67 Open Technology Projects awarded NGI grants

Trustworthy hardware and manufacturing

• Apicula GW5A 60k & 138k — Open source toolchain for Gowin FPGAs

  Apicula is developing an open source toolchain for Gowin FPGAs. Open source tools avoid vendor lock-in and provide unique capabilities, but to avoid vendor lock-in you actually need to support multiple vendors. Apicula offers that, being the second most mature toolchain after Lattice thanks to previous grants. This grant furthers our support for their GW5A line of FPGAs, their most complex product line yet by a large margin.

  ▸ For more details see: https://nlnet.nl/project/Apicula-GW5A

• CflexHDL — C-based flexible hardware/software systems design

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/CflexHDL

• Dot Product Unit - DPU — Hardware accelerator for computing vector dot products

  The Dot Product Unit (DPU) is an open-source hardware IP block for efficient vector dot-product computation across multiple numeric formats, including INT8, FP8, BF16, FP16, FP32 and FP64. It serves as a reusable arithmetic component for matrix-multiplication engines and related compute blocks used in AI acceleration, scientific computing, graphics, DSP and processor architectures. The design uses a pipelined SIMD datapath to process packed vector operands in parallel and reduce the products to a scalar result. It focuses on low latency, efficient hardware reuse across supported formats, and precise numerical behavior, including defined handling of rounding modes, overflow, underflow, NaNs and infinities. The project delivers synthesizable RTL, documentation, integration examples and an open verification environment with golden models, modular scoreboards, directed and random tests, functional coverage and CI support. The goal of the project is to give the open-hardware community a reusable and well-documented dot-product IP for CPUs, GPUs, vector units, DSP blocks, tensor accelerators and custom FPGA or ASIC systems.

  ▸ For more details see: https://nlnet.nl/project/DPU

• Einszeit Quantum-Proof Encryption — Quantum-proof hardware security platform

  Einszeit is an open-source hardware security platform that uses One-Time Pad cryptography with hardware-generated true random keys to theoretically provide perfectly secure, quantum-proof encryption between two paired devices over any communications medium. This project aims to improve the hardware, firmware, software, and documentation, as well as to engage with developers and users in order to make perfectly secure communications user-friendly and widely available.

  ▸ For more details see: https://nlnet.nl/project/Einszeit

• Fazantix video streaming box — All-in-one Open Hardware capture and streaming box

  Live-streaming a conference is deceptively hard: coordinating cameras, laptops, audio, and encoding across multiple (sometimes even dozens!) of rooms requires reliable, purpose-built gear that most events cannot afford or build themselves.

  This project aims to deliver a compact, all-in-one capture and streaming box using open hardware and running free software with mainline Linux kernel support. The box ingests slides, camera feed and audio, mixes and hardware- encodes everything to 1080p h264, optionally mirrors a local backup, and pushes a stream to the network with minimal operator intervention. Battle tested at FOSDEM with 30 parallel tracks and events across Europe, Asia and beyond, this iteration focuses on slashing cost and size while making the system approachable enough for any conference to deploy without specialist knowledge.

  ▸ For more details see: https://nlnet.nl/project/Fazantix

• Funk — Compiler for hard real-time, functionally safe systems

  Funk is an effort to develop free and open-source tooling for functionally safe, hard-real-time systems. Safety-critical systems are increasingly common in the modern world: robots in factories, computerised medical devices, smart railways, and on-board processing in spacecraft all rely on computers and communications networks in applications where missing a hard deadline can end in property damage, severe injury, or loss of life. As the complexity of these systems grows, traditional manual or directed methods of testing will require more and more effort to prevent a design from diverging from its specification. The aim of Funk is to develop a compiler for a language with first-class timing concerns and where the targets are deterministic processors, allowing hard-real-time guarantees to be made at compile time by automated analysis, and to carry out this development to European Cooperation for Space Standardization (ECSS) assurance standards, building on previous work done for ESA’s Comet Interceptor mission.

  ▸ For more details see: https://nlnet.nl/project/Funk

• Iron Electrolytes and Stacks for Flow Batteries — Hybrid battery technology built from readily available materials

  Stationary energy storage technologies, notably chemical batteries, continue to play a key role in the development of clean and resilient electrical grids of all scales. Usually based on lithium or sodium-ion intercalation chemistries, these increasingly important components of our energy infrastructure are often highly proprietary, irreparable, flammable, and challenging to recycle. This project has two main objectives related to advancing open-source battery technology that seeks to address these concerns. First, development of a water-based, iron-salt chemistry for hybrid flow batteries, using a Water-in-Salt Electrolyte (WiSE) approach. Second, the demonstration of a scaled-up flow battery stack and system that is of sufficient size to power its own centrifugal pumps and a server. The iron chemistry will be explored using a previously designed flow battery development kit, and the scaled-up demonstrator will build off of an existing plate-and-frame stack design and a zinc-iodide chemistry, all currently in development by the Flow Battery Research Collective.

  ▸ For more details see: https://nlnet.nl/project/HybridFlowBattery

• Libre-Chip Programmable Decoder — Run multiple ISAs at full speed with an open CPU

  Modern computers are built on several different mutually-incompatible instruction sets such as x86, ARM, PowerISA, and RISC-V. Many of the most popular instruction sets have no high-speed libre/open-source CPUs, which makes those CPUs much harder to trust since you can't inspect their source-code to look for bugs or secret backdoors. Additionally, there are basically no existing modern CPUs which can run more than one of those ISAs without requiring software emulation, which is slow and can often be buggy. To solve those issues, this project is building a fast libre-licensed CPU that will support a programmable decoder - so the CPU can run nearly any instruction set at full speed. Another goal is to be able to prove that the resulting CPU doesn't have speculative-execution security flaws ("Spectre"-style bugs).

