Generating SBOM for Jira products

Question

Hello there,

I am currently looking for a way to differentiate 3 different Jira products: Jira Core, Jira Service Management, Jira Software. Currently, SBOM report is shipped together with the release. However, in previous version, for example, versions that were released in 2018, did not get shipped with SBOM.

I wonder if there is a good way to detect product name like atlassian-bamboo, atlassian-jira-core, etc. and its version in order to enhance our vulnerability management process.

Thank you

Chi T.

Rafał S_idrg1u · Answer

Hi Chi

This years releases shipped with improved SBOMs and the product name and version are both indicated in the filename [product-name]-[version]-[sbom-format](i.e. atlassian-jira-10.0.1.spdx) and in the files themselves - for example the SPDX files will contain a root package supplied by Atlassian that represents the overall product:

##### Package: atlassian-jira

PackageName: atlassian-jira
SPDXID: SPDXRef-DocumentRoot-Directory-atlassian-jira
PackageVersion: 10.0.1
PackageSupplier: Organization: Atlassian

or:

##### Package: atlassian-bamboo

PackageName: atlassian-bamboo
SPDXID: SPDXRef-DocumentRoot-Directory-atlassian-bamboo
PackageVersion: 10.0.1
PackageSupplier: Organization: Atlassian

similarly the CycloneDX format provides it in the metadata.component entry:

{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:479ed3f4-80e9-4678-b451-388915c33282",
"version": 1,
"metadata": {
"timestamp": "2024-09-09T08:54:00Z",
"tools": {
"components": [
 {
"type": "application",
"author": "anchore",
"name": "syft",
"version": "1.11.1"
 }
 ]
 },
"component": {
"bom-ref": "4b2619c6505ad143",
"type": "file",
"name": "atlassian-jira",
"version": "10.0.1"
 }
 },