.

Funded activities must fit the technical objectives of CodeSupply and the broader Open Internet Stack initiative, supporting digital sovereignty and resilience. Projects must fall within the financial envelope of EUR 5,000 to EUR 50,000 and complete their milestones within the defined timeframe of 1 to 12 months.

How to apply

Submissions must be prepared in accordance with the CodeSupply guidelines for applicants and uploaded through NLnet’s online submission portal before the deadline on November 3, 2026, at 12:00 CET (noon). Applicants should review the official eligibility clauses and technical scope prior to filing.

NLnet hosts informational office hours and community sessions via Matrix to address specific applicant questions. Prospective candidates may consult the published guidance documents or attend these sessions to confirm that their work scope aligns with the call’s research criteria.

Applications are submitted on the donor’s page: nlnet.nl.