Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Introducing Software Bill of Materials (SBOM) in our DC products

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 14, 2024

Continuing our commitment to providing the most secure products for our customers, we're pleased to announce that we'll now be providing Software Bill of Materials (SBOMs) for all Data Center products.

What is SBOM and why are we adding it?

An SBOM is a detailed list or inventory of all the components in a piece of software. These components can include open-source software, proprietary code, libraries, frameworks, and other elements used in the software development process.

The SBOM is essential for ensuring compliance with different regulations and standards, for example, the U.S. Executive Order on Improving the Nation's Cybersecurity, the EU NIS 2 Directive, and Cyber Resilience Act. It enhances transparency and facilitates a deeper understanding of software components, their versions, dependencies, and updates on their security vulnerabilities. This can help developers and users identify potential security risks, manage licenses, and maintain the software more effectively. For example, if a vulnerability is discovered in a specific open-source component, anyone with access to SBOM can quickly check if their software is affected.

When will SBOMs be available?

Atlassian will provide SBOMs for all Data Center products across all feature releases starting from the following versions:

    Product

    Version

 Bamboo  9.6.0 LTS
 Bitbucket  8.19.0
 Confluence   8.9.0
 Crowd  5.3.0
 Jira Software  9.15.0
 Jira Service Management 5.15.0

How an SBOM is generated?

We use Syft, an open-source tool, to automatically generate SBOM files during the product build process. Syft scans the code, identifies the dependencies, and compiles a JSON file with the results. Syft supports various SBOM formats, with CycloneDX being Atlassian's current choice due to its popularity. However, we're open and will consider other formats if there is increasing demand. Comment under this post if you’d like to see other formats included or leave general feedback about the change.

The content of the SBOMs complies with the set of required elements outlined by the United States National Telecommunications and Information Administration and contains the following elements:

  • supplier of the software

  • name of the tool used to generate the SBOM (Snyk)

  • timestamp when the SBOM was generated.

In addition, the SBOM contains a complete description of the artifact components:

  • component name and version

  • unique identifier (for example CPE / PURL / SWID)

  • relationship with other components

  • any additional information, such as licensing, repository information, description, or owner.

How to find SBOM?

To locate the SBOM, go to the sbom/ folder in the product installation directory and search for a file named according to the following pattern: <product_name>-<version>-cyclonedx-sbom.json.

Example SBOM location paths:

Jira Software: atlassian-jira-software-9.4.14-cyclonedx-sbom.json

Jira Service Management: atlassian-jira-servicedesk-5.4.14-cyclonedx-sbom.json

Limitations of current SBOMs

Due to the complex, plugin- and component-based architecture of our product suite, we are gradually revealing all front-end dependencies. Our current SBOMs cover a portion of these dependencies.

We are committed to transparency and have begun identifying any missing dependencies to guarantee that there are no surprises in our software. Our next step is to gradually incorporate their complete coverage in our SBOMs. We are giving priority to this task as it is essential for quality assurance, risk management, and maintaining your trust.

It will take some time to navigate these complexities, but we are confident that our efforts will result in more reliable software for everyone.

How to get information out of the SBOMs

You can get basic information from SBOMs using jq queries (). For a more detailed analysis, you may require dedicated tools. Here’s a list of some example queries:

  • Total number of components:
    jq '.components | length' sbom.json

  • Number of unique components:
    jq '.components | unique_by(.name) | length' sbom.json

  • Number of Maven components:
    jq '.components | map(select((.purl) | startswith("pkg:maven"))) | unique_by(.purl) | length' sbom.json

  • Number of NPM components:
    jq '.components | map(select((.purl) | startswith("pkg:npm"))) | unique_by(.purl) | length' sbom.json

Safeguard your business with Atlassian SBOM

The standardized format of the Atlassian SBOM facilitates smooth integration into automated security checks within other supply chains. Additionally, it eliminates the necessity for adjustments in security scans in response to changes in the product’s structure.

We have designed our SBOMs with a thorough understanding of our software, ensuring that they are accurate and reliable sources of information. Therefore, Atlassian recommends using provided SBOMs because they not only streamline your operations but also guarantee the security and reliability of your software.