  ▸ For more details see: https://nlnet.nl/project/Libre-Chip-programmabledecoder

• mikroPhone drivers + GUI — Full-featured expandable mobile phone from off-the-shelf components

  mikroPhone is a device in the form factor of a mobile phone that features ARM computer acting as a smart-phone and RISC-V microcontroller acting as a feature phone. It is a fully open hardware device and it can easily be built in a home lab. It is intended to protect user's privacy to the highest possible level and to bring data sovereignty back to its users. The aim of this project is to implement Linux drivers, provide mobile GUI environment, introduce Android application support and improve applications for the microcontroller's operating system. This project will deliver a fully-featured smart-phone with emphasis on privacy, security and extensibility.

  ▸ For more details see: https://nlnet.nl/project/mikroPhone-drivers

• pcb-rnd + sch-rnd alien formats — Importers for proprietary file formats in Ringdove EDA

  Ringdove EDA is a modular, portable Electronics Design Automation toolkit (primarily for Printed Circuit Board design) with a distinctive focus on the UNIX philosophy. The two flagship subprojects are sch-rnd (schematics capture) and pcb-rnd (printed circuit board editing). Because of the modular code and reduced dependencies, both projects are highly portable, both in time (old, present and future systems) and in workflows (interactive GUI, interactive CLI or headless automated processing). Ringdove also strives to support file formats of other EDA software, especially for loading proprietary formats, making existing/legacy hardware designs more accessible to the Open Source community.

  ▸ For more details see: https://nlnet.nl/project/Ringdove-alienformats

• QUAntum bits of This and That (QUATT) — Design and understand solid-state quantum circuits

  QUAntum bits of This and That (QUATT) has the objective of providing visual outreach tools to design and understand solid-state quantum circuits based on the FrugalEDA software design suite for superconductors. QUATT fills the gap between the quantum properties of superconducting devices obtained by simulations, including quantum interferences and qubits states and intrication, and innovative visual representations that capture the essence of the physics of such systems and help the end-user to design quantum circuits more intuitively.

  ▸ For more details see: https://nlnet.nl/project/QUATT

• Reverse Engineering Toolkit: Platform — Development platform for signal processing

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/Unbinare-RET-Platform

Network infrastructure incl. routing, P2P and VPN

• FiberQ + FiberQ Designer — Interoperable open tooling for fiber rollout

  FiberQ is a free and open-source toolchain for designing, documenting and validating fiber-optic access networks, FTTH, GPON and underlying duct infrastructure - inside the open QGIS ecosystem. The FiberQ QGIS plugin (GPL-3.0-or-later) has been in production since v1.0 in December 2025, with several feature releases since, and provides a dedicated infrastructure data model and repeatable workflows that take design through to documentation and QA without leaving open formats. FiberQ Designer (AGPL-3.0-or-later), a browser-based companion in active development, extends the same open data model to the web with a map view, a splice manager, network diagrams and a manhole/chamber editor. This grant funds the next major plugin release - schema migrations, automated topology and attribute validation with audit-ready reporting, performance work for large projects, automated tests with CI, and import/export tooling built on GeoPackage and GeoJSON - together with the initial beta foundations of FiberQ Designer on the same open codebase. The project targets municipalities, smaller operators, contractors and engineering teams that today rely on proprietary CAD/GIS suites with non-portable data formats.

  ▸ For more details see: https://nlnet.nl/project/FiberQ

• Multipath TCP on Linux mobile devices — Improve mobile support for MPTCP and add cost-aware path control

  Multipath TCP (MPTCP) is a standardised technology extending TCP and invented in Europe. TCP is one of the key protocols of the TCP/IP protocol stack, designed in the 1970s when hosts were attached to the network through a single cable. Today's hosts have several network interfaces, but TCP only uses one of them for a given connection. Multipath TCP solves this problem by enabling TCP connections to exchange packets over different network interfaces. This is very interesting in mobility use-cases, for devices with both Wi-Fi and cellular. This grant will focus on improving MPTCP support on Linux mobile phones and tablets.

  ▸ For more details see: https://nlnet.nl/project/MPTCP-LinuxMobile

• RPSL member enhancements — Enhance Routing Policy Specification Language + IRRDv4 implementation

  This project plans to expand the Routing Policy Specification Language (RPSL) with new features. RPSL is, roughly, the syntax of the IRR, a sort of collaborative database, used for filter configuration on BGP routers on the internet. Through all those layers, this project will improve the internet's resilience against accidental or malicious improper routing changes. This project includes standards development through the IETF, and implementation in IRRD,the most commonly used IRR server. As part of the IETF process, we'll collaborate with other implementors and internet operators to ensure interoperability that fits in with operational reality. Challenges include maintaining full backwards compatibility with existing systems - something that RPSL was not designed for - while ensuring partial upgrades already are effective at improving internet resilience.

  ▸ For more details see: https://nlnet.nl/project/RPSL-enhancements

• Self-hostable SelfPrivacy via Tor — Making SelfPrivacy Resilient and Self-hostable via Tor with self-signed SSL certificates.

  This project aims at making SelfPrivacy and similar solutions self-hostable over Tor. SelfPrivacy is a reproducible, free and open source self-hosting stack based on NixOS that helps you set up and manage your self-hosted services. It installs open source services such as E-Mail, Nextcloud, Jitsi, etc. SelfPrivacy and automates the entire lifecycle: provisioning, updates, configuration changes, monitoring, backups and space management. Currently, you need to register with a provider and copy the access token into the SelfPrivacy application.

