Building a Robust SBOM Solution with Backstage.io
summary
Built a two-step SBOM pipeline integrated with Backstage that generates per-commit SHA SBOMs, runs tool scans (Black Duck/Synopsys by corporate mandate), queues requests via MQ to avoid overloading a limited license, signs artifacts and pushes them to JFrog Artifactory. Uses SPDX/CycloneDX formats, Bomber for tool-agnostic reporting and sbom-qS to enforce an 80% quality threshold. Addresses false positives and a typical 7-day vulnerability DB lag, and supports 20–30 concurrent product teams; the system is deployed and producing accessible, signed SBOMs for Broadcom.
AI-written summary · about
chapters (8)
- 0:00Introduction and Icebreaker
- 0:47Overview of SBOM and Talk Structure
- 1:47Speaker's Background and Achievements
- 2:17Understanding SBOMs and Their Importance
- 4:40Challenges in Implementing SBOMs
- 13:27Introduction to Backstage by Spotify
- 16:24SBOM Implementation Pipeline
- 21:33Conclusion and Q&A
related talks
36mSBOMs, VEX, and Kubernetes
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
27mSBOM: The Rest Of the Story
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
57mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
43mUsing SBOMs for Linux Foundation Projects
35mTransforming SBOMs from Compliance Burden to Security Asset