8 comments

Comment

Log in or Sign up to comment
Maria Groth
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 14, 2024

What about availability for Atlassian cloud?

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 18, 2024

Hey @Maria Groth thanks for highlighting Cloud products. Currently, our SBOMs focus is on self-managed products.

Amar Khot
Contributor
March 15, 2024

Current form is good enough, thank you for this

Like # people like this
Dave Liao
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
March 17, 2024

@Aga Walczak-Karbowska - I think some of the images in this post are access-restricted? They’re not loading for me… (Try viewing them in an incognito window / not on VPN.) 👀 

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 18, 2024

Thanks for the heads up @Dave Liao! There should be no problematic graphics now.

Like Dave Liao likes this
Dave Liao
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
March 18, 2024

I see that, thank you! 🙏 

james.woodworth
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 20, 2024

AWK:  Read that the first SBOM available should be for Bitbucket (DC) v8.19.0 which is now out.  Any idea when the SBOM will be made available.  I also noted that they would be in the /sbom directory...any chance linking it to the release notes pages in the future...one-stop for most of us...

mkemp _Atlassian_
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 20, 2024

Hey @james.woodworth I've double checked that the `sbom` folder is present in the ZIP download of Bitbucket 8.19.0. Apologies the release notes haven't mentioned it. Thanks for the feedback about directly linking, we'll consider it! For our own understanding, could you please describe how you'll use the SBOM? Will there be automated ingestion? Is there anything processing it? etc.

Like Aga Walczak-Karbowska likes this
james.woodworth
I'm New Here
I'm New Here
Those new to the Atlassian Community have posted less than three times. Give them a warm welcome!
March 20, 2024

The DoD and NIST are pushing for programs to either obtain SBOMs from vendors or implement their own capabilities to produce them as part of their RFM/ATO supporting evidence.  It's not absolute mandatory right now, but heading that way.  Thanks for the heads up on the Bitbucket SBOM and we look forward to viewing the ones for Jira/JSM/Confluence down the road.  Again, would appreciate a direct link to the SBOM files from the release notes, just helps with release/patch management actions.  

Daniël
Contributor
March 26, 2024

@Aga Walczak-Karbowska , great development!

How is the SBOM implemented for Marketplace apps either developed bij Atlassian or third party suppliers?

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 26, 2024

@Daniël These SBOMs cover the core part of the mentioned products developed by Atlassian.

Daniël
Contributor
March 26, 2024

@Aga Walczak-Karbowska any plans for the future? 

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 27, 2024

@Daniël Right now, our focus is on gradually integrating front-end dependencies. We'll keep you updated with any new plans on our public roadmap.

Noah - Devsamurai
Contributor
March 28, 2024

It looks good to me. But I am wondering: How does an SBOM enhance software transparency and security, and what motivates its integration into the development process?

Aga Walczak-Karbowska
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
March 28, 2024

@Noah - Devsamurai, SBOMs are integral to the US National Cyber Security Strategy and the amended EU Cyber Resilience Act. They significantly improve the software selection process. With SBOMs, identifying vulnerable components becomes easier. They pave the way for targeted security analysis and source verification

Compliance with policies can be also ensured through SBOMs. They shed light on end-of-life components, offer insights into how software integrates, and aid in planning before purchase and installation, acting as a crucial market signal.

For more information on the benefits of SBOMs, you can check out this NTIA document.

Like Noah - Devsamurai likes this
Chihara
Rising Star
Rising Star
Rising Stars are recognized for providing high-quality answers to other users. Rising Stars receive a certificate of achievement and are on the path to becoming Community Leaders.
July 25, 2024

@Aga Walczak-Karbowska 

Bitbucket DC 9.0.0 is released on 22-Jul-2024.

But this release doesn't has SBOM.

When will Atlassian publish Bitbucket 9.x's SBOM?

J_Y_McRoberts August 7, 2024

It sound like the SBOMS will be made available on the Bitbucket server n the sbom directory.  Will there be a way for users to access the SBOM their code generates if they do not have access to the server?

TAGS
AUG Leaders

Atlassian Community Events