  By making it self-hostable over Tor, anyone can run it on any old laptop, without having to register anywhere. Additionally, it removes any financial barrier to trying out and/or using SelfPrivacy. Instead of having to register, you can generate the private and public key pair for a new onion domain or enter a private key of a previously discovered onion domain. This project will also allow you to run SelfPrivacy on your own domain over HTTPS and intends to generalise the support for alternative nets, such that support for for example Freenet, Hyphanet, Yggdrasil etc. can be easily added.

  ▸ For more details see: https://nlnet.nl/project/SelfPrivacy-Tor

• µTCP — TCP/IP implementation derived from HOL4 formal specification

  In this project, we will bring µTCP to an initial stable release. It originates from the research project NetSem (by Peter Sewell et al), which developed an executable specification of TCP/IP in HOL4. This specification is tested against Linux, FreeBSD, and Windows. It is a precise model of what to expect and allow out in the wild - different from the hundreds of pages of RFCs.

  µTCP has been manually translated to OCaml, and several design decisions have been taken. Some features are not in scope of µTCP. In this project, we will work on a stable release of µTCP, and focus on features (SACK, pluggable congestion control, path MTU discovery, ..), and do a lot of performance engineering.

  ▸ For more details see: https://nlnet.nl/project/microTCP

Software engineering, protocols, interoperability, cryptography, algorithms, proofs

• DMRSEC — Security audit of Digital Mobile Radio

  Digital Mobile Radio (DMR) is an important standard used by emergency services and critical infrastructure globally. New cheap DMR chipsets have made DMR very popular and existing FOSS projects grant DMR the potential to be the most affordable, FOSS-friendly radio standard for use-cases where TETRA or LTE/5G are too heavy or expensive. However, security is not part of the standard and only available through proprietary or non-public DMR Association specifications. As a result, no public security audit of DMR exists and FOSS projects lack any security capabilities which hampers adoption for serious use-cases. The DMRSEC project will perform a thorough DMR security audit, design an improved open DMR security architecture, and integrate said architecture into FOSS projects for affordable COTS hardware.

  ▸ For more details see: https://nlnet.nl/project/DMRSEC

• Nexus — Cross-platform GPU multiphysics simulation for games, robotics, and machine learning

  Nexus is a cross-platform GPU multi-physics simulation engine capable of running on all major GPU hardwares both natively and on modern web browsers. Based entirely on open-source technologies, it offers a wide range of physics solvers, covering a large variety of applications ranging from games and animation, to robotics and datasets generation for AI training. Nexus is a major piece of a nascent open-source cross-platform GPU scientific computing ecosystem that breaks free of vendor lock-ins by leveraging open standard like Vulkan and WebGpu while preserving high performance and pleasant developer experience. Through the use of the Rust programming language on the gpu (and thanks to the rust-gpu compiler backend) this ecosystem aims to democratize GPU computing by enabling developers to write cross-platform GPU code in a mainstream programming language with high-level constructs and a rich open-source community.

  ▸ For more details see: https://nlnet.nl/project/Nexus

• Ovolesti — Gnu Octave bindings for the volesti library

  Ovolesti brings the volesti library to GNU Octave through native bindings, enabling users to work with efficient high-dimensional sampling, volume estimation, and geometric probability methods in a free, open-source scientific computing environment. The project is intended to make these advanced methods easier to access from Octave. The resulting library will expose Octave functions that directly replace the core functionality of existing MATLAB-based packages through compatible calling conventions, while at the same time offering a broader and more complete set of methods. In this way, the project will give Octave users a modern, all-in-one toolbox. In addition, it will provide documentation, tests, and packaging support so that the resulting interface is practical, maintainable, and an important resource for research, teaching, and reproducible work in engineering applications.

  ▸ For more details see: https://nlnet.nl/project/Ovolesti

• Ribbit — Ribbit: An Portable Platform for Language Interoperability

  Ribbit is an extensible compiler for the Scheme (and soon, Lua) language designed to be portable across vastly different computing environments. This is done by generating compact and embeddable executables that can be extended with the target language when necessary. Currently, Ribbit supports 25 targets with interoperability to each of them, allowing execution inside Web applications, memory-constrained microcontrollers, POSIX-shell scripts and most common programming languages.

  The next milestone in the Ribbit project is to support Lua and the R7RS Scheme standard as input languages. This will enable full interoperability between Scheme, Lua and any of the 25 languages currently supported by Ribbit. This is a first step in proving Ribbit's viability as a universal platform for language interoperability.

  ▸ For more details see: https://nlnet.nl/project/Ribbit

• Stable GADT constructor syntax in Haskell — Generalized Algebraic Data Types for GHC (#402)

  Haskell is a purely functional programming language with a free and open-source compiler (GHC), as well as a mature ecosystem of open-source libraries for server-side programming (warp, wai, servant, scotty, etc), client-side programming (http-client), and blog generation (hakyll).

  "Stable GADT constructor syntax" is a proposed refinement to the Haskell specification that brings clearer rules and stronger stability guarantees to GADTs (generalized algebraic data types), a type system feature used to eliminate entire classes of bugs at compile-time. The new specification of GADTs lifts restrictions on the order of type arguments and constraints, giving library authors greater flexibility in API design. This is important for wider adoption of GADTs, leading to fewer defects in Haskell software, which matters especially for networking applications. This project should result in a complete implementation of the new specification and its inclusion in the next compiler release.

