What happened to the Source Downloads?

I need to obtain the latest tarballs Jira and Confluence, on-premise versions. They used to be available from the My Atlassian Licenses page. Now when I click on Download Source on a product we still have an active license for (just like always), I get empty pages adorned with a pair of messages:

A) The product you requested is not available. Please contact us if you have any questions about accessing the source code.
B) There are currently no source downloads available for your license. Please contact us for further details.

Where did the source downloads go? We can’t properly develop and maintain the addons and support customers without sources…

3 Likes

@vivid,

Good question.

Our documentation still says my.atlassian.com is the right way to obtain source code. I haven’t seen any announcements here in the community or in the changelogs to indicate otherwise. It sounds like a mistake so I recommend following the advice in the messages; specifically, contact our customer support about “Pricing, billing & licensing”.

Hey Thanks @ibuchanan , I contacted them.

Yes, Atlassians hid the source code some time ago. This is what support says: “…we’ve temporarily restricted access to source code as a security measure in response to the recent advisory CVE-2023-22515 and we’ll share any additional information as it becomes available.”

3 Likes

@AlexeyDorofeyev,

Thanks for that update. I was not aware but it helped me search around to see if I could share more information. I did confirm this is the exact right path to get source code. In addition, one thing that can help your request get through is to link to your Marketplace vendor account and explain how you use the source code in development (I know it should seem obvious, but these procedures are not managed by Ecosystem or Server/Data Center engineering).

For now, I’ll leave this post open since this should be temporary. I’ll close when the source code is back to my.atlassian.com. Feel free to at-mention me if you have updates. That said, I’m not “in the loop” about this procedure so, please, no mentions to request status updates.

2 Likes

Thanks @AlexeyDorofeyev @ibuchanan We’ll see what happens…

Just received confirmation from Atlassian Support echoing the reason shared by @AlexeyDorofeyev.

So, we wait.

Link normal community post: https://community.atlassian.com/t5/Data-Center-questions/Why-is-source-code-no-longer-available/qaq-p/2517488

4 Likes

@ibuchanan @tpettersen is there a way for Atlassian to provide source code to Marketplace Partners separately from my.atlassian.com?

I fully understand that platform teams are not going to prioritise bringing back source code access to all customers, but not having access to source code really limits our ability to provide support to our mutual customers.

Would it be possible for someone to just upload these sources manually to https://atlassianpartners.atlassian.net for the time being?

6 Likes

Fyi, as a last resort we can contact Atlassian support and request individual source downloads on a per product-basis. I did that recently with Jira 9.4.latest + 9.12.latest and Confluence 8.5.latest + 8.7.latest, and Atlassian Support uploaded the requested ZIPs on my support tickets in a matter of 1-2 days. Not ideal, but better than nothing.

3 Likes

It’s now 6 months after CVE-2023-22515, and source downloads for all (?) products is still blocked:

Atlassian Support won’t provide downloads these days unless you escalate and make a scene.

Atlassian: please note the text in the screenshot:

“Your license entitles you to the source for the period of your license”

That text has been there for 20 years. The whole developer ecosystem was bootstrapped off this openness and developer-friendliness. Don’t screw it up now. The “security” explanation is completely implausible. In fact, it’s security researchers in the Bug Bounty program who now can’t do their job. Then there’s people like me, who professionally support these apps, who need source to debug otherwise intractable problems.

Please fix source code access, or if it’s gone for good, respect your partners, customers and own support staff by saying so.

4 Likes

Even then. I just experienced an interaction with Atlassian Support.

The party line seems to be that Atlassian will only provide those downloads within the scope of your active licenses (as it always has been). We used 10$ 10-user Server licenses as the means to access the Jira source tarballs upon which our product R&D depends. As of 2024 Feb 15, Server exits the picture, and even as an established vendor (plugins only, no license resales or Atlassian Expert / Partner qualification) with a history of making a trickle of money for Atlassian we are not eligible for source code access for Jira versions released after that dead-by date.

If our org is to receive continued access at this time, the only means I have thus identified thus far is for us to purchase the entry level Jira DC license, a 44,000 USD capital expenditure. Atlassian Experts appear to qualify for credits, but their business model is different from ours (VARs, SIers that resell licenses, who are credited depending on the Silver, Gold, etc. tier rankings their sales achieve).

Which begs the question: What is Atlassian’s current vision for 3rd-party plugin development for Data Center?

Edit: Thanks @remie :two_hearts:, that looks like the ticket!

1 Like

You can request a developer license (see Marketplace Partner DC Developer Licenses) and use the SEN of the developer license to request source code access for the product