nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

App Signing rollout started: Time to boost App security

Malathi Vangalapati

Hello, Atlassian Community,

As we communicated in October 2024, in 2025 we’re rolling out app signing to significantly improve the security of app installations. This feature is designed to verify the integrity and origin of application files using a digital signature. In this way, only trusted applications can be installed on an instance. App signing affects only new app installations, previously installed apps will not undergo verification.

When will app signing be available?

The change is being gradually rolled out across Atlassian Data Center (DC) products in their next releases. To activate app signing, you will need to upgrade to the following product versions:

Jira Software and Jira Service Management 10.5 to be released in Mar 2025
Confluence 9.4 to be released in Apr 2025
Bitbucket 9.6 to be released in Mar 2025
Bamboo 11.0 to be released in the first half of 2025
Crowd 6.3 to be released in Mar 2025

Is app signing currently required?

Currently, app signing is disabled by default. The grace period will last until the next major releases of Atlassian DC products in Q3 and Q4 of 2025, after which app signing will be enabled by default.

When app signing is enabled, admins are required to configure it correctly and set up their Trust store, otherwise, customers will not be able to install any application.

What changes for the customers?

As a customer, use the grace period to adapt your processes. The steps you need to take differ depending on whether you install applications from the Marketplace or build your custom applications. In either case, the first step is to set up a Trust store and enable app signing. You will have full control over the Trust store, therefore, you can revoke or remove untrusted certificates. UPM will list all trusted certificates and notify admins about nearly expired ones.

You can also install the app via the file system without using the app signing feature.

Install signed apps from Marketplace

Enable app signing. For details, see Configuring UPM app signature check.
Download and install Certificate Authority (CA) from Atlassian. For details, see Updating Atlassian Certificate Bundles.
Enjoy the safe app installations from Marketplace.

Install custom apps

If you use custom application builds, you can sign and secure your apps:

Enable app signing. For details, see Configuring UPM app signature check.
Create app signature and verification certificate as described in Generating app signature and verification certificate using OpenSSL.
Put your new certificate in your Trust store similarly to Updating Atlassian Certificate Bundles.
Install the signed application.

If you’re experiencing issues, check out app signing troubleshooting or leave us a comment here.

Thanks for being part of this journey!

Comments

Metin _savignano software solutions_

I suppose I’m missing something, sorry. As I understand it, the procedure described in step 2 results in a separate signature file in PEM format, doesn’t it? How would it be incorporated in the jar file for its verification?

Ulrich Kuhnhardt _IzymesCo_

Can you please post a link or explanation on how MP vendors are supposed to create, sign and release apps with Certificate Authority (CA) from Atlassian to MP?

Charaf-Eddine SAIDI

Hi all, thanks for your questions.

As I understand it, the procedure described in step 2 results in a separate signature file in PEM format, doesn’t it? How would it be incorporated in the jar file for its verification?

The signature file is not part of the JAR file. When app signing is enabled, UPM provides a dedicated field on upload to specify the signature. See Install an app from a file documentation.

Can you please post a link or explanation on how MP vendors are supposed to create, sign and release apps with Certificate Authority (CA) from Atlassian to MP?

Marketplace partners can sign their private builds by following the steps described in Generating app signature and verification certificate using OpenSSL documentation. All apps published to the marketplace are signed by Atlassian, and no additional action is needed.

Metin _savignano software solutions_

Maybe I miss some point, but this appears overly complicated to me.

We have always been signing our apps during the build using the jar signer plugin. Doing so adds the signature as well as the certificate chain to the jar file. This means that the jar file has everything needed for a signature verification of the file. If Atlassian supported this standard, the admin could just upload the app as always and still have it checked.

There would be no need to handle separate signature files and/or manually install certificate bundles to accomplish the task.

Did Atlassian consider this approach? Am I overlooking any reason to implement it differently?

Charaf-Eddine SAIDI

Hi @Metin _savignano software solutions_

Last year, we published the RFC-39 Allowing installation of only signed apps on customer instances to present the different approaches we were considering. After the exploration phase, we've decided to opt for Option 3 which provides better control over the signing and verification process.

Metin _savignano software solutions_

I'm afraid, I couldn't follow your explanation how option 3 provides "better control over the signing and verification process". The RFC thread does not explain it either.

Metin _savignano software solutions_

Following the instructions how Marketplace partners can sign their private builds described in Generating app signature and verification certificate using OpenSSL, a few questions came up that aren't answered in above documentation. Could you answer them please if possible.

The example creates a certificate that is valid for 700 days, but it's not made clear if that is a requirement or just an example or perhaps a limit that should not be exceeded?
The example uses a self-signed certificate, but it's not made clear if that is a requirement. We would prefer to use a CA certificate that signs the app signing certificate and distribute the CA certificate to verify against. Is this possible or is support limited to self-signed certificates in the Atlassian platform?
Is there perhaps a Maven plugin that does this kind of app signing?

Thanks!

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira-data-center

data-center

bitbucket-data-center

confluence-data-center