  ▸ For more details see: https://nlnet.nl/project/Haskell-GADT-GHC.402

• Towards AtomVM v1.0 — From-scratch implementation of the Erlang

  AtomVM allows building embedded applications - IoT firmware, sensor nodes, devices on wireless or mesh networks such as LoRa - with a functional, concurrent and memory-managed programming model, and supports new web architectures where the same ecosystem used on the backend can also run on the frontend. Together, these features extend the BEAM ecosystem beyond servers and into smaller, local-first, more personal and decentralised computing environments.

  The project’s current focus is extending hardware support beyond what is supported right now, enabling new silicon vendors through existing abstraction platforms. The project is also moving toward a 1.0 release, so the focus is also on polishing current APIs and improving overall security, stability, and performance in order to deliver a rock-solid 1.0 release.

  ▸ For more details see: https://nlnet.nl/project/AtomVM

Operating Systems, firmware and virtualisation

• DISTRHO Plugin Framework — Wayland, Web UIs and documentation/polishing for DPF

  DPF is a small but powerful framework for building audio plugins that allows developers to export multiple tool-specific plugin formats from the same code-base. Wayland is a protocol and architecture for applications to talk to a display server and get input from the user. This grant serves to support Wayland for audio plugin UIs within DPF, which will also be useful in general for any other frameworks. The project will also tackle Web UIs too, using the underlying OS browser component. A final step consists of improving documentation and a polishing phase to bring DPF's overall quality to the next level.

  ▸ For more details see: https://nlnet.nl/project/DPF

• Landlock observability and telemetry — Add kernel observability and telemetry features to Linux Security Module

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/Landlock-kernelobservability

• PrismaFS — Portable userspace filesystem with isolated session layer

  PrismaFS is a lightweight, portable userspace filesystem that lets you compose multiple directory trees into a single transparent view - where all writes are captured in an isolated session layer, the originals are never touched, and discarding the session returns everything to exactly the state it was. PrismaFS acts as zero overhead wrapper around any directory on your system, bringing portable filesystem-level isolation to major Unix families, without needing a container runtime, a daemon, or root. Planned deliverables include symlink and full POSIX ownership support, Linux portability via libfuse, named and exportable sessions (enabling reproducible and shareable filesystem states), a rich session audit toolchain with native or portable GUI, cryptographic session signing for verifiable change records, and expanded synthetic dev namespace exposing live system state as readable files - bringing the Plan 9 philosophy of "everything is a file" directly into the merged view.

  ▸ For more details see: https://nlnet.nl/project/PrismaFS

• River window management protocol — Dedicated window management protocol for non-monolithic Wayland compositors

  River is a non-monolithic Wayland compositor. Unlike other Wayland compositors, river does not combine the compositor and window manager into one program. Instead, river provides a stable window management protocol to build on top of, significantly lowering the cost of writing and maintaining Wayland window managers and desktop/mobile environments; it is no longer necessary for each project to write and maintain an entire compositor as well.

  While the river window management protocol is stable and the design proven, there is a long tail of compositor and protocol features needed to support more advanced and diverse use cases. This grant will be used to close the gap between river and the currently more mature, monolithic alternatives, building a foundation for desktop/mobile environments competitive with the likes of GNOME, KDE, macOS/iOS, and Android.

  ▸ For more details see: https://nlnet.nl/project/River-protocol

• Servo Multimedia — Improve multimedia support in Servo browser

  Servo is a web rendering engine written in Rust, with WebGL and WebGPU support, and adaptable to desktop, mobile, and embedded applications. Built with safety, speed, and concurrency in mind, Servo showcases the potential of Rust for modern web development. Servo Multimedia project is about improving multimedia playback on Servo. The main goal is to provide an initial support for the Media Source Extensions standard, which is a fundamental piece for playing multimedia content on many websites. In addition, we'll also work on fixing other generic issues related to the HTML audio and video elements, and media playback in general.

  ▸ For more details see: https://nlnet.nl/project/Servo-multimedia

• Servo Writing Modes — Improve Servo layout engine with writing modes

  Servo is a web rendering engine written in Rust, with WebGL and WebGPU support, and adaptable to desktop, mobile, and embedded applications. Built with safety, speed, and concurrency in mind, Servo showcases the potential of Rust for modern web development. Servo Writing Modes project will continue the previous efforts that allowed us to greatly improve the Servo layout engine. In this project we'll work on adding support for the `writing-mode` CSS property, a key foundational feature for a layout engine very important for internationalization.

  ▸ For more details see: https://nlnet.nl/project/Servo-writingmodes

• Virtualized Redox — Redox as a Web Server Runtime, hosted in a Virtual Machine

  Redox OS is a Unix-like microkernel-based operating system written in Rust, intended for both the cloud and the desktop. In this project, we will take strides towards enabling the use of Redox as a secure hosted runtime for web services, running in a virtual machine. Improvements to file systems, POSIX compliance, WebAssembly System Interface (WASI) support, and other related features will be implemented. A simple WebAssembly (WASM) microservice will be implemented, to be used for performance and stability testing.

  ▸ For more details see: https://nlnet.nl/project/Redox-virtualised-microservices

• Waldo — New Web browser based on Servo engine

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/Waldo

• wayland-epd — Better desktop rendering on electrophoretic displays

  epd-wayland improves the visual fidelity of the modern Linux/UNIX graphical desktop on electrophoretic / e-reader displays by communicating rendering requirements from application to display driver. Latency-focused free and open source solutions such as Modos Glider and the Pine64 PineNote support a number of operating modes that balance latency, bit depth, and display artifacts. Mostly static content such as text benefits from slower, high-fidelity updates while dynamic content such as video playback or scrolling surfaces requires higher framerates to be displayed in a non-disruptive way. Integrations exist that address this problem on a per-window level, but in practice these still rely on a driver-internal refresh for most applications. epd-wayland allows applications to communicate rendering preferences on a more granular level to the wayland compositor, which in turn can communicate these to the display driver or controller. The result are native graphical applications whose textual outputs and menus are displayed clearly from the start while seamlessly switching to low-latency updates for regions that demand it.

