Jira Software 9.15.x release notes

What is SBOM and why are we adding them?

SBOM is a detailed list or inventory of all the components in a piece of software. These components can include open-source software, proprietary code, libraries, frameworks, and other elements used in the software.

SBOM is essential for ensuring compliance with different regulations and standards; for example, the Executive Order on Improving the Nation's Cybersecurity on Improving the Nation's Cybersecurity, the European Union NIS 2 Directive and Cyber Resilience Act. It enhances transparency and facilitates a deeper understanding of software components, their versions, dependencies, and updates to their security vulnerabilities.

Furthermore, SBOM can help app developers and admins identify potential security risks, manage licenses, and maintain software more effectively. For example, if a vulnerability is discovered in a specific open-source component, anyone with access to SBOM can quickly check if their software is affected.

How is SBOM generated

We use Syft, an open-source tool, to automatically generate SBOM files during the product build process. Syft scans the code, identifies dependencies, and compiles a JSON file with the results. Syft supports various SBOM formats, with CycloneDX being Atlassian's current choice due to its popularity.

Where to find SBOM

To locate the SBOM, go to the sbom/ folder in the installation directory of your Atlassian product and search for a file named with either of the following patterns: <product_name>-<version>-cyclonedx-sbom.json or <product_name>-<version>-sbom.cdx.json.

Check an example for Jira Software 9.15:

atlassian-jira-software-9.15-cyclonedx-sbom.json

Important to know

Due to the complex, plugin- and component-based architecture of our product suite, we are gradually revealing all front-end dependencies. Our current SBOMs cover a portion of these dependencies.