TechPrufer
Get started
Atlassian
Atlassian logoAtlassian · Feature trail

Software Bill of Materials (SBOM) Platform

2 posts · Nov 2024 – May 2025

What this trail covers

Atlassian has built a platform to generate Software Bill of Materials (SBOMs) for its repositories. This platform automates the process of creating SBOMs based on incoming commits, leveraging multiple open-source tools like Syft, cdxgen, and cyclonedx-maven-plugin to ensure comprehensive coverage across various technology stacks. The generated SBOMs are stored in S3 buckets and processed into a data lake for aggregation and analysis. This initiative aims to enhance software supply chain transparency.

All Atlassian trails
  1. Producing Software Bill of Materials a.k.a SBOMs for AtlassianThis post details the architecture and implementation of Atlassian's SBOM platform. It describes the scheduler component, which uses Bitbucket commit webhooks to trigger Kubernetes jobs. The SBOM Generator Jobs clone repositories and use tools like Syft, cdxgen, and cyclonedx-maven-plugin to produce SBOMs, which are then uploaded to S3. The SBOM Processor, an AWS Lambda function, parses these SBOMs and uploads them to the Atlassian data lake for aggregation and deduplication. The post also quantifies the platform's impact, reporting over 1MM SBOMs generated containing 1.8 billion packages.
  2. Evolving Atlassian's deployment controls enforcementThis post details the evolution of Atlassian's deployment controls, moving from an implicit trust model to a direct source and build provenance verification system at deployment time. It introduces the Artifact Metadata Store (Metadata-API) inspired by Grafeas, standardizing artifact metadata and centralizing its storage. The post describes the collection of build provenance from Bitbucket Pipelines and Bamboo Server, and how attestations are used to link artifacts to their builds and sources, including specific integrations with Artifactory, Config Registry, Bifrost, and Micros Providers. The focus is on minimizing developer friction by using an observation-based approach.