  ▸ For more details see: https://nlnet.nl/project/epd-wayland

• xdgmime — Unit and fuzz testing for reference shared-mime-info implementation

  xdgmime is a widely used library for working out what desktop application to open a file with by looking at the file’s contents. It is a foundational library on the majority of Linux desktops. Unfortunately it does not have good test coverage and has not undergone fuzzing or other modern security testing. As it is used in conjunction with potentially malicious files, this is a risk. This project therefore aims to improve the testing of xdgmime and fix any issues which are found, thus improving security of the Linux desktop.

  ▸ For more details see: https://nlnet.nl/project/xdgmime

• Integration of GNU Taler in GNU Guix — Package Taler components in Guix functional package manager

  This project is about adding the main components and extensions (fifteen packages in total) of the GNU Taler project to the official GNU Guix distribution, with the aim of making GNU Taler more widely available. GNU Guix can be used with any GNU/Linux distribution and has a strong focus on user freedom, reproducibility and referential transparency, providing a trustworthy foundation for security-sensitive applications like GNU Taler.

  For more details see: https://nlnet.nl/project/Taler-iOS-automation/

• Magic Nix VFS — Lazy-loading Virtual File System for the Nix store

  Magic Nix VFS is a new VFS project for Nix that aims to optimize certain common scenarios and unlock new use cases for the Nix/NixOS ecosystem. It allows for the transparent distribution of software on-demand from Nix cache servers to client machines. Programs on the clients run from a "virtual Nix store" that makes all programs that were ever built available directly without a specific installation step, downloading files in the background as they are used. This provides a simple and efficient model for distribution of build artifacts in cluster environments such as HPC clusters or Internet service platforms. Magic Nix VFS integrates transparently with the Nix daemon, allowing to keep full Nix functionality on all machines. Being built on top of Nix ensures that this process is secure and reproducible.

  For more details see: https://nlnet.nl/project/Magic-Nix-VFS/

• Island sandboxing tool — Sandboxing tool to help secure day-to-day workflows

  The project summary for this project is not yet available. Please come back soon!

  For more details see: https://nlnet.nl/project/Island-Sandboxing/

Measurement, monitoring, analysis and abuse handling

• Alternative algorithms for selective data disclosure — Alternative Algorithms for Privacy Audits of Aggregated Tabular Data

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/SelectiveDataDisclosure

• Dep-scan memory-safety risk analysis — Static analysis to identify memory-safety issues

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/OWASP-dep-scan-memorysafety

• DrFed — Web-based development and debugging platform for ActivityPub

  DrFed is a web-based tool for debugging ActivityPub federation failures. ActivityPub implementations often differ in small but important ways, and developers may have to inspect cryptographic signatures, JSON-LD processing, and object discovery by hand to find out why two servers do not federate. DrFed makes these failures easier to trace. The tool includes an activity monitor showing where delivery failed and at which stage, inspectors for ActivityPub objects and WebFinger responses, a step-by-step signature debugger covering the signing schemes used across the fediverse, a JSON-LD toolkit that shows how different implementations process the same document, and an activity builder for constructing and sending test activities. DrFed can be self-hosted but is also available as a hosted service.

  ▸ For more details see: https://nlnet.nl/project/DrFed

• Open Instrument Control (OIC) — Open protocols for test and measurement

  Open Instrument Control (OIC) is a suite of open-source transport-level protocols for communicating with test and measurement (T&M) instruments, such as oscilloscopes and digital multimeters. Currently, only proprietary solutions exist, with limited platform support and restrictive licensing. Researchers must manage complex dependencies and cannot assume compatibility across devices and platforms. Consequently, lab automation is uncommon, leaving significant unrealised efficiency gains. OIC provides an open-source alternative which is cross-platform by default and can be bundled into a binary, eliminating friction. Specifically, OIC will deliver implementations of HiSLIP (LAN) and USBTMC (USB) protocols, each of which will be validated in real-world experiments. Scientists and engineers working with test and measurement devices will have access to free and portable libraries for automating their lab workflows. OIC eliminates obstacles which have to date restricted lab automation and allows anyone to freely build software based on it, fostering greater competition in the industry.

  ▸ For more details see: https://nlnet.nl/project/OpenInstrumentControl

• os-test expansion — Comprehensive POSIX compliance test suite for operating system implementations

  os-test measures interoperability and differences between every POSIX operating system (Linux, BSD, macOS, and many more). This project expands os-test by adding API definition files for historical POSIX versions. It will also add an exhaustive test suite to test if each POSIX program and that each option works correctly, and expand the basic test suite to use each symbolic constant in the standard library headers at least once. Additional miscellaneous test suites will be added as well. The final outcome is that os-test has a 100% basic coverage of every POSIX facility available to application programmers and users, and an ever-increasing detailed coverage of selected subsystems.

  ▸ For more details see: https://nlnet.nl/project/os-test

• SBOMVert — Generate, compare, and unify SBOMs and vulnerability reports

  SBOMVert is an open-source utility designed to simplify the comparison, normalization, and harmonization of Software Bills of Materials (SBOMs) across different formats and tooling ecosystems.

  As organizations increasingly adopt SBOMs for software supply chain security, they often encounter inconsistencies between formats such as SPDX and CycloneDX, as well as variations introduced by different generators and scanners. SBOMvert addresses this challenge by providing a consistent way to analyze and reconcile SBOM data, enabling teams to identify discrepancies, align component metadata, and improve interoperability between security and compliance workflows. By supporting SBOM comparison and harmonization, SBOMvert helps security teams reduce noise caused by duplicate or mismatched component records while improving the reliability of downstream tooling such as vulnerability scanners, policy engines, and asset inventories. The tool contributes to a more standardized SBOM ecosystem, making it easier for organizations to integrate SBOM analysis into CI/CD pipelines and broader software assurance initiatives.

  ▸ For more details see: https://nlnet.nl/project/SBOMVert

• SecObserve+ — Automated workflow for software supply chain management

  The project SecObserve+ integrates three established tools, SecObserve, ScanCode, and VulnerableCode, to improve visibility and security across software supply chains. SecObserve orchestrates an automated workflow in which ScanCode performs deep codebase analysis to identify dependencies, licenses, and copyrights, while VulnerableCode provides direct access to a FOSS vulnerability database, removing the need for intermediary scanners. The project aims to significantly reduce vulnerability detection time and strengthen SecObserve's Software Composition Analysis capabilities, contributing to a more secure and transparent open source ecosystem.

  ▸ For more details see: https://nlnet.nl/project/SecObservePlus

Middleware and identity

• AppBundler Expansion — Tool to create cross-platform installers

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/AppBundler-expansion

• Distributed key management in Hockeypuck — Next generation OpenPGP Keyserver

  Encryption key management is usually implemented using centralised trust roots, such as the X.509 Certificate Authorities, or authoritative keyservers, such as those operated by Signal and Meta. OpenPGP instead relies on a distributed network of independent keyservers, and the famous “web of trust”. GDPR compliance and spam prevention present particular challenges in such a distributed system. Hockeypuck is a modern synchronising OpenPGP keyserver application written in Go and AGPL licensed. This project will update Hockeypuck to provide robust and decentralised management tools for both users and operators, including keyholder self-sovereignty, distributed blocklists, enhanced abuse and error detection, and noninteractive email proofs.

  ▸ For more details see: https://nlnet.nl/project/Hockeypuck-distributed-keys

• SCIM Python Framework and Integrations — Further integration of System for Cross-domain Identity Management

  The SCIM provisioning protocol is an essential tool for alternative or self-hosted cooperation suites. It allows users and group synchronization between services, and manage permissions. The goal of this project is to strenghten the SCIM ecosystem by improving the main Python framework, and use it to implement the protocol in popular FLOSS services. We want to bring SCIM to the LaSuite projects, and implement a middle-ware solution for the Synapse Matrix server.

  ▸ For more details see: https://nlnet.nl/project/SCIM-integrations

Decentralised solutions, including blockchain/distributed ledger

• FogDHT — Secure, embeddable Distributed Hash Table in Rust

  FogDHT is a free and open-source Distributed Hash Table implementation designed to address common weaknesses in existing DHTs and provide a more resilient foundation for decentralised applications. By combining local discovery methods with decentralised bootstrapping, FogDHT will allow peers to find each other and form the network even without reliable internet access, making it useful during internet shutdowns, disaster situations, community networks and other constrained environments. The project will also introduce cryptographic and architectural improvements to reduce exposure to Sybil, Eclipse and routing-manipulation attacks, while remaining lightweight and modular enough to run across many kinds of devices, from servers and desktops to smartphones, embedded routers and mesh-network nodes. Its Rust library and standalone daemon will enable peers to contribute according to their available resources, and will provide a flexible API that developers can use to build fully decentralised, censorship-resistant and disruption-tolerant applications on top of a resilient and secure peer-to-peer network.

  ▸ For more details see: https://nlnet.nl/project/FogDHT

• Nocloud — Remote storage platform for individuals and families

  Nocloud is a file-hosting platform designed for self-hosting and regional deployment. Individuals, families and small businesses are encouraged to deploy their own instance or create an account on an existing one that they trust and, ideally, that is physically close to them. First-class support for WebDAV provides interoperability with a wide range of existing software. WebDAV ACL support adds fine-grained access control and file sharing. The lightweight web UI lets users browse their files and use nocloud-specific features from most devices with a web browser, including older, slower ones. This grant will be used to implement the features still missing for nocloud to serve as primary personal file storage in everyday use.

  ▸ For more details see: https://nlnet.nl/project/Nocloud/

Data and AI

• Open Food Facts Explorer — Modern front-end for Open Food Facts

  Open Food Facts Explorer is a new, modern frontend for the Open Food Facts database (8M monthly visitors) and its sister databases. Originally a side project to test the speed of SvelteKit, it has evolved into an official project. The goal is to create a feature-complete, user-friendly replacement to the classic website that separates the view layer from data management, finally offering us: increased user happiness and attract more users with a better value proposition, increased contributions (decoupling frontend and our Perl backend) by decreasing the barrier of entry for web devs thus opening it to a broader community, making the effort more sustainable and distributed while increasing software quality and velocity along the way, dogfood our own API as we did for mobile which benefits the whole ecosystem and finally reduce technical debt and avoid the need to code in Perl for any frontend development.

  ▸ For more details see: https://nlnet.nl/project/OFF-Explorer

• OpenStreetMap iD tagging schema overhaul — Improve OSM iD tagging to expand capabilities of OpenStreetMap editors

  OpenStreetMap's iD tagging schema is a machine-readable description of key-value parts describing OSM objects. A comprehensive tagging schema allows normal people to contribute to OpenStreetMap and enables translation of descriptions. But there are known deficiencies to the tagging schema. This project will create a human-readable view of presets in one place, with context based on OSM Wiki and Data Items, taginfo statistics and other sources of documentation. It will also implement unified comparison of iD presets with Vespucci presets, JOSM presets and taginfo statistics to find discrepancies, mismatches and missing support.

  ▸ For more details see: https://nlnet.nl/project/OSM-iD-tagging

• pgmpy: Open-Source Infrastructure for Causal AI — Machine learning for determining cause-and-effect relationships

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/pgmpy

Services + Applications (e.g. email, instant messaging, video chat, collaboration)

• Castopod v2 — ActivityPub-capable podcast server

  Castopod is an open-source podcast hosting platform that is part of the Fediverse, with hundreds of server instances and the largest instance boasting as much as over 1,500 active podcasts and 65,000+ episodes in 25 languages. Building on this foundation, Castopod v2 will improve media management, federation reliability, monitoring, and safeguards against unauthorized AI scraping. This will help make decentralized podcast publishing more resilient, scalable, and aligned with open internet standards.

  ▸ For more details see: https://nlnet.nl/project/Castopod-v2

• Follow-me slideshow for Jitsi — Accessible Collabora Online slideshow plugin for videoconferencing

  Sharing slide presentations during video calls today relies on screen-sharing a video stream: viewers see opaque pixels, are locked to the presenter's pace, and are limited by network bandwidth and codec quality, which makes the content inaccessible to screen readers and unsuitable for users who need extra time to understand each slide. This project will add a follow-me slideshow plugin to Jitsi that integrates Collabora Online, sending the slide content directly to each participant's browser instead of a video stream: attendees will get the slides at native resolution with locally rendered, GPU-accelerated transitions; screen readers will be able to reach the slide text for genuine accessibility; and viewers will be able to follow the presenter or go back and resume at their own speed, ending the all-or-nothing trade-off of today's video-based screen sharing.

  ▸ For more details see: https://nlnet.nl/project/Follow-me-slideshow-Jitsi

• Full Accessibility of the LaTeX Ecosystem — Systematic Tagging of Heading Structures in LaTeX

  LaTeX is a widely used system for technical and scientific publishing, especially in mathematics, physics, computer science, and other STEM fields. Recent work by the LaTeX Team has improved the accessibility of core LaTeX output, making accessible PDF documents possible without manual remediation work. However, many widely used document classes and extension packages still do not fully support accessibility requirements.

  This project addresses that important gap by making major LaTeX extension packages accessibility-ready, using LaTeX’s template model. In the first phase, we will implement accessible heading structures and related document-class support for the most important packages used in scientific publishing. Later phases will extend this work to additional document elements and broader package coverage. The expected final outcome is a more accessible LaTeX ecosystem, allowing researchers, students, publishers, and organizations to automatically produce accessible PDF documents with minimal changes to existing workflows. By improving widely used document classes and extension packages, the project will make accessible scientific publishing possible by default for a broader community, including people with disabilities.

  ▸ For more details see: https://nlnet.nl/project/LaTeX-Ecosystem-A11y

• MistServer Video-on-Demand — Turning MistServer into an open distributed caching and processing node for VoD

  MistServer is a media server toolkit with a focus on live streaming in all modern "consumer" formats. It makes it possible for developers without in-depth knowledge of media to still build efficient and capable media-heavy services and systems. This project extends MistServer's capabilities further towards video on demand, bringing media processing (e.g. transcoding, subtitle generation, etc) and caching (efficient replication across many nodes) into the core feature set of the software. This way, MistServer will allow anyone to easily build their own multi-server media storage, processing and playback system for either offline/online public/private use.

  ▸ For more details see: https://nlnet.nl/project/MistServer-VoD

• PeerTube Scalability — Horizontally scalable video hosting

  PeerTube is a free-libre and federated video platform that empowers anyone to self host video content without being isolated in the wide web. Many institutions have started using PeerTube to reclaim control over their video hosting. By choosing PeerTube, these institutions offer a wider audience the opportunity to familiarize themselves with PeerTube.

  With this proposal, we want to improve PeerTube's scalability, allowing very large institutions to handle high traffic without additional costs. To achieve this, we plan to enhance PeerTube's performance by enabling it to run on multiple nodes and by addressing identified bottlenecks. We also want to improve user management to make it easier to moderate large-scale platforms, even with a limited moderation team. Finally, we plan to continue improving our mobile app to ensure it offers the same useful features as the web application.

  ▸ For more details see: https://nlnet.nl/project/PeerTube-Scalability

• Plugging end-to-end encryption in Posca — End-to-end encrypted communication client

  Posca is a self-hosted, end-to-end encrypted communication client built on the Matrix protocol, combining chat, forums, microblogging, and media sharing in a single interface. Posca relies exclusively on the standard client-server API, making it easy to use with any homeserver. It is made to interoperate with other Matrix clients and the wider federated Web. It is designed for communities and collectives of all sizes, from civil society organisations and labour movements to citizen assemblies and hackerspaces, to communicate and organise outside of corporate, surveillance-based platforms.

  ▸ For more details see: https://nlnet.nl/project/Posca

• Fleetbase × Taler: Payments for Global Logistics — Enable Taler payments in logistics/supply chain software

  Fleetbase × Taler will integrate GNU Taler into Fleetbase, an open-source logistics and supply chain operating system used to manage transportation, deliveries, fleet operations, warehousing, and supply chain workflows. The project will develop an open-source extension that enables organizations to generate invoices, accept GNU Taler payments, issue refunds, and automatically reconcile transactions within Fleetbase. The integration will enhance Fleetbase Ledger, which provides invoicing, accounting, transaction management, customer wallets, and financial reporting, while also supporting payment workflows across other Fleetbase modules. By combining privacy-preserving digital payments with open logistics infrastructure, the project will help logistics and transportation organizations manage operational and financial processes within a unified open-source platform, reducing dependence on proprietary payment providers and supporting greater technological sovereignty.

  ▸ For more details see: https://nlnet.nl/project/Fleetbase-Taler/

• Taler PoS

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/TALER-POS/

• Taler iOS automation

  The project summary for this project is not yet available. Please come back soon!

  ▸ For more details see: https://nlnet.nl/project/Taler-Guix-packaging/

Vertical use cases, Search, Community

• CoMaps Cycling Maps and Fresh Map Updates — Easy-to-use, privacy-focused offline mobile map app

  CoMaps is an easy-to-use and privacy-focused offline mobile map app (Android and iOS, and an experimental Qt version) - for travelers, drivers, hikers, and cyclists. It is a fully Free and Open Source Software and is powered by open data commons like OpenStreetMap and Wikipedia. CoMaps is run by a community of volunteers, is non-profit and transparent. The planned improvements are: a dedicated cycling map style; automation of releases and maps generation process to reduce burden on maintainers and reliance on particular contributors; providing more frequent and independent map updates including ability to choose a maps server and share and sideload map files between phones.

  ▸ For more details see: https://nlnet.nl/project/CoMaps

• Generic e-invoicing module for Dolibarr — Support for electronic invoicing platforms

  Dolibarr ERP CRM is an open source software suite to manage organisations (customer and supplier management, quotes, orders, invoices, stocks, human resouces, accounting, ...). This project consists of completing, testing and improving reliability of an official, generic module between Dolibarr ERP CRM software and electronic invoicing platforms (PA/PDP). There is a widespread adoption of electronic invoicing at European level, which aims to ensure that all European companies are able to issue and receive electronic invoices by 2035. Two standards have been adopted at the European level for the exchange of these invoices: Factur-X (a hybrid PDF/XML format) and Peppol (which is XML-based). The module will allow Dolibarr user to benefit from e-invoicing that is compliant with current regulations. The module should be compatible with the European Peppol network. Prototype-level tests have already been successfully carried out.

  ▸ For more details see: https://nlnet.nl/project/Dolibarr-e-invoice

• Karrot UX — Community self-organisation, building and governance

  Karrot is made to support group coordination and community-building on a grassroots local level. Some of main features Karrot offers are the booking of activities, context-defined communication, full transparency of members' actions and their respective roles. Karrot is also unique for not having admin roles, using instead a trust-based system. In this project we will improve navigation and the user experience, allow for public sign-ups in activities and make self-hosting more appealing with custom pages (white-labeling) - all of which are requested by the community of groups using Karrot.

  ▸ For more details see: https://nlnet.nl/project/Karrot-UX

• Ruuti — Open-source EUDI-compatible development wallet

  It is a lot of work to test and verify that credential issuance and verification services are compliant and interoperable with the standards and wallets of the EUDI Wallet system. With every update, that work needs to be redone. The wallets typically used for testing are built for end users and mobile operating systems, which makes them difficult to run programmatically - and thus ill-suited to be used in automated end-to-end and interoperability tests.

  Ruuti is an open-source EUDI-compatible wallet that can be used as a target wallet and testing tool. It allows developers to quickly test the code they are working on. It makes writing and running automated tests easier and quicker, as it was designed with that in mind. These timesavings and overall improvements to the developer experience reduce the cost of development in the EUDI ecosystem as more gets done in less time.

  ▸ For more details see: https://nlnet.nl/project/Ruuti

• Sacr3d — Scheme-based graphics and math rendering toolkit

  sacr3d is a 3D graphics toolkit designed for creating and sharing procedural and mathematical visualizations with ease. Built for the web, sacr3d applications run in any modern browser, making them both interactive and effortlessly portable.

  sacr3d enables quick visualization and exploration of mathematical and procedural objects—from curves and surfaces to fractals. But its true strength lies in its hackable rendering pipeline, which invites users to experiment with unconventional rendering techniques and think about how mathematical objects can be visualized.

  sacr3d bridges the gap between creative coders, geometry researchers, and math students at all levels. Its goal is to make it easy to experiment with rendering techniques, so if you understand how an object can be visualized, implementing it in sacr3d should be intuitive and straightforward.

  ▸ For more details see: https://nlnet.nl/project/sacr3d

• Zotero Plugin Ecosystem and Infrastructure — Consolidate Zotero Research Management Platform plugin system

  This project aims to strengthen the infrastructure for Zotero plugin development. Zotero is a popular open-source research management tool with a large ecosystem of community plugins. However, plugin developers currently rely on fragmented, under-documented, or discontinued development tools, making plugin maintenance unnecessarily costly and starting a new plugin project unnecessarily complex. This project will consolidate and modernize the main open-source libraries already used by a large part of the Zotero plugin ecosystem, and extend features on top. The outcome will be a better organized, documented, and sustainable framework for out-of-the-box Zotero plugin development, with smoother TypeScript support, easier development, more reliable debugging and testing, and clearer onboarding for new contributors. Together, these tools will form the next-generation open infrastructure for long-term, maintainable Zotero plugin projects.

  ▸ For more details see: https://nlnet.nl/project/Zotero-plugin-ecosystem